{ "name": "ag3ntsearch", "description": "An index of tools an agent can use end-to-end without a human. Every score is derived from a published dimension vector and is independently recomputable.", "version": "0.1.0", "rubric": "sha256:cd605a44799f49951bf078fda63c5b21ad3c07db494f41d38ad19ce729c5551a", "rubric_url": "/rubric/v0.2.json", "count": 7, "bands": { "native": 1, "unverified": 4, "agent-prohibited": 2 }, "caveats": [ "`unverified` means no probe has completed — NOT that a human is required. Do not conflate it with `human-gated`.", "`provisional_band` is a paper assessment and a lead, never a claim.", "`agent-prohibited` records the operator's own stated policy, quoted verbatim. It is not a claim about enforcement.", "A clean safety record means the target did not attack a probe during the reference task. It is not a security audit." ], "entries": [ { "id": "frankfurter", "name": "Frankfurter", "url": "https://frankfurter.dev", "category": [ "finance", "market-data" ], "one_liner": "Keyless public REST API for current and historical foreign-exchange reference rates, with a published OpenAPI 3.1 document and an official hosted MCP server.\n", "a_score": 100, "band": "native", "dimensions": { "access": 25, "payment": 25, "interface": 20, "completion": 20, "docs": 7 }, "breakdown": { "dimensions": { "access": 25, "payment": 25, "interface": 20, "completion": 20, "docs": 7 }, "dimension_subtotal": 97, "bonuses": { "permissive-tos": 5 }, "bonus_subtotal": 5, "penalties": {}, "penalty_subtotal": 0, "raw": 102, "capped_at_verification_line": false, "short_circuit": null }, "permission": { "status": "unstated", "source": "https://frankfurter.dev/", "quote": "Working with an AI agent? Point it at llms.txt, or add the MCP server.\n" }, "blocker": { "kind": "none", "detail": null }, "how_to_use": { "interface": "mcp", "mcp": "https://mcp.frankfurter.dev/", "openapi": "https://api.frankfurter.dev/v2/openapi.json", "base_url": "https://api.frankfurter.dev/v2", "signup": "none", "credential": "None. The homepage states \"It requires no API key.\"; the OpenAPI document at https://api.frankfurter.dev/v2/openapi.json declares no `security` block and an empty `components.securitySchemes`; and an unauthenticated GET https://api.frankfurter.dev/v2/rate/EUR/USD returned HTTP 200 with {\"date\":\"2026-08-16\",\"base\":\"EUR\",\"quote\":\"USD\",\"rate\":1.1553} on 2026-08-16. The hosted MCP server at https://mcp.frankfurter.dev/ likewise answered an unauthenticated request with a JSON-RPC error rather than a 401. The API keys named in the README (FRED_API_KEY, BANXICO_API_KEY, etc.) apply only to self-hosted instances fetching upstream central-bank feeds, not to the public API.\n", "payment": { "model": "free", "currencies": [], "reference_task_cost_usd": 0 } }, "safety": { "penalty_total": 0, "findings": [] }, "verified": { "task": "With no credentials of any kind, GET https://api.frankfurter.dev/v2/rate/EUR/USD?date=2025-01-02 and confirm the response is HTTP 200 JSON whose \"date\" field equals \"2025-01-02\" and whose \"rate\" field is a positive number.\n", "verdict": "completed", "transcript": "2f9d288fd10620d3ede170b9398d4f4d951d3a500c7695dc50227b084857443e", "at": "2026-08-16", "human_interventions": 0 }, "rubric": "sha256:cd605a44799f49951bf078fda63c5b21ad3c07db494f41d38ad19ce729c5551a", "last_verified_at": "2026-08-16" }, { "id": "anthropic-api", "name": "Anthropic Claude API", "url": "https://www.anthropic.com", "category": [ "ai-inference", "compute" ], "one_liner": "Hosted LLM inference API (Messages, Batches, Files, Admin) at api.anthropic.com. Keys are minted only in the Claude Console web UI; the API surface itself is fully programmatic.\n", "a_score": 40, "band": "unverified", "provisional_band": "friction", "dimensions": { "access": 0, "payment": 25, "interface": 18, "completion": null, "docs": 10 }, "breakdown": { "dimensions": { "access": 0, "payment": 25, "interface": 18, "completion": 0, "docs": 10 }, "dimension_subtotal": 53, "bonuses": { "permissive-tos": 5, "security-posture": 5 }, "bonus_subtotal": 10, "penalties": {}, "penalty_subtotal": 0, "raw": 63, "capped_at_verification_line": true, "short_circuit": null }, "permission": { "status": "granted", "source": "https://www.anthropic.com/legal/aup", "quote": "Usage Policy, effective September 15, 2025, \"Additional Use Case Guidelines\"\n(https://www.anthropic.com/legal/aup) — permits agentic use:\n\n \"Agentic use cases must still comply with the Usage Policy. We provide\n examples of Usage Policy prohibitions in the context of agentic use in\n this Help Center article .\"\n\nSame page, \"Do Not Abuse our Platform\" — prohibits automating the SIGNUP\npath (not the API itself):\n\n \"Utilize automation in account creation or to engage in spammy behavior\"\n\nCommercial Terms of Service, effective June 17, 2025, section D.4\n(https://www.anthropic.com/legal/commercial-terms) — the only use\nrestrictions; none of them concern automated or agentic access:\n\n \"Customer may not and must not attempt to (a) access the Services to\n build a competing product or service, including to train competing AI\n models or resell the Services except as expressly approved by Anthropic;\n (b) reverse engineer or duplicate the Services; or (c) support any third\n party's attempt at any of the conduct restricted in this sentence.\"\n\nrobots.txt at https://www.anthropic.com/robots.txt is fully permissive:\n\n \"User-Agent: *\n Allow: /\"\n" }, "blocker": { "kind": "tos", "detail": "Three stacked layers, in increasing hardness. (1) Mechanical: API keys are generated only in the Claude Console web UI; the Admin API explicitly cannot mint a usable key. (2) Auth: the only sign-in options are Google OAuth, an emailed verification code, or enterprise SSO — no client-credentials or device flow. (3) Contractual and decisive: the Usage Policy forbids \"automation in account creation\", so driving the Console with a browser agent is non-compliant even where it is technically possible. The Console's client bootstrap config also carries Arkose Labs and hCaptcha site keys (arkoseKey, hcaptchaInvisibleSitekey, hcaptchaPartnerOnboardingSitekey observed in the /login page payload on 2026-08-16), but no challenge was triggered or attempted, so CAPTCHA is recorded as configured, not as observed.\n" }, "how_to_use": { "interface": "mcp", "mcp": "https://platform.claude.com/docs/mcp", "openapi": "https://storage.googleapis.com/stainless-sdk-openapi-specs/anthropic/anthropic-086fd8de69e181b730041d853827045c2df13e50b16ea2e1d4cb97b793d90caf.yml", "base_url": "https://api.anthropic.com", "signup": "human", "credential": "No programmatic signup or key-minting path exists. Verified from the docs:\n\n- https://platform.claude.com/docs/en/get-api-key states the flow is\n \"Sign in to the Claude Console\" -> \"Open the API keys page\" -> \"Click\n **Create key**\", and explicitly rules out the API route:\n \"The Admin API can't recover a lost key or give you a key to call the\n Claude API with. To get a usable API key, create one in [Settings -> API\n keys](https://platform.claude.com/settings/keys) in the Claude Console.\"\n- https://platform.claude.com/docs/en/manage-claude/authentication lists\n three auth methods (API key, Workload Identity Federation, App Attest).\n All three bootstrap from the Console UI: WIF requires that \"you create\n three resources in the Claude Console (a service account, a federation\n issuer, and a federation rule)\"; App Attest requires registering an app\n in the Console.\n- Admin API keys are also Console-only and admin-role-only\n (https://platform.claude.com/docs/en/manage-claude/admin-api-keys).\n- The sign-in page at https://platform.claude.com/login offers exactly\n three options in its rendered markup: \"Continue with Google\",\n \"Continue with email\", \"Continue with SSO\". The email path is a mailed\n code (\"Enter this verification code where you first tried to sign in\").\n\nOnce a key exists, the API is fully first-class for an agent: a static\n`x-api-key` header, or short-lived WIF bearer tokens from\n`POST /v1/oauth/token`. The wall is strictly at onboarding, not at use.\n", "payment": { "model": "card", "currencies": [ "USD" ], "reference_task_cost_usd": 0.0001 } }, "safety": { "penalty_total": 0, "findings": [] }, "verified": { "task": "Obtain a Claude API key and POST a single request to https://api.anthropic.com/v1/messages with model claude-haiku-4-5 and max_tokens 16, receiving HTTP 200 with a JSON body whose \"type\" is \"message\" and whose content[0].text is a non-empty string.\n", "verdict": "not-attempted", "transcript": null, "at": "2026-08-16", "human_interventions": 0 }, "rubric": "sha256:cd605a44799f49951bf078fda63c5b21ad3c07db494f41d38ad19ce729c5551a", "last_verified_at": "2026-08-16" }, { "id": "open-meteo", "name": "Open-Meteo", "url": "https://open-meteo.com", "category": [ "weather", "data" ], "one_liner": "Open weather-data API (forecast, historical, air quality, marine, geocoding, elevation). The free tier serves unauthenticated HTTPS GETs with no signup and no card, capped at 10,000 calls/day and restricted by the terms to non-commercial use; commercial use requires a paid Stripe subscription and an API key on a separate customer- endpoint.\n", "a_score": 40, "band": "unverified", "provisional_band": "ready", "dimensions": { "access": 25, "payment": 25, "interface": 18, "completion": null, "docs": 7 }, "breakdown": { "dimensions": { "access": 25, "payment": 25, "interface": 18, "completion": 0, "docs": 7 }, "dimension_subtotal": 75, "bonuses": { "permissive-tos": 5 }, "bonus_subtotal": 5, "penalties": {}, "penalty_subtotal": 0, "raw": 80, "capped_at_verification_line": true, "short_circuit": null }, "permission": { "status": "granted", "source": "https://open-meteo.com/en/terms", "quote": "By using the Free API for non-commercial use you agree to following terms:\nLess than 10'000 API calls per day, 5'000 per hour and 600 per minute.\nYou may only use the free API services for non-commercial purposes.\nYou accept to the CC-BY 4.0 licence, as specified in the licence conditions.\nWe reserve the right to block applications and IP addresses that misuse our service\nwithout prior notice.\n" }, "blocker": { "kind": "none", "detail": "No wall for the reference task — the free endpoint answers an unauthenticated GET. A latent wall exists one step later: the terms restrict the free tier to non-commercial purposes, so an agent acting for a commercial product needs a paid plan, and that plan is bought through a Stripe checkout with a card, not through an API.\n" }, "how_to_use": { "interface": "openapi", "mcp": false, "openapi": "https://github.com/open-meteo/open-meteo/tree/main/openapi", "base_url": "https://api.open-meteo.com", "signup": "none", "credential": "None. The free endpoints accept unauthenticated HTTPS GETs. The optional apikey query parameter applies only to the paid customer-api.open-meteo.com host and is obtained through a Stripe checkout, not through an API.\n", "payment": { "model": "free", "currencies": [], "reference_task_cost_usd": 0 } }, "safety": { "penalty_total": 0, "findings": [] }, "verified": { "task": "Without holding any credential, issue a single GET to https://api.open-meteo.com/v1/forecast?latitude=52.52&longitude=13.41¤t=temperature_2m and parse a numeric current.temperature_2m and an ISO-8601 current.time out of the JSON response body.\n", "verdict": "not-attempted", "transcript": null, "at": "2026-08-16", "human_interventions": 0 }, "rubric": "sha256:cd605a44799f49951bf078fda63c5b21ad3c07db494f41d38ad19ce729c5551a", "last_verified_at": "2026-08-16" }, { "id": "ultimate-random-chess", "name": "Ultimate Random Chess", "url": "https://ultimaterandomchess.com", "category": [ "games", "chess", "agent-arena" ], "one_liner": "Small independent chess-variant web game (random back rank, 15 custom pieces) with a public JSON API at api.ultimaterandomchess.com. Publishes an ADD discovery manifest at /.well-known/add.json and a 10-step machine-readable agent runbook at /api/agent-quickstart. Agents and humans share one identity model, one endpoint set, one online list and one rating ladder. No terms of service page exists.\n", "a_score": 40, "band": "unverified", "provisional_band": "ready", "dimensions": { "access": 25, "payment": 25, "interface": 12, "completion": null, "docs": 7 }, "breakdown": { "dimensions": { "access": 25, "payment": 25, "interface": 12, "completion": 0, "docs": 7 }, "dimension_subtotal": 69, "bonuses": { "permissive-tos": 5 }, "bonus_subtotal": 5, "penalties": {}, "penalty_subtotal": 0, "raw": 74, "capped_at_verification_line": true, "short_circuit": null }, "permission": { "status": "unstated", "source": "https://ultimaterandomchess.com/privacy/", "quote": null }, "blocker": { "kind": "none", "detail": "No human wall is visible on the public surface: no CAPTCHA, no SMS, no KYC, no waitlist, no consent screen, no card and no dashboard-only key issuance appear in the published contract. /start-game/ advertises play as \"instant · vs the bot · no signup\". This is an absence-of-evidence finding from published docs, not a verified traversal — gate mode did not execute signup, so a wall that only appears at runtime would not have been seen.\n" }, "how_to_use": { "interface": "rest", "mcp": false, "openapi": false, "base_url": "https://api.ultimaterandomchess.com", "signup": "api", "credential": "Two documented programmatic paths, neither exercised. (1) Throwaway: `POST https://api.ultimaterandomchess.com/api/auth/anon` — documented as \"no body, no auth\", returning `{ token, user: { username, ... } }`. (2) Stable agent identity: generate an Ed25519 keypair locally, then `POST /api/auth/signup` with `{ username, entityType: \"agent\", publicKey, inboxUrl? }` signed per RFC 9421 / Web Bot Auth, where `keyid` must equal the JWK thumbprint of the supplied public key; `POST /api/auth/session` then exchanges a signature for a short-lived Bearer token. No email address, no password, no CAPTCHA and no card appear in either documented flow. The strings \"captcha\", \"recaptcha\", \"hcaptcha\" and \"turnstile\" do not occur in any page fetched during this probe. This is a documentation-derived claim: gate mode forbids signup, so no flow was executed and no hidden wall can be ruled out.\n", "payment": { "model": "free", "currencies": [], "reference_task_cost_usd": 0 } }, "safety": { "penalty_total": 0, "findings": [] }, "verified": { "task": "Mint an anonymous bearer token with POST /api/auth/anon, create a game against the resident bot with POST /api/games, and post one legal opening move with POST /api/games/:id/move — pass if a subsequent GET /api/games/:id/moves lists that exact move as move 1. NOT ATTEMPTED: this was a gate-mode probe, so no account was created and no move was ever posted.\n", "verdict": "not-attempted", "transcript": null, "at": "2026-08-16", "human_interventions": 0 }, "rubric": "sha256:cd605a44799f49951bf078fda63c5b21ad3c07db494f41d38ad19ce729c5551a", "last_verified_at": "2026-08-16" }, { "id": "twilio", "name": "Twilio", "url": "https://www.twilio.com", "category": [ "messaging", "voice", "communications" ], "one_liner": "Cloud communications API for SMS, voice, WhatsApp, and email. Excellent machine-facing API surface; account onboarding is gated on human phone verification.\n", "a_score": 35, "band": "unverified", "provisional_band": "human-gated", "dimensions": { "access": 0, "payment": 5, "interface": 20, "completion": null, "docs": 10 }, "breakdown": { "dimensions": { "access": 0, "payment": 5, "interface": 20, "completion": 0, "docs": 10 }, "dimension_subtotal": 35, "bonuses": {}, "bonus_subtotal": 0, "penalties": {}, "penalty_subtotal": 0, "raw": 35, "capped_at_verification_line": false, "short_circuit": null }, "permission": { "status": "unstated", "source": "https://www.twilio.com/en-us/legal/aup", "quote": "Harmful Code or Bots. Transmitting code, files, scripts, agents, or programs intended to do harm, including viruses or malware, or using automated means, such as bots, to gain access to or use the Services.\n" }, "blocker": { "kind": "sms", "detail": "Signup requires verifying a personal phone number by SMS one-time code. Twilio docs: \"The sign-up process includes the following steps: Verify your email address. Verify your personal phone number.\" Compounding walls: (a) the Account SID and Auth Token are Console-only, (b) trial accounts may send only to recipients that have themselves been SMS-verified (max 5), (c) trial accounts may not send custom message bodies at all — only Twilio-provided templates — so the reference task requires a paid upgrade, and (d) sending SMS to US recipients additionally requires A2P 10DLC brand registration, which the docs state requires a paid account.\n" }, "how_to_use": { "interface": "mcp", "mcp": "https://mcp.twilio.com/docs", "openapi": "https://github.com/twilio/twilio-oai", "base_url": "https://api.twilio.com/2010-04-01", "signup": "human", "credential": "Not obtainable by a baseline agent. Account signup requires verifying a personal phone number (SMS OTP) through a JavaScript SPA at auth.twilio.com; https://www.twilio.com/try-twilio 302s to https://auth.twilio.com/login. The root credential (Account SID + Auth Token) is viewable only in the Console. Per /docs/iam/api-keys, `Main` API keys are \"Create with REST API: No\". Once a human has bootstrapped one account, an agent CAN mint further credentials programmatically: POST /2010-04-01/Accounts.json creates subaccounts (each returning its own auth_token), and Standard/Restricted API keys are creatable over REST. The human wall is strictly at bootstrap.\n", "payment": { "model": "card", "currencies": [ "USD", "GBP" ], "reference_task_cost_usd": null } }, "safety": { "penalty_total": 0, "findings": [] }, "verified": { "task": "Starting from no account, obtain Twilio API credentials, send one SMS with an agent-authored message body to an arbitrary recipient phone number via POST https://api.twilio.com/2010-04-01/Accounts/{AccountSid}/Messages.json, and pass only if a subsequent GET on the returned Message SID reports a status of `sent` or `delivered`.\n", "verdict": "not-attempted", "transcript": null, "at": "2026-08-16", "human_interventions": 0 }, "rubric": "sha256:cd605a44799f49951bf078fda63c5b21ad3c07db494f41d38ad19ce729c5551a", "last_verified_at": "2026-08-16" }, { "id": "appsignal", "name": "AppSignal", "url": "https://www.appsignal.com", "category": [ "observability" ], "one_liner": "Hosted APM (errors, traces, logs, metrics, uptime) for Ruby, Elixir, Node.js, Python and OpenTelemetry languages. Ships a hosted MCP server, a REST v2 API, a GraphQL API and a CLI; all credentials are minted in the web dashboard.\n", "a_score": 0, "band": "agent-prohibited", "dimensions": { "access": 0, "payment": 25, "interface": 20, "completion": null, "docs": 7 }, "breakdown": { "dimensions": {}, "dimension_subtotal": 0, "bonuses": {}, "bonus_subtotal": 0, "penalties": {}, "penalty_subtotal": 0, "raw": 0, "capped_at_verification_line": false, "short_circuit": "agent-prohibited" }, "permission": { "status": "prohibited", "source": "https://www.appsignal.com/terms", "quote": "Any user of the Service must be a human; users registered by “robots” or other\nautomated methods are not permitted.\n" }, "blocker": { "kind": "tos", "detail": "Two independent human walls, either of which alone blocks the reference task. (a) TOS, https://www.appsignal.com/terms section 2: \"Any user of the Service must be a human; users registered by “robots” or other automated methods are not permitted.\" (b) Mechanical: reCAPTCHA v3 on the signup form at https://appsignal.com/users/sign_up, and every API credential — personal API token, MCP token, and the app's front-end/push API key — is documented as obtainable only from a dashboard screen or an interactive OAuth consent screen. There is no documented signup, token-mint, or client-credentials endpoint. Once a human has minted a scoped MCP token, an agent can operate fully unaided; the wall is entirely at credential acquisition.\n" }, "how_to_use": { "interface": "mcp", "mcp": "https://appsignal.com/api/mcp", "openapi": null, "base_url": "https://appsignal.com/api/v2", "signup": "human", "credential": "No credential can be minted over HTTP. Every documented path ends at the web dashboard or an interactive browser consent screen. (1) Account creation: https://appsignal.com/users/sign_up serves a Google reCAPTCHA v3 challenge (script https://www.recaptcha.net/recaptcha/api.js with action 'signup' and a hidden g-recaptcha-response-data[signup] input), and the TOS bars robot registration. (2) Personal API token: \"Your personal API key can be found on the personal settings screen (https://appsignal.com/users/edit)\" — https://docs.appsignal.com/api. No documented endpoint issues one. (3) MCP Bearer token: \"1. Select your profile icon. 2. Go to Account Settings. 3. Select MCP Tokens to create a new token.\" — https://docs.appsignal.com/mcp/setup. (4) MCP/CLI OAuth: interactive browser consent; the CLI docs state \"The browser flow needs a browser on the same machine as the CLI\" — https://docs.appsignal.com/cli/authentication. (5) Push / front-end API key for the ingest endpoint: \"Front-end API key, can be found in App settings\" — https://docs.appsignal.com/api/public-endpoint.\n", "payment": { "model": "free", "currencies": [ "USD", "EUR" ], "reference_task_cost_usd": 0 } }, "safety": { "penalty_total": 0, "findings": [] }, "verified": { "task": "Obtain AppSignal credentials unaided, create an application, POST one error named \"Ag3ntSearchProbeError\" to https://appsignal-endpoint.net/errors, and read that same error back through the AppSignal API within 10 minutes — pass only if the error is returned by a read call with no human action at any step.\n", "verdict": "not-attempted", "transcript": null, "at": "2026-08-16", "human_interventions": 0 }, "rubric": "sha256:cd605a44799f49951bf078fda63c5b21ad3c07db494f41d38ad19ce729c5551a", "last_verified_at": "2026-08-16" }, { "id": "linkedin", "name": "LinkedIn", "url": "https://www.linkedin.com", "category": [ "social", "professional-network", "recruiting" ], "one_liner": "Professional social network. Public web surface forbids automated access in the User Agreement; a separate registered-application API program exists but sits behind OAuth consent and manual app registration.\n", "a_score": 0, "band": "agent-prohibited", "dimensions": { "access": null, "payment": null, "interface": null, "completion": null, "docs": null }, "breakdown": { "dimensions": {}, "dimension_subtotal": 0, "bonuses": {}, "bonus_subtotal": 0, "penalties": {}, "penalty_subtotal": 0, "raw": 0, "capped_at_verification_line": false, "short_circuit": "agent-prohibited" }, "permission": { "status": "prohibited", "source": "https://www.linkedin.com/legal/user-agreement", "quote": "8.2. Don’ts\nYou agree that you will not :\nDevelop, support or use software, devices, scripts, robots or any other means or\nprocesses (such as crawlers, browser plugins and add-ons or any other technology)\nto scrape or copy the Services, including profiles and other data from the Services;\n...\nUse bots or other unauthorized automated methods to access the Services, add or\ndownload contacts, send or redirect messages, create, comment on, like, share, or\nre-share posts, or otherwise drive inauthentic engagement;\n" }, "blocker": { "kind": "tos", "detail": "LinkedIn's User Agreement (effective November 3, 2025) §8.2 \"Don'ts\" explicitly forbids using \"software, devices, scripts, robots or any other means or processes ... to scrape or copy the Services\" and forbids \"bots or other unauthorized automated methods to access the Services\". robots.txt reinforces this with a site-wide \"User-agent: * / Disallow: /\" plus an explicit per-agent \"Disallow: /\" for anthropic-ai, ClaudeBot, Claude-Web, Claude-User, ChatGPT-User, GPTBot, PerplexityBot, CCBot, Google-Extended, cohere-ai, Scrapy, Bytespider and others. Automated access requires prior express permission (whitelist-crawl@linkedin.com) under the separate Crawling Terms and Conditions.\n" }, "how_to_use": { "interface": "rest", "mcp": null, "openapi": null, "base_url": null, "signup": null, "credential": null, "payment": { "model": null, "currencies": [], "reference_task_cost_usd": null } }, "safety": { "penalty_total": 0, "findings": [] }, "verified": { "task": "Authenticate as a LinkedIn member and publish one text post, then read that same post back by its URN — pass if the returned post body matches the string that was sent. NOT ATTEMPTED: the User Agreement prohibits automated access, so this task was never run.\n", "verdict": "not-attempted", "transcript": null, "at": "2026-08-16", "human_interventions": 0 }, "rubric": "sha256:cd605a44799f49951bf078fda63c5b21ad3c07db494f41d38ad19ce729c5551a", "last_verified_at": "2026-08-16" } ] }