---
type: "article"
title: "The Demand Report — Issue #13"
summary: "The Demand Report issue #13 cover — agents nearly tripled, and the refund question is still climbing. 8,978 MCP searches, an all-time high; 59 searches for refunds, the top human term; 60,502 bounces off the paid surface."
newsletter: "APIs.io"
newsletter_handle: "apisio"
newsletter_url: "https://usecommune.com/n/apisio"
author: "Kin Lane (@kinlane)"
published: "2026-10-12T14:48:04.159Z"
canonical_url: "https://usecommune.com/n/apisio/a/oqy6qnCm"
markdown_url: "https://usecommune.com/n/apisio/a/oqy6qnCm.md"
chat_url: "https://usecommune.com/n/apisio/a/oqy6qnCm/chat"
body_source: "native"
likes: 0
replies: 0
body_words: 1762
---

# The Demand Report — Issue #13

*Agents searched apis.io nearly three times as often as last week, a new record by a wide margin. The human list kept asking the question it started asking last week, how do I give the money back, and this week I went and checked who lets an agent ask it safely.*

**Week of October 5 – 11, 2026 · 29,988 providers · 147,572 APIs**

***

Every Monday I read what people and agents actually typed into [apis.io](https://apis.io/) — the search box and the MCP server — as a demand signal for the API economy. Nobody else has this data, so nobody else can send you this email.

***

## 📈 The Demand Report

**MCP searches came in at 8,978 — up 156% on the week, and 62% above the previous record of 5,551.** The series: 4,533 → 1,591 → 2,041 → 4,754 → 5,551 → 3,508 → **8,978**.

Nothing in my own tooling explains it. The tag-quality pass ran on five days this week, but it calls the REST API on a key, not the MCP server. There's no templated block behind it either: no MCP-bearing term anywhere in the top hundred. Share of all requests rose to 1.33%, even on a record denominator.

The rest of the scoreboard was the machine again. Total requests rose **516,891 → 673,315, up 30%, a new high for the run**, and keyless callers **331,092 → 490,436, up 48%** — while distinct terms *fell*, **5,279 → 5,110, down 3%**. More volume on a narrower vocabulary is one automated caller. I don't count it as demand.

![This week vs last: total searches +30% to 673.3k, keyless API +48% to 490.4k, unique terms −3.2% to 5,110, MCP searches +156% to 8,978. Footnote: volume set a record on fewer distinct terms — a machine; the MCP bar is a new all-time high](https://kinlane-images.s3.amazonaws.com/apievangelist/demand-report/issue-13-scoreboard.838a28fd.png)

### The refund question held

Last week `refunds` entered the top hundred for the first time, at 48. **This week it's the top human term, at 59.** One week is a blip; two rising weeks is a question people are actually asking.

| Term | Sep 28–Oct 4 | Oct 5–11 |
| --- | --- | --- |
| refunds | 48 | **59** |
| Payments | 43 | **47** |
| stripe | 13 | **34** |
| pix | — | **10** |
| payment | — | **10** |
| gold price API | — | **10** |

Stripe came back up to 34. `pix` — Brazil's instant-payment rail — showed up at 10. Payments-shaped searches have sat at the top of the human list three weeks running now.

### The resilience stack came back

The five-term cluster from #09 and #10 returned to the top hundred, smaller and still in a tight band: `aviation ADS-B flight API` 15, `satellite earth observation API` 15, `critical infrastructure outage API` 13, `emergency management alert API` 13, `telecommunications network status API` 13. That makes three appearances in five weeks for the same five sentences. Somebody keeps checking.

### The gate

Bounces off the paid surface went **12,716 → 60,502** — almost five times last week. Nearly all of it is two resources: `cohorts`** 5,491 → 29,227** and `security`** 3,854 → 23,334**. Growth that concentrated in two endpoints looks like one caller working through them, so I'm reporting it as an ask, not a crowd. Even so, the shape hasn't changed in six weeks. The most reached-for thing behind the gate is still "rank this group," and the second is still "what does this API's security look like." `scopes` doubled again, **935 → 2,084**.

The authenticated tiers stay off the scoreboard. `pro` reads 82,521, and that's the tag-quality pass on my own Understanding key.

***

## 🕳️ The Gaps (demand we couldn't answer)

The pipeline saw **694 raw unmet terms**, dropped 315 as noise and 240 the catalog can now answer, and kept **139**, down from 176.

Three candidates were dropped before the chart was drawn because the provider is already indexed and only the spelling missed: `keepersecurity` (Keeper Security is in), `delinea totp` (Delinea is in, with over a hundred APIs) and `hostelworld room` (Hostelworld is in).

Eight rows, each re-probed against the live search this morning and still returning nothing:

![The Gaps — top zero-result searches: gracely at 6×; aggreg8 and divineshop at 4×; pawapay, ifthenpay, emiratesnbd, adirondack trust and indosat at 2×](https://kinlane-images.s3.amazonaws.com/apievangelist/demand-report/issue-13-gaps.1d86aeb2.png)

- **gracely** (6×, plus 4 as `gracely church` and more as it was typed out) — church management software. The most-searched genuine gap of the week.
- **aggreg8** (4×) — Australian pay-by-bank and financial-data aggregation.
- **divineshop** (4×) — a Vietnamese store for software licences and game keys.
- **pawapay** (2×, plus 2 as `pawapa`) — a mobile-money payments API across African markets. A company whose product *is* an API, and we don't carry it.
- **ifthenpay** (2×, plus 6 as the name was typed letter by letter) — the Portuguese gateway behind Multibanco references and MB WAY.
- **emiratesnbd** (2×) — Emirates NBD, one of Dubai's largest banks. The spaced form returns other companies that mention it.
- **adirondack trust** (2×) — a community bank in Saratoga Springs, New York.
- **indosat** (2×) — Indosat Ooredoo Hutchison, the Indonesian telco.

**Five of eight rows are money:** two banks, a pay-by-bank aggregator, and two payment gateways, from Australia, Portugal, Africa, the UAE and upstate New York. Banks and payment rails have now filled this section three weeks running: India and Brazil, then Colombia and Denmark, now this.

`croxyproxy` came back a fourth week, at 8×.

**If you build in one of these lanes, this is your invitation.** Add your API in about two minutes: [**apis.io/add**](https://apis.io/add) — or point your agent at the [apis.io MCP server](https://apis.io/) and let it submit for you.

***

## 🆕 New to the Index

The deployed index reads **29,988 providers and 147,572 APIs** — up 1,177 providers and 3,677 APIs on the week. That's the second week in a row above a thousand new providers. As always, the API line counts specification files, not products.

|   | Last Monday | Today |   |
| --- | --- | --- | --- |
| MCP entries (all) | 6,800 | **6,591** | −209 |
| — hosted endpoints | 2,508 | **2,278** | −230 |

Twenty-eight posts went up on the blog last week, and more than half were about MCP and agents. Among them:

- [**Cloudflare's MCP portals go GA, and its own record is already agent-native**](https://apis.io/blog/)
- [**Instrumentl's only public API is an MCP server, with eleven write tools and no contract**](https://apis.io/blog/)
- [**Kong gives every Dev Portal an MCP server, and the catalog lost track of Kong's**](https://apis.io/blog/)
- [**AWS names uncontrolled delegation as the root flaw, and Bedrock's record has no delegated identity**](https://apis.io/blog/)
- [**Zyte lets an agent into a running Scrapy crawl, with no read-only mode**](https://apis.io/blog/)
- [**APIs.io Insights reads 343,299 job postings for the APIs 984 companies name**](https://apis.io/blog/)

All on the [apis.io blog](https://apis.io/blog).

***

## ⭐ Rated This Week: Adyen — the refund tool that doesn't carry a key

*This week's angle: refunds held the top of the human list, on the week agents searched most. Last issue was Square, where an agent can't refund twice. This week is the other way to build it.*

|   | Adyen | Square (last issue) |
| --- | --- | --- |
| **Kin Score** | **66.1** strong | 75.9 exemplar |
| **Agent Readiness** | **43.0 agent-native** | 60.6 agent-native |
| Refund idempotency key | **optional** | required |
| MCP server | official, **local, API key** | official, hosted, OAuth |

Both are agent-native. Both document idempotency properly — Adyen accepts an `Idempotency-Key` header on its refund call, up to 64 characters, and the scorecard verifies it. The difference is one word in the contract. In Adyen's own published spec, the key is `required: false`. Square makes it required. An agent that never sends one gets no protection from Adyen if it retries.

That matters more than it sounds, because Adyen ships an official MCP server, `@adyen/mcp`, and **one of its tools refunds a captured payment.** I read the source this morning, at the latest commit (September 11). The refund tool takes a PSP reference, currency, amount, merchant account and your reference, and calls Adyen's refund endpoint. **There's no idempotency key in the tool's inputs, and the server never adds one.** The word doesn't appear anywhere in the server's code. So the safety Adyen's API offers is never used by the agent tool Adyen built.

The door is a different design too. The server runs on your machine via `npx`, with an Adyen API key in an environment variable. There's no hosted endpoint and no OAuth. The README is sensible about it: make a new webservice user, and limit its roles to the tools you'll use. But a key in an environment variable can do whatever that key can do, and there's no consent step between an agent and a refund.

**The cheapest points left are in the tool, not the API.** Generate an idempotency key per refund call inside `@adyen/mcp` and Adyen's existing safety reaches every agent using it. That's a few lines. Beyond that: no `/.well-known/api-catalog` on adyen.com or docs.adyen.com (both 404), no delegated identity, no protected-resource metadata, and contract governance at 27.3 — the same lowest facet Square had.

Adyen built the safety into the API and left it out of the agent tool. For a payments API, the agent tool is where it's needed most.

*Kin Score rubric 0.23.0, Adyen scored 2026-10-11. Bands: exemplar 66.5+ · strong 54.3–66.4 · developing 39.3–54.2 · thin 26.2–39.2 · emerging 11–26.1 · minimal 0–10.9. Agent Readiness: agent-native 38.7+ (gated on idempotency AND error semantics) · agent-ready 28.6–38.6 · agent-aware 5.1–28.5 · human-only 0–5.*

***

## 🤖 Reproduce this yourself

Adyen and Square, side by side, no key required:

```javascript
find_providers(providers=["adyen","square"], fields=["slug","score","agent_readiness","api_count"])
```

The refund call's idempotency header, from Adyen's own spec:

```javascript
curl -s https://raw.githubusercontent.com/Adyen/adyen-openapi/main/json/CheckoutService-v71.json \
  | jq '.components.parameters["Idempotency-Key"].required'
```

It prints `false`. Then the agent tool:

```javascript
git clone --depth 1 https://github.com/Adyen/adyen-mcp
grep -rni idempotenc adyen-mcp --include='*.ts' | grep -v node_modules
```

It prints nothing.

Or read the demand data directly: [**apis.io/search-terms/**](https://apis.io/search-terms/), refreshed every Monday.

***

**29,988 providers. 147,572 APIs. 8,978 agent searches, a record by a mile — and the human list is still asking how to give the money back.** See a gap that's yours? → [**apis.io/add**](https://apis.io/add)

*The Demand Report is a weekly read of apis.io's own search + discovery signal. Forward it to someone who ships an API.*

***

## Discussion

No replies yet.