|
As the number of APIs I profile for APIs.io continues to
expand, so does the surface area of this newsletter. The
number of blog posts providers publish shifts from week to
week, but I did another refresh of API provider blog
sources, which resulted in me reading 12,767 posts from 2,795 provider blogs, up from 7,816 posts from 1,705 blogs the week before.
There is no way I can read all of these posts, but I can
quickly filter them by topic and keyword using blogs.apievangelist.com, which has essentially become my new feed reader. From
there I prioritize the week's themes and trends, and
align them with the storytelling I am doing on the API
Evangelist and APIs.io blogs. The result is the breakdown
in this newsletter each week, capturing the pulse of the
API space powering the AI market.
MCP and Agent Skills definitely dominate the conversation,
but this process lets me keep my finger on the API signal
within all of the AI noise, showing how important APIs
have become even as the vocabulary on the street shifts.
|
|
A dark neon observatory where a great circular lens
on a pedestal has come into focus, its sharp centre
revealing a dense field of lights that blurs into
soft points around it.
|
Agent Skills Became a Supply Chain
Three weeks ago I wrote that Skills over MCP is final, and now it needs servers. This week one of the biggest arrived: the Cloudflare API MCP server now serves Cloudflare
skills through the Skills over MCP extension. Clients that support it discover them with skills/list and read the files at skill:// URIs. A skill is no longer a folder you copy into a
repo. It is something a server hands an agent at
connection time.
|
|
A dark neon loading dock where a long conveyor
carries small glowing parcels toward a waiting
angular vessel, most parcels shining clean blue
while one in the line glows a faint wrong red, and a
single scanning arch stands over the belt.
|
The same week, the security industry started treating
skills the way it treats packages.
Put those together and the shape is clear. Skills are now
distributed by servers, consumed by agents, and attacked
like packages — all in the same week. The thing nobody has
yet is the provenance layer between them: who wrote this
skill, what it is allowed to do, and whether the copy your
agent just loaded is the one that was published.
|
|
A dark neon hall where a long row of identical
angular doorways each carries the same glowing
interlocking lock, and a small light-vessel passes
through one of them as its lock opens in a clean
ring of light.
|
MCP Authentication Grew Patterns
Two weeks ago the MCP auth story was a list of bugs. This
week it was a list of patterns, which is what maturity
looks like from the outside.
The protocol is also getting the long-running pieces it
was missing. Upstash explained MCP Tasks and the proposed MCP
Events — durable long-running tools and agents that wake up —
and Google took the MCP Toolbox Java SDK to 1.0.
|
|
A dark neon city road where two glowing gates stand
side by side, one a single bright arch and the other
a pair of interlocking rings, with small
light-vessels passing through each.
|
From the research: Delivering a Modern API Integration Page with
Arazzo
You should not be building integrations anymore. You
should be describing them. An integration is two ends and
a wire — both ends already publish OpenAPI, and Arazzo is
the wire. This paper turns the integrations page from a
gallery of connectors into a directory of forkable
workflows.
Read the paper
Agents Started Choosing Between Payment Rails
Last week the story was that you can now charge an agent
per call. This week the people doing it started comparing
notes.
The common thread with the last section: every one of
these rails needs to know which agent is paying. That is
the problem I spent the week working on myself.
|
|
A dark neon plain covered in thousands of tiny
identical markers in rigid catalogue rows, with a
handful of larger, distinct structures standing out
among them.
|
MCP, Counted Honestly at a New Scale
The wider pull changed the MCP count more than anything
else, and almost all of the change is one kind of source.
Of 196 titles naming MCP this
week, 113 come from three MCP directories
the fix brought into view — vinkius.com, neuronto.com and
agentalog.com — which publish one auto-generated listing
per server, not posts. Four more are PyPI releases. Take
those out and there are 79, in a pool of
12,654 posts — about 0.6%. Last week was about 0.85% on a
smaller, narrower pool. I am not going to call that a
decline; the new coverage reaches a lot of blogs that were
never going to write about MCP.
What the posts themselves said:
-
The help-centre pattern is now everywhere — Planhat published four pages on MCP plugins in a
day, with QuotaPath, Nimble, Testlio and CompanyCam not
far behind.
-
The launches: Bubble shipped Agent 2 and the Bubble MCP, PagerDuty the Rundeck MCP server, Hashnode an MCP server for managing your blog, and Redis wrote up how it built its docs MCP for
agents so agents stop answering from pretraining.
-
The "which surface" debate continued: Playwright CLI vs MCP vs Kane CLI, compared on
tokens, turns and reliability, Semgrep on MCP giving agents tools while hooks give
security control, and GC AI on what it learned building more than twenty
agent connectors for legal work. And from the people who generate SDKs for a
living, APIMatic asked what SDKs are for, twelve years
on.
|
|
A dark neon cartographer's table seen from
above where a single luminous blueprint lies
unrolled, a bright ring of nine connected nodes at
its centre, and a small glowing badge resting at the
edge of the map.
|
From My Desk: Know Your Agent, and the End of a Nine-Part
Series
Across 12,767 third-party posts, OpenAPI appeared in two
titles, both from Scalar, on generating it from ASP.NET Core and from FastAPI. The wider lens did not change that ratio at all.
-
Know Your Agent. An agent cannot fill
in a signup form, and the form was never really about
authentication — it was how a provider found out who
it was dealing with. So we shipped the other half of Know Your Agent on APIs.io: an agent that signs up for your API should arrive
with a record, every fact graded by how we know it,
and two numbers — disclosure and verification — never
collapsed into one. That is my answer to the question
both sections above keep asking.
-
The Kin Score, facet by facet, finished. Nine posts, one facet a business day: this week access clarity, operational transparency, create-or-update ergonomics, open source surface and regulatory posture. Meanwhile Nylas moved into first place on APIs.io at 93.2, past HubSpot, Salesforce and Harness, and I ranked 79 industries by programmability — the opportunity is at the bottom of the table.
-
Specifications, from the inside. OpenAPI 3.2, a year on: most API tooling cannot
read it, following one in ten providers still publishing Swagger. Overlay 1.2 and the fourteen jobs we already use it
for, and an overlay is a layer, not a diff. I sat in on three specification calls in one Thursday, learned what JOSE actually is, and wrote about how we used to ask the clients, and now we unleash the
dogs.
-
And some opinions. It is called API design, you MCP hustlers. Twenty-four agent bundles and not one MCP server. 984 companies hiring, and 99 of them say OpenAPI. Business capabilities provide the context you need
for AI engineering. Who took my API catalog last week, and how much of
it. What I learned running the profiling pipeline on
gpt-oss-120b.
-
The doors into APIs.io. Everything you can do with the APIs.io API — 164 operations — and the 141 tools in the APIs.io MCP server. And a note on this newsletter itself: Commune shipped an API, and our newsletters are
moving onto it.
I want to end where the skills section left off. An agent
loading a skill gets every signal that things are working
— the skill loads, the tools appear, the calls succeed —
and nothing tells it whether what it is running is what
was published. The same goes for the agent paying for a
call and the server deciding to let it in. Every layer of
this stack is now trusting something it has not checked.
You only find that out by going and looking.
See you next week.
🔌 APIs.io — Know Your Agent — If you run an API and agents are starting to sign up
for it, this is the part of APIs.io I would point you at
this week. An agent publishes an A2A card, registers it,
and builds a record with us — who operates it, how to
reach them, what it is for — with every fact graded
verified, attested, declared or absent. When that agent
signs up for your API, the record can travel with it, so
you get back the thing the signup form used to give you:
who you are dealing with.
Start at apis.io/kya to see what a record holds.
|
