Agent-ready APIs, measured: category matters less than MCP

The Headless Index now holds 550 vendor scorecards, and 321 of them could be scored on all five criteria. On those 321, the category a vendor sits in tells you little about whether an agent can operate it: the thirteen category medians span 11.5 points, from 55 to 66.5 out of 100. What separates an agent-ready API from the rest is the same pair of criteria in almost every category, MCP posture and webhooks, and MCP posture is the weakest of the five overall, at a mean of 9.8 out of 20.

That is the answer for anyone choosing between vendors an agent will call. Pick the category for the job, then look at how the vendor talks to agents and how it pushes events, because the API itself is rarely where it falls short. Ranked over all 550 vendors instead, the category medians spread 36 points, and most of that spread is how completely each category was collected, not how its vendors behave.

The figures below come from the scorecards in The Headless Index, all 550 of which carry a scoring date of 2026-08-20 and methodology THI-v1.0. Every number is computed from those files, and the arithmetic is given where a number is derived.

Which vendors the Index can measure completely

The Index scores each vendor on five criteria, each out of 20: API-first design, headless operation, MCP posture, schema and observability, and webhooks and events. MCP posture covers what a vendor ships for agents on top of its API, above all a Model Context Protocol (MCP) server, which exposes the API’s operations as tools an agent can discover and call. When the collector cannot establish a criterion, it records Unknown and leaves that criterion out of the denominator. Of the 550 scorecards, 321 have all five criteria scored and 229 have at least one Unknown.

The two groups look like different industries. The 321 complete records average 61.3 with a median of 62. The 229 incomplete ones average 26.8. A median over all 550 is 51, which describes neither group.

The Index grades each vendor from band A, Strong, to band F, Hostile, and the F band is almost entirely made of the second group. Of 177 vendors graded F, 174 have at least one Unknown criterion. Our August definition of a headless system read the same pattern on 447 vendors as a discoverability finding: if a collector following the documentation cannot find a webhook reference, an agent in production cannot either.

Nearly every incomplete record is missing the same criterion. Of the 229 incomplete records, 227 have no webhooks and events score, 189 have no headless operation score and 92 have no API-first score. MCP posture is Unknown in only 10; whether a vendor publishes an MCP server is comparatively easy to establish either way.

What has changed since August is who gets added. The Index published 449 vendors in May, then 42 in August and 59 in September. All 101 of the later vendors are fully scored, and none of them is graded F. The May batch holds every one of the 177 F grades and only 220 complete records.

The collection did change. The Index’s build record for those 101 vendors notes that their documentation was rendered in a browser and that every one of their five criteria carries a hand-written rationale. The vendors may also differ, so the scorecards alone cannot say how much of the gap is collection and how much is the vendors chosen. Either way, a ranking over all 550 vendors partly measures when a category was added and how completely its vendors were collected. So the rest of this post uses the 321 complete records only.

One more coverage number matters for the bands. 411 of the 550 scorecards record the same reason for a missing JAIRF score, “No public OpenAPI specification discovered during collection”. JAIRF is the open agent-readiness score the Index runs on an OpenAPI file; 137 vendors were scored on it, with a mean of 75.4, and two specifications were malformed. The band rules in the methodology cap any vendor without a JAIRF score at B, so a published, machine-readable OpenAPI file is the price of an A.

That cap does real work at the top of the Index. 50 complete vendors score 75 or more, the Index threshold for band A. Ten of them are graded A. Twenty-four are held at B because no OpenAPI file was found, and the other 16 have a JAIRF score below 75.

Agent-readiness by category, on complete evidence

Restricted to complete records, every category has a median between 55 and 66.5.

The second column is the reason to read the table this way. Workflow and Automation has a median of 33 across all 60 of its vendors and 66 across the 29 that could be fully scored. AI Platforms moves from 28 across 80 vendors to 55 across 28. A category comparison that mixes complete and incomplete records ranks the collection, and these two categories were ranked near the bottom for that reason.

AI Platforms is still last on complete evidence, at 55. The vendors that sell agents score lower than the vendors that sell message delivery or feature flags, and the gap on that basis is 11.5 points.

Communications leads, with Twilio at 84, Slack at 82, LiveKit at 80, Resend at 76 and Nylas at 75. Each of them sells something whose primary consumer was already application code.

One vendor at each end of the range

Two scorecards show what sits inside the medians. We chose the top of the leading category and the bottom of the trailing one.

Twilio scores 20 on API-first, 18 on headless operation, 12 on MCP posture, 16 on schema and observability and 18 on webhooks and events, for 84. Its webhooks deliver call, message and status events with optional HMAC signing, and its scorecard records replay through the console. Its weakest criterion is MCP posture, with the note “A first-party MCP server is not yet published as a core product.” Twilio is graded B, not A, because the collector found no OpenAPI file to run JAIRF on, although the same scorecard’s schema rationale says Twilio publishes OpenAPI specifications in its documentation. That gap between what the vendor publishes and what a collector found is the coverage problem in a single record.

DeepInfra is the lowest fully scored vendor in AI Platforms, the trailing category. It scores 12, 10, 4, 8 and 4 on the same five criteria, for 38 and band D. Its scorecard records an OpenAI-compatible inference API, no first-party MCP server, and on events, “Synchronous inference. No documented webhook surface.” It is not an outlier in its category on the last two criteria. Of the 28 fully scored AI Platforms vendors, 9 score 4 or less on MCP posture and 10 score 4 on webhooks and events.

The two records differ by 46 points, and 22 of those points sit in MCP posture and webhooks. The rest is spread across the three criteria that describe the API itself.

MCP posture lags in nearly every category

Across the 321 complete records, the five criteria compare as follows.

No complete record scores below 5 on API-first design or headless operation. Webhooks and MCP posture are the two criteria where more vendors sit at 4 or less than at 15 or more. MCP posture asks, in the methodology’s words, “Has the vendor invested in agent-native integration?”: an official MCP server, maintained community servers, SDKs designed for tool calling.

The distribution is wide. 38 vendors score the full 20, and 74 score 15 or more. 106 score 4 or less. So a third of the vendors whose APIs the Index can fully read have made almost no agent-specific investment on top of them.

In 11 of the 13 categories, the two weakest criteria are MCP posture and webhooks and events. Content Management is a near miss: schema and observability edges below MCP posture there by one point summed over 22 vendors. Payments is the real exception, and it is the clearest case of the gap.

Payments has 31 fully scored vendors and an API-first mean of 15.3, fifth of the 13 categories and 0.4 below the highest, AI Platforms at 15.6. Its MCP posture mean is 6.5, the lowest of any category on any criterion except webhooks in Search and Vector DBs. Eleven payments vendors score 16 to 18 on API-first and 4 on MCP posture: Braintree, Chargebee, Checkout.com, Klarna, Lemon Squeezy, Lithic, Marqeta, Mollie, Moov, Paystack and Recurly. Three score 15 or more on MCP posture, and all three score the full 20: Adyen, Square and Stripe.

Stripe is the one vendor in the Index that scores the full 20 on all five criteria, for 100. Ten fully scored vendors reach band A: Stripe at 100, Scalekit at 88, Braintrust at 84, Webflow at 82, Mem0 at 81, Contentstack, Grafana and Honeycomb at 78, and Razorpay and Zapier at 76.

The payments numbers describe an industry whose APIs are ready and whose agent tooling is not. An agent can call Recurly’s API today, and Recurly scores 18 on API-first. Its scorecard records no first-party MCP server and says “Community wrappers carry the protocol layer”. For those eleven vendors, the layer that turns an API into tools an agent can call is left to the community or to the integrator.

Commerce shows the same split one layer down. In our test of whether an agent can run a back office system, none of the eight commerce platforms that score 15 or more on headless operation scored 15 or more on MCP posture, and the highest was 12.

Webhooks are the second gap, and some of it is fair

Webhooks and events is the weakest criterion in seven categories. It measures whether a system can push state changes outward: a declared list of events, a signing scheme, retry and replay, and payloads complete enough to act on. Its bottom band reads “No webhooks. Agents must poll.”

Search and Vector DBs is the low point, with a mean of 5.3 out of 20. 12 of its 20 fully scored vendors score 4, and none scores above 10. That is partly a fair absence. A search index is queried, and the state change a caller cares about is usually its own write, so a search vendor without an event catalogue has fewer events worth sending.

Analytics and Events, at 7.5, is harder to excuse. These products ingest events by design, yet 8 of the 22 fully scored vendors score 4 on pushing them back out, and 15 score 8 or less. An agent that cannot subscribe to a change has to poll for it, which costs a call per check and still sees the change late.

How the figures were computed, and what they do not show

Each scorecard displays the vendor’s points on the criteria it could score, scaled to 100, and that is the score this post uses. A category median is the median of those scores, and we took every criterion mean over the 321 complete records only, so every vendor contributes to every criterion. We recomputed the figures from the published scorecard files on 2026-10-12; those files last changed when the Index added the August and September vendors.

The scores measure whether a machine surface exists, can be found and is described. They do not measure whether an agent completes a task through it, and a vendor can score well here and still be hard for an agent to operate.

The complete-evidence view has its own bias. It keeps the vendors whose documentation the collector could read in full, which is likely the better documented end of each category. Because 227 of the 229 incomplete records lack a webhooks score, it also keeps, almost by construction, the vendors whose webhook reference the collector found. The medians above are therefore an upper reading for each category as a whole, and the true spread between categories may be wider than 11.5 points.

The cohort split is only partly explained, as set out above. Re-collecting the 229 incomplete May records with the current process would settle it; until then, read the all-vendor figures as coverage figures.

A vendor that shipped an MCP server or an OpenAPI file after the 2026-08-20 scoring date does not show here, and MCP posture is the criterion most likely to have moved since.

What this changes when you choose a vendor an agent will call

Do not shortlist by category reputation. On complete evidence the categories are close, and a strong API is the norm rather than the differentiator: API-first averages 14.8 out of 20 across the 321 vendors.

Score the two criteria that vary. Ask whether the vendor ships and maintains its own MCP server or tool definitions, and whether it publishes a signed, documented event catalogue that an agent can subscribe to. Where the answer to the first is no, budget for writing and maintaining the tool layer yourself, because in payments that is the situation for 11 of the 17 vendors that score 16 or more on API-first.

Treat a missing machine-readable OpenAPI file as a cost. Without one, an agent framework cannot generate its tools from the contract, and the Index cannot give the vendor its top band: 24 of the 50 complete vendors scoring 75 or more stop at B for that reason alone.

And read an F grade on the Index as a question, not a verdict. For 174 of the 177 F-band vendors, the grade says that evidence for at least one criterion could not be found, and the first job is to find out whether your agent can find it either.