# Cyber Security Centre — API Agent Score

> Score: 71/100 (Grade: B) | Domain: cyber.gc.ca | Rubric: 1.0.0 | Checked: October 28, 2026

Cyber Security Centre scored 71/100 (B), classified "partially-ready".

[View full report](https://www.postman.com/ai/ai-ready-apis/company/gc)
[All organizations](https://www.postman.com/ai/ai-ready-apis/llms.txt)

## Summary

- Overall: 71/100 (B)
- Classification: partially-ready

## Category Scores

- API Design: 99/100 (A+)
- Developer Experience: 45/100 (F)
- Agent Discovery: 71/100 (B)
- Agent Understanding: 57/100 (D)
- Agent Usability: 85/100 (A)

## Check Results

### API Design

- [pass] Auth declared & discoverable — The MCP server at https://api.contrastcyber.com/mcp/ accepts unauthenticated requests, so an agent knows it needs no credentials. Investigated: mcp 100%.
- [warn] Schema coverage & depth — 21/21 (100%) public params are fully typed (no any/**kwargs). Analyzer confirms all methods have a derivable input schema. Investigated: sdk 98%.
- [pass] Security & governance hygiene — Code is formatter-clean with zero linter errors and zero style warnings. Investigated: sdk 100%, wellknown 0%.
- [pass] Example coverage — README is present and includes a runnable quickstart. Investigated: sdk 100%, docs 0%.
- [skip] Machine-readable, versioned contract — No surface produced evidence for this capability in this run.

### Developer Experience

- [warn] Quickstart present — Quickstart page is reachable at https://www.cyber.gc.ca/en/tools-services/sms/quickstart (1 variants scanned) but has no runnable code sample in its HTML or .md variant, so there's nothing to copy and run. Investigated: docs 50%.
- [warn] Description completeness — 12/18 operations lack a description. Investigated: sdk 33%.
- [fail] Self-service developer portal — No self-service signup detected — no signup link on the homepage or docs, and no conventional signup path (/signup, /sign-up, /register, /get-started, /console/signup, /dashboard/signup, /try, /try-free, /free, /free-trial, /start, /start-free, /join, /create-account, /account/signup, /auth/signup, /users/sign_up) resolved — so an agent can't onboard on its own. Investigated: docs 0%.
- [fail] Code samples in docs — No code samples detected across 1 sampled docs pages, so a coding agent gets no ready-to-use examples. Investigated: docs 0%.
- [skip] Changelog published — No surface produced evidence for this capability in this run.

### Agent Discovery

- [pass] Docs reachable, not hard auth-gated — All 1 pages are publicly accessible. Investigated: docs 100%.
- [pass] Registry & SDK presence — Indexed on Context7 (llmstxt/cyberar_io_llms-full_txt, 0 snippets). Investigated: docs 100%, wellknown 100%, sdk 58%, cli 0%, mcp 0%.
- [warn] Crawlable / AEO — No sitemap found via robots.txt or /sitemap.xml on the docs host, so AI search engines have no crawl map for your docs. Investigated: wellknown 50%.
- [fail] llms.txt present, valid & comprehensive — No llms.txt found at any candidate location (https://www.cyber.gc.ca/en/tools-services/llms.txt, https://www.cyber.gc.ca/llms.txt, https://www.cyber.gc.ca/docs/llms.txt). Investigated: docs 0%, sdk 0%.

### Agent Understanding

- [pass] Agent-navigable, token-efficient docs — All 1 pages contain server-rendered content. Investigated: docs 100%.
- [warn] Operation purpose clarity — Read/write classification is mostly ambiguous: only 0/18 operations classified. Investigated: sdk 50%.
- [warn] Agent instructions file (AGENTS.md) — No agents.md or skill.md context file found (nice-to-have for agent operation). Investigated: sdk 50%, wellknown 0%.
- [warn] Docs structured data — Only OpenGraph/meta tags across 1 assessed pages — no JSON-LD for AI answer engines to cite. Investigated: docs 50%.
- [fail] Machine-readable errors (RFC 9457) — No single common SDK base error class was found; errors do not share one root. Investigated: sdk 0%.
- [fail] Description consistency across surfaces — Mean pairwise description similarity across 2 surfaces (docs, sdk) is 0% (threshold 35% for full credit).

### Agent Usability

- [pass] Idempotency documented — Built-in retry machinery is present (grep-derived). Investigated: sdk 100%.
- [warn] Sandbox separation — No test-mode flag or sandbox environment is exposed. Investigated: sdk 50%.
- [pass] Runnable collection with test scripts — README is present and includes a runnable quickstart. Investigated: sdk 100%, platform 0%.
- [skip] Rate-limit signaling — No surface produced evidence for this capability in this run.
- [skip] Pagination documented & consistent — No surface produced evidence for this capability in this run.

## Executive Summary

Your API design surface is strong — schema and types are well-structured, giving partners and their agents a solid contract to build against. However, the program has critical gaps in two areas that directly block partner adoption: partners and agents cannot discover your APIs without a sales conversation (no machine-readable discovery file, no self-service portal, no code samples), and once they do find your APIs, errors and descriptions are neither machine-readable nor consistent enough for agents to act on reliably. Prioritize establishing a self-service front door with agent-ready discoverability first, then close the error semantics and documentation consistency gaps to ensure partners and their AI agents can integrate with confidence.