---
type: "article"
title: "The Demand Report — Issue #11"
summary: "The Demand Report issue #11 cover — the crawler came back and the agents kept climbing. 5,551 MCP searches, a second consecutive all-time high; Stripe the most-searched name at 89; 15,050 bounces off the paid surface."
newsletter: "APIs.io"
newsletter_handle: "apisio"
newsletter_url: "https://usecommune.com/n/apisio"
author: "Kin Lane (@kinlane)"
published: "2026-09-28T18:24:36.164Z"
canonical_url: "https://usecommune.com/n/apisio/a/MxceWsAD"
markdown_url: "https://usecommune.com/n/apisio/a/MxceWsAD.md"
chat_url: "https://usecommune.com/n/apisio/a/MxceWsAD/chat"
body_source: "native"
likes: 0
replies: 0
body_words: 1976
---

# The Demand Report — Issue #11

*The crawler came back and took the headline number with it. Underneath, agents searched more than in any week this report has run — for the second week in a row — and the most-asked-for name on the human side was Stripe, six times over.*

**Week of September 21 – 27, 2026 · 27,575 providers · 139,197 APIs**

***

Every Monday I read what people and agents actually typed into [apis.io](https://apis.io/) — the search box and the MCP server — as a demand signal for the API economy. Nobody else has this data, so nobody else can send you this email.

***

## 📈 The Demand Report

**MCP searches came in at 5,551 — a new all-time high, up 17% on the week, and the first time this line has set a record two weeks running.** The series: 35 → 42 → 310 → 1,027 → 518 → 1,924 → 2,768 → 2,508 → 4,533 → 1,591 → 2,041 → 4,754 → **5,551**.

Everything else in the log moved the other way from last week. Total requests rose **229,355 → 363,576, up 59%**, keyless callers **159,227 → 240,399, up 51%** — and distinct terms *fell*, **5,474 → 5,185, down 5%**. More volume on a narrower vocabulary is the signature of one automated caller, and it is back. I do not count it as demand.

![This week vs last: total searches +59% to 363.6k, keyless API +51% to 240.4k, unique terms −5.3% to 5,185, MCP searches +17% to 5,551. Footnote: volume rose on fewer distinct terms — the crawler is back; the MCP bar is the one to believe](https://kinlane-images.s3.amazonaws.com/apievangelist/demand-report/issue-11-scoreboard.8913f42c.png)

That is what makes the agent line worth reading this week. It did not rise *with* the crawler. Share of all requests actually fell, 2.07% → 1.53%, because the denominator ballooned — the agent count climbed on its own, in absolute terms, while the rest of the log was being walked by a machine. And as last week, there is no templated block behind it: no MCP-bearing term anywhere in the top hundred, no run of near-identical counts on the agent side.

Two records back to back, on two very different weeks — one quiet, one noisy. That is the most durable thing this line has done.

### The human list is shopping for money

Strip out the crawl and the top of the human vocabulary is unusually concentrated:

| Term | Sep 14–20 | Sep 21–27 |
| --- | --- | --- |
| Stripe | 15 | **89** |
| Paylocity | 25 | **42** |
| Payments | 25 | **28** |
| Payment Agreement | — | **17** |
| payment | 14 | **14** |
| Micropayments | — | **8** |
| AP2 | — | **8** |

**Stripe went from 15 to 89 — the largest single named-provider search of the week by double.** Paylocity climbed a second straight week, 25 → 42: payroll, which is money moving the other direction. And `AP2` — Google's Agent Payments Protocol — and `Micropayments` turned up in the top hundred for the first time, next to `Payment Agreement`.

Read with the agent line, that is the week's shape: more agents than ever, and a human list asking how money moves through software. It rhymes with a post going up on the blog this Tuesday — a16z's twelve "agent-native" companies mostly move money.

Behind the payments cluster: `wp-json` (37, someone probing WordPress endpoints by name), `Developer Community` (22), `apibara` (17), `turvo` (16, freight TMS), `music`, `news`, `EA SPORTS FC`, `weather` down from last week's 66 to 13, and `HackerOne` (10) next to `Bug Bounty` (9).

### The gate

Bounces off the paid surface rose with the traffic: **11,331 → 15,050**, across 24 resources. `cohorts` **4,522 → 6,723**, the most reached-for gated resource for the fourth week; `security` 3,543 → 4,710; `scopes` 525. The smaller lines are the ones that moved: `insights` **89 → 185**, `agent-readiness` 38 → 66, `stack` 17 → 46, `changes` 8 → 31 — the "what changed, what should I build with, is it ready for an agent" questions, each roughly doubling.

The authenticated tiers stay off the scoreboard. `pro` reads 23,958 this week, and the tag-quality pass ran again on my own Understanding key, on four days of the seven; I will not print those tiers as demand until the log can tell my keys from a subscriber's.

***

## 🕳️ The Gaps (demand we couldn't answer)

The pipeline saw **779 raw unmet terms**, dropped 299 as noise and 303 the catalog can now answer, and kept **177**, down from 204. The dictionary walk has moved on to words like `disafforest`, `frogmarch`, `gazump` and `pullulate`; the operation-name reader is still sending back things like `returntoauthor` and `pluginconfig`.

`schlage encode` was dropped before the chart was drawn — Schlage is an Allegion brand and Allegion is indexed with five APIs. A phone number followed by `Opay` was dropped as noise; OPay itself is in.

Eight rows, each re-probed against the live search this morning and still returning nothing:

![The Gaps — top zero-result searches: zerodha and paypercall at 3×; idfcfirst, airtelmoney, melhor envio, anvisa, impinj and undersea cable at 2×](https://kinlane-images.s3.amazonaws.com/apievangelist/demand-report/issue-11-gaps.23e5bfb3.png)

- **zerodha** (3×) — India's largest retail stockbroker. It publishes a real, public trading API, Kite Connect. The sharpest row on the list: the API exists and we don't carry it.
- **paypercall** (3×) — a pay-per-call performance marketing network. `performance marketing` was in the top hundred too, at 8.
- **idfcfirst** (2×, plus 2 as `idfcfir` and 10 as the bank's domain, which returns other banks) — IDFC FIRST Bank. Fourteen attempts across three forms.
- **airtelmoney** (2×) — Airtel Money, mobile money across Airtel Africa's markets. The spaced form finds a partner that integrates it, not Airtel.
- **melhor envio** (2×) — Brazil's shipping aggregator, with a public API for quotes, labels and tracking.
- **anvisa** (2×) — Agência Nacional de Vigilância Sanitária, Brazil's health regulator.
- **impinj** (2×) — RAIN RFID chips, readers and the platform behind them. The machine layer, a fourth week running.
- **undersea cable** (2×, plus 2 as `maritime cable`) — subsea cable data. Read it next to the resilience stack from #09 and #10: outage, network status, flight tracking, emergency alerts — and now the cables underneath. A post going up today says maritime has 67 providers on apis.io and none above developing.

**India and Brazil, twice each.** Zerodha, IDFC FIRST and Airtel Money is a retail-finance shopping list for one market; Melhor Envio and Anvisa is logistics and regulation for another.

`apifootball` came back at 4× — a fifth week. `croxyproxy` came back at 3×, a second week.

**If you build in one of these lanes, this is your invitation.** Add your API in about two minutes: [**apis.io/add**](https://apis.io/add) — or point your agent at the [apis.io MCP server](https://apis.io/) and let it submit for you.

***

## 🆕 New to the Index

The deployed index reads **27,575 providers and 139,197 APIs**. Providers up 9; APIs down 3,294. That line counts specification files, not products, and it moves both ways.

The MCP lines moved more in one week than in the previous month:

|   | Last Monday | Today |   |
| --- | --- | --- | --- |
| MCP entries (all) | 5,270 | **6,714** | \+1,444 |
| — hosted endpoints | 1,445 | **2,499** | **+1,054** |
| — hosted, answering with an auth challenge | 21 | **751** | \+730 |

To be plain about what that is: a week of the catalog finding servers, not a week of the market launching them. Airtable, Box, Contentful, Amplitude and Axiom are among the hosted endpoints on the index today that weren't last Monday. None of them is new; the index caught up to them. The number worth keeping is the last row: **751 hosted MCP endpoints answer an anonymous caller with an auth challenge** rather than a 404 or a login page. That is the population where "can an agent get in on its own" is a real question, and it just got more than thirty-five times bigger.

Thirty-five posts are queued for the week. Among them:

- [**a16z's twelve agent-native companies mostly move money, and OpenAI is not one of them**](https://apis.io/blog/)
- [**Maritime has 67 providers on apis.io and not one scores above developing**](https://apis.io/blog/)
- [**Kinde scores exemplar, and its own MCP server is not allowed to update or delete**](https://apis.io/blog/)
- [**DoorDash Drive Refunds puts the whole refund policy in one operation**](https://apis.io/blog/)
- [**The Nordics grew to 165 providers, and the region still cannot see Spotify, Tink or Trustly**](https://apis.io/blog/)
- [**Logistics has 670 providers, and the carriers score below the software built on top of them**](https://apis.io/blog/)

All on the [apis.io blog](https://apis.io/blog).

***

## ⭐ Rated This Week: Stripe — what an agent finds at the door

*This week's angle: Stripe was the most-searched name of the week, on the week agents searched most. So: what does an agent actually find when it knocks?*

|   | Stripe |
| --- | --- |
| **Kin Score** | **81.6** exemplar |
| **Agent Readiness** | **58.3 agent-native** |
| Contracts / callable | 71 / 100%, none derived by us |
| Payments regulatory layer | 53.6 |

Agent-native is the top band, and it is gated: you only get there by documenting idempotency *and* error semantics. Stripe does both — the `Idempotency-Key` header has been part of how you call Stripe for as long as most readers have been calling it. That is the part of the band most providers never reach.

The part I checked this morning is the door. `mcp.stripe.com` is Stripe's own hosted MCP server. An anonymous `initialize` gets the right refusal:

```javascript
HTTP/2 401
www-authenticate: Bearer resource_metadata="https://mcp.stripe.com/.well-known/oauth-protected-resource"
```

Follow it and there is a real RFC 9728 document naming the resource and its authorization server, `access.stripe.com/mcp`. That server publishes RFC 8414 metadata with a **dynamic client registration endpoint** and PKCE `S256`. A made-up `.well-known` path on stripe.com returns 404, so none of this is a catch-all.

Put together: **an agent that has never heard of Stripe can find the door, learn who guards it, register itself as a client, and ask a human to approve it — without a developer pasting a key.** That's the whole unaided path, and it's rarer than it should be for a company this size.

**The cheapest points left on the table are all declarations, not engineering.** There is no `/.well-known/api-catalog` on stripe.com or api.stripe.com, and no A2A agent card — both 404 today. Stripe has built the hard part of agent access and not yet put up the sign that says where it is. An RFC 9727 catalog pointing at 71 contracts and one MCP server is an afternoon's work.

*Kin Score rubric 0.23.0, scored 2026-09-25. Bands: exemplar 66.5+ · strong 54.3–66.4 · developing 39.3–54.2 · thin 26.2–39.2 · emerging 11–26.1 · minimal 0–10.9. Agent Readiness: agent-native 38.7+ (gated on idempotency AND error semantics) · agent-ready 28.6–38.6 · agent-aware 5.1–28.5 · human-only 0–5.*

***

## 🤖 Reproduce this yourself

Stripe's rating bands, no key required:

```javascript
find_providers(providers=["stripe"], fields=["slug","score","agent_readiness","api_count"])
```

Then the door, the way I checked it:

```javascript
curl -s -D - -o /dev/null -X POST https://mcp.stripe.com \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{}}' \
  | grep -i www-authenticate

curl -s https://access.stripe.com/.well-known/oauth-authorization-server/mcp
```

And the count that moved this week:

```javascript
find_mcp(install_method="Hosted endpoint", limit=1)
```

`meta.total` reads **2,499**, up from 1,445 last Monday.

Or read the demand data directly: [**apis.io/search-terms/**](https://apis.io/search-terms/), refreshed every Monday.

***

**27,575 providers. 139,197 APIs. 5,551 agent searches — a second record in a row, set on a week the crawler did its best to drown out.** See a gap that's yours? → [**apis.io/add**](https://apis.io/add)

*The Demand Report is a weekly read of apis.io's own search + discovery signal. Forward it to someone who ships an API.*

***

## Discussion

No replies yet.