Localhostlocalhost.direct.
Localhost's API program has a functional contract at its core, but the partner-facing layer is almost entirely absent: there is no self-service portal, no quickstart, no code samples, and no sandbox — meaning partners and their AI agents cannot onboard without direct intervention. The two most urgent gaps are Developer Experience (no portal, no guided first call, no changelog) and Agent Usability (no sandbox, no idempotency or rate-limit guidance), both of which block partners from ever reaching a first successful integration.
API DesignA clean, typed, well-governed API contract agents can reason about2 pass2 warn1 fail79B
| Signal | Points | Findings | Rationale | |
|---|---|---|---|---|
| pass | Auth declared & discoverablevia spec | 25/25 | Authentication is required across the API (declared globally or on every operation), so an agent knows credentials are needed. Investigated: spec 100%, docs 100%. | Agents can only call an API when they can determine its auth posture — a declared scheme, or an explicit statement that none is required. |
| warn | Machine-readable, versioned contractvia spec | 18.8/25 | The API sets a version ("1.0.0") but exposes no versioning scheme in the URL, a header, or the media type, so an agent can't pin to a specific version. Investigated: spec 75%, docs 50%. Fix: Pick a versioning scheme (URL path /v1/, Accept: application/vnd.x+json, or a version header) and apply it consistently. | A current OpenAPI version with a declared versioning scheme lets agents reason about the contract. |
| warn | Schema coverage & depthvia spec | 16.7/25 | Only 0% of the 3 operations document request and response schemas, so an agent can't do function-calling against most endpoints. Investigated: spec 67%, sdk 0%. Fix: Add request and response schemas to enable agent function-calling. | Typed, complete request/response schemas are what make agent function-calling possible. |
| pass | Security & governance hygienevia spec | 15/15 | No credential-shaped strings detected in spec. Investigated: spec 100%, sdk 83%, wellknown 0%. | No leaked secrets, no critical lint violations, no OWASP API Top-10 spec smells, and a published vulnerability-disclosure channel. |
| fail | Example coveragevia spec | 0/10 | No parameters or responses are defined to attach examples to, so example coverage can't be measured. Investigated: spec 0%, docs 0%, sdk 0%. Fix: Add example values to parameters and response schemas. | Examples carry shape semantics schemas under-specify — for humans and agents alike. |
Developer ExperienceThe context both developers and agents need to integrate fast — onboarding, code samples, complete descriptions and worked examples1 pass0 warn4 fail43F
| Signal | Points | Findings | Rationale | |
|---|---|---|---|---|
| pass | Description completenessvia spec | 15/15 | Only 83% of operations and parameters have substantive descriptions (2 of 3 ops, 0 of 0 params; target 90%+). Investigated: spec 100%. | Complete descriptions are the context humans and agents need to use endpoints. |
| fail | Self-service developer portalvia docs | 0/29 | No self-service signup detected — no signup link on the homepage or docs, and no conventional signup path (/signup, /sign-up, /register, /get-started, /console/signup, /dashboard/signup, /try, /try-free, /free, /free-trial, /start, /start-free, /join, /create-account, /account/signup, /auth/signup, /users/sign_up) resolved — so an agent can't onboard on its own. Investigated: docs 0%. Fix: Publish a public signup endpoint and link it from your homepage/docs to compress time-to-first-call. | A first call without a human in the loop — self-serve credentials, a free tier, or an API that needs none. |
| fail | Quickstart presentvia docs | 0/25 | No quickstart or getting-started page found at the conventional docs paths, so new developers and agents have no obvious first step. Investigated: docs 0%. Fix: Publish a single-page quickstart that goes from zero to a first successful API call. | A quickstart is the fastest path from landing page to first successful call. |
| fail | Code samples in docsvia docs | 0/18 | No code samples detected across 1 sampled docs pages, so a coding agent gets no ready-to-use examples. Investigated: docs 0%. Fix: Add copy-pasteable code samples to API reference and quickstart pages. | Multi-language samples shorten time-to-first-call. |
| fail | Changelog publishedvia spec | 0/13 | No changelog link or mention appears in the spec, so an agent can't tell what changed before something breaks. Investigated: spec 0%, docs 0%. Fix: Publish a structured changelog (e.g., /changelog.json or releases.atom) and reference it in info or externalDocs. | A published changelog lets partners track changes without surprise. |
Agent DiscoveryPartners and their agents can find your APIs — llms.txt, registries, crawlable and reachable docs2 pass1 warn1 fail71B
| Signal | Points | Findings | Rationale | |
|---|---|---|---|---|
| pass | Docs reachable, not hard auth-gatedvia docs | 30/30 | All 1 pages are publicly accessible. Investigated: docs 100%. | Agents can only index and fetch docs they can reach — past auth gates and over correct HTTP semantics. |
| pass | Registry & SDK presencevia docs | 28/28 | Indexed on Context7 (openai/tunnel-client, 1687 snippets). Investigated: docs 100%, sdk 88%, cli 0%. | Listing in MCP registries and publishing SDKs puts the API where agents and their tooling look. |
| warn | Crawlable / AEOvia wellknown | 6/12 | No sitemap found via robots.txt or /sitemap.xml on the docs host, so AI search engines have no crawl map for your docs. Investigated: wellknown 50%. Fix: Publish an XML sitemap and reference it from robots.txt. | Bots allowed plus a fresh sitemap make docs findable by agent crawlers. |
| fail | llms.txt present, valid & comprehensivevia docs | 0/30 | No llms.txt found at any candidate location (https://get.localhost.direct/llms.txt, https://get.localhost.direct/docs/llms.txt). Investigated: docs 0%. | A valid, comprehensive llms.txt is the machine-readable entry point for agents. |
Agent UnderstandingAgents can correctly interpret your APIs — machine-readable errors, consistent descriptions, structured data, parseable docs1 pass3 warn2 fail56D
| Signal | Points | Findings | Rationale | |
|---|---|---|---|---|
| pass | Agent-navigable, token-efficient docsvia docs | 22/22 | All 1 pages contain server-rendered content. Investigated: docs 100%. | Server-rendered, clean, small-footprint docs are what an agent can cheaply fetch and parse correctly. |
| warn | Operation purpose clarityvia spec | 12.5/25 | Only 67% of operations (2 of 3) have both a clear summary and a descriptive name (target 90%+), so an agent may pick the wrong endpoint for the rest. Investigated: spec 50%. Fix: Give every operation a concise summary and a descriptive operationId so an agent can pick the right endpoint without guessing. | Agents select the right endpoint from its summary + operationId; clear, named operations make tool-selection reliable — the strongest driver of correct tool choice. |
| warn | Agent instructions file (AGENTS.md)via sdk | 5/10 | No agents.md or skill.md context file found (nice-to-have for agent operation). Investigated: sdk 50%, wellknown 0%. Fix: Add an agents.md or skill.md describing how an agent should use this SDK (auth setup, key operations, gotchas). | An AGENTS.md gives coding agents explicit setup, auth, and usage instructions to interpret and operate the API — beyond llms.txt's link index. |
| warn | Description consistency across surfaces | 1.3/7 | Mean pairwise description similarity across 2 surfaces (docs, sdk) is 6% (threshold 35% for full credit). Fix: Align the API description across spec, docs, and SDK so an agent reading any one surface gets the same story. | Every surface tells the same story about what the product is. |
| fail | Machine-readable errors (RFC 9457)via spec | 0/28 | No error responses (4xx/5xx or a catch-all default) are documented anywhere in the spec, so an agent can't anticipate or handle failures. Investigated: spec 0%, docs 0%. Fix: Document at least the common error codes (400, 401, 403, 404, 429, 500) per operation. | RFC 9457 problem details and a documented error-code inventory let agents parse failures without burning tokens. |
| fail | Docs structured datavia docs | 0/8 | No JSON-LD or OpenGraph/meta tags found across 1 assessed pages (1 JS-rendered), so answer engines have nothing to cite. Investigated: docs 0%. Fix: Server-render structured data (JSON-LD) so AI answer engines can cite your docs. | Structured data (JSON-LD/schema.org) on docs pages gives agents an unambiguous parse target and is what answer engines cite. Detected on the JS-rendered head (Firecrawl) for a bounded page budget, so JS-injected JSON-LD is now caught; pages we can't render are excluded rather than failed. |
Agent UsabilityAgents have the context to use your APIs reliably, not just find them0 pass1 warn3 fail41F
| Signal | Points | Findings | Rationale | |
|---|---|---|---|---|
| warn | Runnable collection with test scriptsvia platform | 4.5/9 | No test scripts found in the workspace's public collections, so an agent can't use them to verify API behavior. Investigated: platform 50%, sdk 0%. Fix: Add pm.test() assertions so the collection can be used as an agent-runnable test suite. | A public, maintained collection with assertions is runnable truth agents validate against. |
| fail | Idempotency documentedvia spec | 0/27 | Only 0% of mutating operations (0 of 1) document idempotency, so an agent's retries can create duplicate writes. Investigated: spec 0%, docs 0%. Fix: Agents retry on failure; without idempotency, retries create duplicates. Document Idempotency-Key on every POST/PUT/PATCH/DELETE. | Documented idempotency lets agents retry safely. |
| fail | Rate-limit signalingvia spec | 0/22 | No rate-limit response headers are documented, so an agent can't tell when it is approaching a limit and will get throttled. Investigated: spec 0%, docs 0%. Fix: Add x-ratelimit-* response headers and document retry-after semantics. | Machine-readable rate-limit headers let agents throttle adaptively. |
| fail | Sandbox separationvia spec | 0/20 | None of the 1 declared server(s) is a sandbox/test host, and no test-key prefixes are documented, so agents can only hit production. Investigated: spec 0%, docs 0%. Fix: Add a sandbox server in spec.servers[] with visually distinguishable test credentials. | An isolated environment lets agents exercise destructive operations safely. |
| na | Pagination documented & consistent | —/22 | No surface produced evidence for this capability in this run. | Consistent, documented pagination lets agents traverse collections. |
Resources Discovered
The public resources we found for Localhost — the evidence behind the score. All discovered from public sources; nothing here requires access to your systems.
| Agent hints | Context7 (1,687) |
|---|---|
| APIs analyzed | 1 — blacklist-collection |