API Buildability Census composio take-home · 11 Jul 2026 · agent-generated, human-verified
100 apps · 10 categories · every claim linked to evidence

Can an agent build a toolkit for it today?

A Python research agent profiled 100 SaaS apps — auth model, credential access, API surface, existing MCP servers — then an independent verifier fact-checked every claim against freshly fetched docs pages, and flagged records were re-researched. A no-LLM checker re-tested every claim against its evidence URL: 81% supported on pass 1, 82% after the fix loop, with 9 records corrected along the way — misses shown honestly below.

74buildable today
21buildable with friction
5blocked / no public API
61fully self-serve credentials
5gated (sales / partner)
92already have an MCP server
01

The patterns

the headline, not the table

74 of 100 apps could become agent toolkits this week — the gate is business, not technology.

Where an app isn't buildable, the blocker is almost never a missing API — it's who is allowed to hold credentials. Top blockers found: paid plan required (12), app review or admin gate (11), other (6).

OAuth2 dominates (56/100)

OAuth2 appears on 56 apps and API keys on 54 — many apps ship both: OAuth for user-delegated access, keys for server-to-server. A toolkit platform must treat dual-auth as the default case, not the edge case.

Self-serve is the norm — gating is categorical

Communications is the most open category (100% self-serve); Finance & Fintech is the most gated (30%). Openness clusters by who the buyer is: developer-first products open the door, enterprise- and partner-sold products keep a human in the loop.

4 easy wins with no MCP yet

Apps that are buildable, self-serve, and have no MCP server found — greenfield for Composio. The gated list (5 apps) is the outreach queue, not a dead end.

Auth methods across 100 apps (multi-count)
OAuth2
56
API Key
54
Token / JWT
49
Basic Auth
17
None
5
Session
4
Other
1
Credential access by category
CRM
6
4
Support
6
4
Communications
10
Marketing
5
5
Ecommerce
6
3
1
Data
7
2
1
Dev
7
3
Productivity
6
4
Finance
3
6
1
AI
5
3
2
Self-servePartialGatedUnknown
The 100 — buildability at a glance (hover any cell)
YesPartialNoUnknown
02

All 100 apps

every row links to the evidence behind it · ✓ = verifier confirmed all 5 claims
#AppAuthAccessAPI surface MCPBuildableBlockerEvidence · ✓
1 SalesforceSalesforce is a customer relationship management (CRM) and sales platform. OAuth2 Partial RESTfull CRUD on core objects official Partial paid plan or approval api auth access mcp 4/5
2 HubSpotHubSpot is a CRM and sales platform that enables businesses to manage their customer relat API Key OAuth2 Token / JWT Partial RESTfull CRUD on core objects official Partial paid plan or admin approval api auth access mcp 3/5
3 PipedrivePipedrive is a CRM and sales platform that provides API access for integrations and custom API Key OAuth2 Self-serve RESTfull CRUD on core objects official Yes none api auth access mcp
4 AttioAttio is a CRM that provides a public REST API for developers to build custom integrations API Key OAuth2 Token / JWT Partial RESTfull CRUD on core objects official Partial rate limits api auth access mcp
5 TwentyTwenty is an open-source CRM that provides building blocks for a custom CRM to meet comple API Key OAuth2 Self-serve REST + GraphQLfull CRUD on all core objects community Yes none api mcp 3/5
6 PodioPodio is a CRM and sales platform that provides a programmable interface to all its functi API Key OAuth2 Self-serve RESTfull CRUD on all core objects official Yes none api auth access mcp
7 Zoho CRMZoho CRM is a customer relationship management platform that provides APIs for integration OAuth2 Self-serve RESTfull CRUD on core objects community Yes none api auth access mcp 3/5
8 CloseClose is a CRM and sales platform that provides API access for integrations and automation API Key OAuth2 Self-serve RESTfull CRUD on core objects official Yes none api auth access mcp
9 CopperCopper is a CRM and sales platform that provides a RESTful interface with JSON-formatted r API Key OAuth2 Self-serve RESTfull access to most Copper resources community Yes none api auth mcp
10 DealCloudDealCloud is a CRM and sales platform that provides a comprehensive API for custom integra API Key OAuth2 Token / JWT Partial RESTfull CRUD on core objects official Partial paid plan or approval api auth access
11 ZendeskZendesk is a support and helpdesk platform that provides APIs for ticketing, help center, API Key Basic Auth OAuth2 Token / JWT Self-serve RESTfull CRUD on core objects community Yes none api auth access mcp
12 IntercomIntercom is a support and helpdesk platform that provides APIs for developers to build int OAuth2 Token / JWT Self-serve RESTfull CRUD on core objects official Yes none api auth access mcp
13 FreshdeskFreshdesk is a support and helpdesk application API Key Basic Auth Partial RESTfull CRUD on core objects community Partial paid plan required api access mcp
14 FrontFront is a helpdesk and support platform that allows users to manage customer conversation OAuth2 Token / JWT Self-serve RESTfull CRUD on core objects none found Yes none api auth
15 PylonPylon is a B2B customer support and customer operations platform. Token / JWT Partial RESTfull CRUD on core objects community Partial admin approval api auth access mcp
16 LiveAgentLiveAgent is an integrated customer support software, ticketing system, live chat, social API Key Self-serve RESTfull CRUD on core objects official Yes none api auth access mcp 2/5
17 PlainPlain is an API-first customer infrastructure platform for B2B SaaS that provides a suppor API Key Token / JWT Self-serve GraphQLfull API-UI parity official Yes none api auth mcp 3/5
18 Help ScoutHelp Scout is a support and helpdesk platform that provides tools for developers to integr API Key Basic Auth OAuth2 Partial RESTfull CRUD on core objects community Partial paid plan required api access mcp
19 GorgiasGorgias is a support and helpdesk platform that provides an open REST API for reading and API Key Basic Auth OAuth2 Partial RESTfull CRUD on core objects official Partial paid plan or approval api access mcp
20 GladlyGladly is a customer service platform that provides APIs for integrating with external sys API Key Basic Auth Self-serve RESTfull CRUD on core objects official Yes none api access mcp
21 SlackSlack is a communication platform that allows users to interact with each other and with A OAuth2 Token / JWT Self-serve RESTfull CRUD on all core objects official Yes none api auth access mcp 3/5
22 TwilioTwilio provides cloud communications APIs for messaging, voice, video, email and other cha API Key Basic Auth Self-serve RESTfull CRUD on all core communication objects official Yes none api auth access mcp
23 Zoho CliqZoho Cliq is a team chat and collaboration platform for channels, threads, reminders and s OAuth2 Self-serve RESTfull CRUD on chat objects (channels, messages, reminders, users) official Yes none api auth mcp 3/5
24 LarkLark is a workplace communication and collaboration platform. OAuth2 Self-serve RESTbroad set of workplace collaboration APIs official Yes none api auth mcp 0/5
25 PumblePumble is an all‑in‑one team communication app for messaging, file sharing and video confe API Key Self-serve RESTfull CRUD on messages, channels, reactions and user interactions official Yes none api mcp 4/5
26 DiscordDiscord is a communications platform that provides chat, voice, and community features via OAuth2 Token / JWT Self-serve RESTfull CRUD on core Discord objects (guilds, channels, messages, users) community Yes none api access mcp
27 TelegramTelegram provides a cloud‑based messaging platform with a Bot API that lets developers cre API Key Self-serve RESTfull CRUD on core messaging objects (messages, chats, users, etc.) community Yes none api access mcp 3/5
28 WhatsApp BusinessProvides a programmable API for businesses to send and receive WhatsApp messages. Token / JWT Self-serve RESTfull messaging (send, receive, templates, media) community Yes business verification for production messaging api auth access mcp 4/5
29 AircallAircall provides a cloud‑based phone system with a public REST API for managing calls, use Basic Auth OAuth2 Self-serve RESTfull CRUD on core objects (users, calls, contacts, numbers, teams, tags, webhooks, etc.) community Yes none api access mcp
30 VonageVonage provides communication APIs for voice, video, messaging, and network features. API Key Basic Auth Token / JWT Self-serve RESTfull CRUD across voice, video, messaging, and network APIs official Yes none api auth access mcp
31 Google AdsThe Google Ads API is a programmatic interface for managing Google Ads accounts and campai OAuth2 Partial RESTfull CRUD on campaigns, ads, keywords and reporting official Partial Developer token approval required api access mcp
32 Meta AdsMeta Ads is a platform that allows developers to automate ad creation, management, and rep API Key OAuth2 Partial RESTfull CRUD on ad accounts and campaigns official Partial app review api auth access mcp 4/5
33 LinkedIn AdsThe LinkedIn Ads app helps businesses grow by building technology to reach, engage, and co OAuth2 Partial RESTfull CRUD on core objects official Yes approval process api auth access mcp
34 GoHighLevelGoHighLevel is a CRM and marketing automation platform that lets businesses manage contact API Key OAuth2 Partial RESTfull CRUD on core objects (contacts, conversations, calendar, payments, etc.) official Partial OAuth requires paid Agency Pro plan api access mcp
35 MailchimpMailchimp provides a marketing platform for creating, sending, and tracking email campaign API Key Basic Auth OAuth2 Token / JWT Self-serve RESTfull CRUD on core marketing objects (audiences, contacts, campaigns, automation, etc.) community Yes none api auth access mcp
36 KlaviyoKlaviyo provides marketing automation APIs for managing profiles, events, lists, campaigns API Key OAuth2 Self-serve RESTfull CRUD on core marketing objects (profiles, events, lists, campaigns, etc.) official Yes none api mcp
37 systeme.ioSysteme.io is an all‑in‑one platform for building sales funnels, email marketing, online c API Key Self-serve RESTCRUD on contacts, tags, subscriptions, newsletters and related objects official Yes none api auth mcp 3/5
38 PinterestProvides an API to create and manage Pins, Boards, ads, product catalogs, and analytics on OAuth2 Partial RESTfull CRUD on content, ads, catalogs plus analytics community Partial App review and video demo required for standard access api auth access mcp
39 ThreadsProvides an API for creating, publishing, and retrieving Threads posts and managing a crea OAuth2 Self-serve RESTfull CRUD on Threads posts and user content community Yes none api auth mcp 2/5
40 SendGridSendGrid provides an email delivery service with a REST API for sending emails and managin API Key Basic Auth Token / JWT Self-serve RESTfull CRUD on most core objects (excluding billing & email validation) community Yes none api access mcp
41 ShopifyShopify provides APIs to manage e‑commerce stores, including products, orders, customers, OAuth2 Session Self-serve REST + GraphQLfull CRUD on core e‑commerce objects official Yes none api auth access mcp
42 WooCommerceWooCommerce adds e‑commerce functionality to WordPress sites, enabling online stores. API Key Basic Auth Self-serve RESTfull CRUD on core e‑commerce objects (products, orders, customers, etc.) official Yes none api auth mcp 3/5
43 BigCommerceBigCommerce provides a SaaS ecommerce platform with REST and GraphQL APIs to manage store OAuth2 Token / JWT Self-serve REST + GraphQLfull CRUD on core ecommerce objects (products, orders, customers, etc.) official Yes none api auth access mcp 4/5
44 Salesforce Commerce CloudSalesforce Commerce Cloud provides APIs to build and customize headless e‑commerce storefr OAuth2 Gated RESTunknown community Partial Commerce Cloud license required — no self-serve path api auth access mcp 1/5
45 Magento (Adobe Commerce)Adobe Commerce (Magento) provides an e‑commerce platform with APIs for managing products, Basic Auth OAuth2 Session Token / JWT Self-serve REST + GraphQLfull CRUD on core commerce objects community Yes none api access mcp 3/5
46 SquarespaceSquarespace is a website and ecommerce platform that provides APIs to manage commerce feat API Key OAuth2 Partial RESTfull CRUD on core commerce objects (products, orders, inventory, contacts, etc.) community Partial requires paid Commerce Advanced plan or Extension approval api auth access mcp
47 EcwidEcwid provides a REST API for managing store data, orders, products, customers and other e OAuth2 Other Token / JWT Partial RESTfull CRUD on core e‑commerce objects (store profile, products, orders, customers, discounts, shipping, payments, etc.) community Partial API requires a paid Ecwid plan api access mcp
48 GumroadGumroad provides a platform for creators to sell digital products and offers a REST API to OAuth2 Token / JWT Self-serve RESTread/write on products, sales, subscribers, and license management community Yes none api auth access mcp 4/5
49 Amazon Selling PartnerProvides REST APIs for Amazon sellers and vendors to programmatically access orders, shipm OAuth2 Partial RESTfull CRUD on core eCommerce objects (orders, inventory, listings, payments, reports) community Partial requires Amazon approval for data‑access api access mcp
50 FanbasisFanBasis provides a payment and subscription platform that lets creators sell products, ma API Key Self-serve RESTfull CRUD on payments, subscriptions, customers, products, discounts, and webhooks none found Yes none api
51 DataForSEODataForSEO provides REST APIs that deliver structured SEO and SEM data such as SERP result Basic Auth Self-serve RESTbroad set of read‑only SEO data endpoints (SERP, keyword, backlinks, etc.) official Yes none api auth mcp
52 SE RankingSE Ranking provides SEO and GEO data via a REST API and an MCP server for AI assistants. API Key Self-serve RESTfull CRUD on SEO data and project management resources official Yes none api auth access mcp
53 AhrefsProvides access to Ahrefs marketing and search data via a REST API for custom integrations API Key Token / JWT Partial RESTread‑only reporting on SEO data plus limited management endpoints official Partial Requires paid Ahrefs plan to obtain API key api auth mcp
54 MrScraperMrScraper provides a web‑scraping platform with AI‑powered and manual scrapers accessible API Key Self-serve RESTfull CRUD on scrapers, runs, and results community Yes none api mcp 2/5
55 ApifyApify provides a platform for running web‑scraping and automation Actors via a REST API. API Key Token / JWT Self-serve RESTfull CRUD on core platform objects (actors, runs, datasets, key‑value stores, schedules, etc.) official Yes none api mcp 2/5
56 FirecrawlFirecrawl provides a REST API to search, scrape, crawl, map and extract web content for AI API Key None Self-serve RESTscrape, crawl, map, search, extract, parse, and browser automation endpoints official Yes none api auth access mcp
57 Bright DataBright Data is a web data platform that helps you collect, process and scale access to pub API Key Token / JWT Self-serve RESTfull CRUD on all core objects official Yes none api auth access mcp
58 SherlockFind usernames across 400+ social networks and websites. None Self-serve CLI onlyread‑only username search across many sites community No No public REST/GraphQL API endpoint api mcp
59 Waterfall.ioWaterfall.io provides an enrichment API that aggregates data from 30+ vendors to find and API Key Partial RESTsearch, enrichment and verification of contacts and companies none found Partial requires master API key, likely a paid account api access mcp
60 ClayGTM data-enrichment platform that orchestrates 100+ data providers inside spreadsheet-like None Gated Noneoutbound HTTP-API column + per-table inbound webhooks only none found No no public inbound API to build against api
61 GitHubGitHub is a DevOps platform for version control and collaboration on code. Token / JWT Partial RESTfull CRUD on all core objects official Yes authentication token requirements api auth access mcp
62 VercelFrontend cloud platform for deploying and hosting web apps with serverless infrastructure. Token / JWT Self-serve RESTfull platform control: deployments, projects, domains, DNS, env vars, teams official Yes none api mcp
63 NetlifyWeb development platform for building, deploying and hosting sites with serverless functio OAuth2 Token / JWT Self-serve RESTsites, deploys, DNS, forms, functions, env vars official Yes none api mcp
64 CloudflareCDN, DNS, security and edge-compute platform fronting a large share of the web. API Key Token / JWT Self-serve RESTvery broad: zones, DNS, Workers, R2, KV, firewall, analytics official Yes none api auth mcp
65 SupabaseSupabase is a full Postgres database for every project with Realtime functionality, databa API Key Token / JWT Self-serve REST + GraphQLfull CRUD on all core objects official Yes none api auth access mcp 4/5
66 Neo4jNeo4j Aura is a fully automated graph platform offered as a cloud service. OAuth2 Token / JWT Partial REST + GraphQLfull CRUD on all core objects official Yes none api auth access mcp 4/5
67 SnowflakeCloud data warehouse for analytics, data engineering and AI workloads. OAuth2 Token / JWT Self-serve RESTSQL API executes any SQL; separate REST APIs for management official Yes none (account + warehouse setup is the only friction) api auth access mcp
68 MongoDB AtlasThe MongoDB Atlas Administration API allows developers to manage all components in MongoDB API Key Basic Auth None OAuth2 Session Token / JWT Partial RESTfull CRUD on all core objects official Yes Organization Owner access required for service accounts and Project Owner access required for API keys api auth access mcp
69 DatadogObservability platform: infrastructure monitoring, APM, logs and security. API Key Self-serve RESTvery broad: metrics, monitors, dashboards, logs, incidents, users official Yes none api auth mcp 2/5
70 SentryError tracking and application performance monitoring for developers. OAuth2 Token / JWT Self-serve RESTprojects, issues, events, releases, alerts, teams official Yes none api auth mcp 3/5
71 NotionAll-in-one workspace for notes, docs, wikis and databases. OAuth2 Token / JWT Self-serve RESTpages, databases, blocks, users, comments, search official Yes none api auth access mcp
72 AirtableAirtable is a low-code platform for building collaborative apps. API Key Token / JWT Self-serve RESTfull CRUD on all core objects official Yes none api auth mcp 2/5
73 LinearA project management tool for teams. API Key OAuth2 Self-serve GraphQLfull CRUD on all core objects official Yes none api auth access mcp
74 JiraJira is a productivity and project management app. API Key Basic Auth OAuth2 Session Token / JWT Partial RESTfull CRUD on all core objects official Yes Migrate from API tokens to officially supported authentication by December 31st, 2025 api auth access mcp
75 AsanaAsana is a productivity and project management app. OAuth2 Token / JWT Self-serve RESTfull CRUD on all core objects official Yes none api auth access mcp
76 Monday.comA productivity and project management platform that allows teams to create and shape their OAuth2 Token / JWT Self-serve GraphQLfull CRUD on all core objects official Yes none api auth access mcp
77 ClickUpProductivity and project management tool for teams. API Key OAuth2 Token / JWT Partial RESTfull CRUD on core objects official Yes OAuth app creation requires Workspace owner or admin approval api auth access mcp
78 CodaCoda is an all-in-one collaborative workspace that blends the flexibility of docs, structu Token / JWT Partial RESTfull CRUD on all core objects official Yes API usage is subject to the role of the user associated with the API token api auth access mcp
79 SmartsheetThe Smartsheet app is a productivity and project management tool that enables users to pro Token / JWT Partial RESTfull CRUD on core objects official Yes token generation process varies by environment api auth mcp
80 HarvestTime tracking and invoicing for teams and freelancers. OAuth2 Token / JWT Self-serve RESTtime entries, projects, clients, invoices, estimates, reports community Yes none api auth mcp 3/5
81 StripePayments infrastructure: accept, process and manage online payments. API Key OAuth2 Self-serve RESTvery broad: payments, customers, subscriptions, invoices, payouts, issuing official Yes none api auth mcp
82 PlaidPlaid is a financial services company that provides APIs for accessing financial data. API Key Token / JWT Self-serve RESTfull CRUD on all core objects official Yes none api access mcp
83 BinanceThe Binance app provides access to cryptocurrency market data and trading functionality. API Key OAuth2 Partial RESTfull CRUD on all core objects official Yes API key creation and management api access mcp 2/5
84 Paygent ConnectPaygent Connect is a payment orchestration platform that enables AI agents to integrate wi API Key Token / JWT Partial RESTfull CRUD on payment gateways none found Yes EMV Level 3 processor certification api auth access 3/5
85 iPayXiPayX is a FINTRAC-registered FX forensic audit layer. API Key Partial RESTfull CRUD on FX audit data official Yes API key management interface requires administrator privileges api access mcp 4/5
86 QuickBooksQuickBooks is a finance and fintech app for accounting and bookkeeping. OAuth2 Partial REST + GraphQLfull CRUD on all core objects official Yes OAuth2 setup and admin approval api auth access mcp 2/5
87 XeroXero is a cloud-based accounting software that allows users to manage their finances, invo OAuth2 Self-serve RESTfull CRUD on all core objects official Yes none api auth access mcp 4/5
88 BrexBrex is a financial platform that allows developers to integrate with their banking servic API Key Basic Auth OAuth2 Token / JWT Partial REST + GraphQLfull CRUD on all core objects official Yes OAuth implementation complexity api auth mcp 4/5
89 RampRamp is a finance and fintech app that provides a platform for businesses to manage their Basic Auth Token / JWT Partial RESTfull CRUD on all core objects official Yes admin access required api auth access mcp 2/5
90 PitchBookPitchBook provides real-time access to company data and market intelligence for financial API Key Token / JWT Gated RESTfull CRUD on company data and market intelligence official No standalone contract with PitchBook sales required api auth access mcp 2/5
91 NotebookLMGoogle's AI research notebook that grounds answers in user-uploaded sources. OAuth2 Gated RESTEnterprise-only: create/manage notebooks and sources via Discovery Engine API none found No enterprise-only API behind Gemini Enterprise licensing api 1/5
92 Otter AIAI meeting transcription and notetaking assistant. API Key Partial RESTspeeches/transcripts export and search (narrow) official Partial API is new and narrow; MCP gated to Business/Enterprise api mcp
93 FathomFathom captures, transcribes, and summarizes meetings, and provides a public API for acces API Key OAuth2 Self-serve RESTread and write access to meeting data none found Yes none api access
94 ConsensusConsensus is an AI academic search engine for peer-reviewed literature that helps find, or API Key Token / JWT Gated RESTfull CRUD on all core objects official No requires application and custom quote api mcp 2/5
95 ReductoDocument-parsing API platform that turns PDFs and scans into structured data for AI pipeli API Key Self-serve RESTparse, extract, split, edit pipelines official Yes none api 3/5
96 DevinCognition's autonomous AI software engineer that plans and executes coding tasks. Token / JWT Partial RESTsessions, playbooks, knowledge, schedules official Partial paid Devin subscription required api mcp
97 HiggsfieldGenerate and manage AI images and videos with Higgsfield's unified model API. Token / JWT Partial RESTfull CRUD on all core objects official Yes none api access mcp 3/5
98 Mermaid CLIA command-line interface (CLI) for mermaid that takes a mermaid definition file as input a None Self-serve CLI onlydiagram file in, SVG/PNG/PDF out; also a Node.js run() API official Partial no hosted API — a toolkit would wrap the local CLI api mcp
99 YouTube TranscriptThird-party REST API (transcriptapi.com) for fetching YouTube transcripts, video and chann Token / JWT Self-serve RESTtranscripts, video search, channels, playlists none found Yes none (note: unofficial third-party YouTube service) api
100 GrainAI meeting recorder that captures, transcribes and shares video call highlights. OAuth2 Token / JWT Self-serve RESTrecordings, transcripts, webhooks, users, teams official Yes none documented; plan limits unclear api mcp 3/5
03

The agent

python · groq/openrouter/gemini fallback chain · serper search
01

Search ×3

Per app: docs & auth, MCP servers, credential access — via Google (Serper).

02

Read the docs

Downloads the top docs pages and reads the text — snippets alone lie.

03

Extract

One LLM call → strict JSON: auth, access, API, MCP, verdict, evidence URLs, confidence. Guessing forbidden.

04

Checkpoint

results.json written after every app — crash-safe, resumable.

05

Verify → fix → verify

A deterministic checker (no LLM) re-fetches all evidence URLs and tests every claim; flagged records get corrected and re-checked.

Where a human was needed

Defining the schema and what “self-serve” means. Unblocking run #1, which died on Gemini free-tier 429s (kept in the repo as artifacts_run1_gemini_429.json) — replaced with a Groq → OpenRouter → Gemini fallback chain. When free-tier quotas kept choking, 16 apps were finished by a human-driven research pass (same schema, same evidence rules — marked researched_by in the data). Hand spot-checking 13 claims against real docs and correcting 9 records. The agent did everything else.

What the agent got wrong (kept honestly)

The hand check caught real failure modes: entity confusion (Fathom's MCP evidence pointed at Fathom Analytics, a different company), context bleed (Mermaid CLI got "API Key" auth from unrelated search results — it has no auth at all), over-optimism on gated APIs (PitchBook needs a standalone contract, not "partial"), and over-caution (Zendesk's free trial has full API access). 1 records self-report low confidence. The spot-check table below shows every hit and miss.

04

How we know it's right

accuracy is what matters most

Machine loop — deterministic, no LLM

The checker re-fetches every record's evidence URLs and mechanically tests each claim (URL liveness + keyword support). It cannot hallucinate agreement — a dead evidence link can never count as support. Pass 1: 398/489 claims supported (81%), 25 dead evidence links. After the fix pass (evidence-URL repairs + 4 claim corrections), pass 2: 399/488 (82%), dead links down to 21. Most remaining flags are docs the static fetcher can't read (JS-rendered or bot-blocked: Salesforce, Meta, Datadog) — a stated limitation, covered by the human loop, not papered over by loosening the checker.

Human loop — where judgment lives

13 field-level spot checks against the real docs by hand — the agent had 8/13 right (62%) before fixes; every miss was corrected with a cited docs page and re-verified, and the machine loop's flags triggered 9 record corrections in total. Sample weighted toward low-confidence and gated verdicts, because that's where agents bluff.

AppFieldAgent saidDocs actually sayVerdict
Fathomidentity + accessdevelopers.fathom.ai, API key self-serve in minutesConfirmed: developers.fathom.ai is the fathom.video meeting product; 'Generate an API key and make your first call in minutes'✓ right
Fathommcp evidencecommunity MCP: mcp-fathom-analyticsThat repo is for Fathom Analytics (website stats) — a different company than the fathom.video meeting recorder✗ wrong
Mermaid CLIauthAPI KeyNo auth at all — mermaid-cli is a local npm CLI (mmdc), no hosted API, no credentials. Agent bled in API-key text from unrelated search results✗ wrong
WhatsApp BusinessauthunknownBearer access tokens (temporary token for testing, permanent system-user token in production)✗ wrong
WhatsApp Businessaccessself-serve (free test numbers)Confirmed: free test number + temporary token, no payment or approval to start✓ right
Fanbasisidentity + authapidocs.fan, API key from dashboardConfirmed: apidocs.fan is FanBasis; x-api-key header, key copied from dashboard, sandbox available✓ right
PitchBookaccess + buildablepartial, buildable: yes'The API is a separate offering from the PitchBook platform that requires a standalone contract agreement' — gated behind sales, not buildable self-serve✗ wrong
Waterfall.ioidentity + accesspartial — master API key on signup, likely paidRight entity (contact/company enrichment); docs confirm x-api-key and are silent on pricing — the hedge is the honest answer✓ right
Ahrefsaccesspartial — API key requires paid Ahrefs planConfirmed: API keys created in account settings on paid plans; no free API tier✓ right
TelegramauthAPI Key (bot token from BotFather)Confirmed: bot token from @BotFather; api_id/api_hash for MTProto apps✓ right
Shopifyauth + accessOAuth2 + session tokens, self-serve via custom app in dev dashboardConfirmed: custom apps installable on a dev store generate access tokens without review; OAuth for public apps✓ right
Amazon Selling Partneraccesspartial — requires Amazon approval for data accessConfirmed: developer registration and role-based approval required before SP-API access✓ right
Zendeskaccesspartial — paid plan or approvalFree 14-day trial has full API access, and Zendesk sponsors non-expiring dev instances — self-serve for developers✗ wrong