generated: '2026-08-31'
method: probed
source: live probes 2026-08-31 + openapi/reefapi-openapi.json + https://reefapi.com/docs + mcp/reefapi-mcp-tools.json
name: ReefAPI
slug: reefapi
summary: >-
  ReefAPI conforms to the discovery and agent-transport standards (OpenAPI 3.0.3,
  RFC 9727 API catalog, MCP 2025-06-18, llms.txt) and to none of the HTTP semantic
  standards (no RFC 9457 problem+json, no RFC 9331 rate-limit headers, no RFC 8594
  Sunset, no OAuth). That split is characteristic of an agent-first, RPC-over-POST
  gateway - the machine-discovery layer is unusually complete while the HTTP layer is
  deliberately minimal.
standards:
- id: openapi-3.0.3
  name: OpenAPI Specification 3.0.3
  conforms: true
  evidence:
    url: https://api.reefapi.com/openapi.json
    status: 200
    content_type: application/json
    detail: "Parses as OpenAPI 3.0.3 with 1,528 paths, 13 declared tags, components.securitySchemes and a global security requirement. Served on the API host root, not the docs host."
- id: rfc9727-api-catalog
  name: RFC 9727 - API Catalog well-known URI (application/linkset+json)
  conforms: true
  evidence:
    url: https://api.reefapi.com/.well-known/api-catalog
    status: 200
    content_type: application/linkset+json
    detail: "Correct linkset shape with an anchor plus service-desc, service-doc and status link relations. Rare - fewer than 1% of catalog providers serve one."
    file: well-known/reefapi-api-catalog.json
- id: rfc8288-web-linking
  name: RFC 8288 - Web Linking (link relation types in the linkset)
  conforms: true
  evidence:
    url: https://api.reefapi.com/.well-known/api-catalog
    status: 200
    detail: Uses the registered service-desc and service-doc relations plus a status relation.
- id: mcp-2025-06-18
  name: Model Context Protocol 2025-06-18, streamable-HTTP transport
  conforms: true
  evidence:
    url: https://api.reefapi.com/mcp
    status: 200
    detail: "initialize returned protocolVersion 2025-06-18, serverInfo {name reefapi, version 1.27.2} and a capabilities object with tools/prompts/resources. Session managed via the mcp-session-id header. tools/list returns 5 tools with JSON Schema inputSchema."
- id: mcp-server-json
  name: MCP server.json manifest (schema 2025-12-11) and Official MCP Registry listing
  conforms: true
  evidence:
    url: https://registry.modelcontextprotocol.io/v0/servers?search=reefapi
    status: 200
    detail: "Published as io.github.reefapi/reefapi-mcp, status active, latest 1.27.2, with a remotes[] entry declaring the streamable-http endpoint and its required Authorization header."
- id: llms-txt
  name: llms.txt convention
  conforms: true
  evidence:
    url: https://reefapi.com/llms.txt
    status: 200
    detail: "Well-formed llms.txt with an H1, a blockquote summary and sectioned links; a 520KB llms-full.txt companion; plus a per-engine markdown twin at /docs/{engine}.md for all 183 engines."
- id: json-schema
  name: JSON Schema (via OpenAPI 3.0 Schema Object and MCP inputSchema)
  conforms: partial
  evidence:
    detail: "MCP tool inputSchemas are well-formed JSON Schema. The OpenAPI request bodies are structurally valid but semantically thin - every property is `type: string` with no description, enum, default or example, even where the docs publish enums (e.g. amazon marketplace has 19 allowed values in docs, none in the spec). Response `data` is entirely untyped."
- id: rfc9457-problem-details
  name: RFC 9457 - Problem Details for HTTP APIs
  conforms: false
  evidence:
    detail: "Uses a vendor envelope { ok, data, meta, error{code,message,retryable} } with content-type application/json. No application/problem+json anywhere in the spec or on a live 401."
    see: errors/reefapi-problem-types.yml
- id: rfc9331-ratelimit-headers
  name: RateLimit header fields for HTTP (RFC 9331 draft family)
  conforms: false
  evidence:
    url: https://api.reefapi.com/currency/v1/convert
    status: 401
    detail: "No RateLimit-*, X-RateLimit-* or Retry-After headers on a live response. Limits are documented in prose and signalled only in the response body."
- id: rfc8594-sunset
  name: RFC 8594 - The Sunset HTTP Header Field
  conforms: false
  evidence:
    detail: No Sunset or Deprecation headers observed; no deprecation policy published; zero deprecated operations in the spec.
- id: rfc9116-security-txt
  name: RFC 9116 - security.txt
  conforms: false
  evidence:
    url: https://api.reefapi.com/.well-known/security.txt
    status: 404
    detail: 404 on both api.reefapi.com and reefapi.com.
- id: oauth2
  name: OAuth 2.0 / OpenID Connect
  conforms: false
  evidence:
    detail: "API-key auth only (x-api-key on REST, Bearer on MCP). No oauth2 securityScheme in the spec; /.well-known/openid-configuration, /oauth-authorization-server and /oauth-protected-resource all 404. Not a gap - it is a deliberate single-credential model."
- id: rest-http-semantics
  name: RFC 9110 HTTP semantics for resource APIs (GET-safe reads, path/query params)
  conforms: false
  evidence:
    detail: "RPC-over-POST by design: all 1,528 operations are POST with a JSON body, including pure reads. No caching, no conditional requests, no safe-method semantics. A deliberate architecture choice, recorded rather than penalised."
- id: a2a
  name: A2A Agent Card
  conforms: false
  evidence:
    url: https://api.reefapi.com/.well-known/agent-card.json
    status: 404
    detail: "404 on api.reefapi.com and reefapi.com, and 404 on the legacy /.well-known/agent.json path on both. No card published - no a2a/ artifact was written."
domain_standard:
  applicable: false
  market: web data extraction / SERP and marketplace data aggregation
  detail: >-
    REWARD-ONLY CHECK, CORRECTLY EMPTY. The web-data-extraction market has no
    interoperability standard - there is no schema body, no shared message type and no
    conformance profile that a scraping/aggregation gateway can declare. Competitors
    named on the provider's own comparison pages (Bright Data, Oxylabs, Zyte, SerpAPI,
    ScraperAPI, ScrapingBee, ZenRows, Firecrawl, Apify, Diffbot, DataForSEO, Octoparse,
    ParseHub) each publish a bespoke contract for the same reason. The contract was
    searched for SCIM URNs, OData $metadata, OpenRTB, Sparkplug, ActivityPub, LTI /
    OneRoster / Ed-Fi / Caliper / QTI, OAI-PMH verbs, ORCID / DataCite / Crossref
    identifier schemes and HL7v2 / X12 / EDIFACT / ISO 20022 message types - none
    present, and none would be appropriate. Nothing invented to fill the slot.
  adjacent_note: >-
    Two engines DO touch standards-bearing domains without claiming conformance -
    `academic` proxies OpenAlex, arXiv and Crossref (and exposes author_id / venue_id /
    institution_id / concept_id filters that are OpenAlex entity identifiers), and
    `hs-code` works in WCO Harmonized System tariff codes. These are pass-through
    vocabularies of the upstream source, not a conformance ReefAPI declares in its own
    contract, so they are recorded here rather than as a domain_standard claim.
compliance_certifications:
  published: false
  soc2: false
  iso27001: false
  gdpr_statement: see https://reefapi.com/privacy
  detail: >-
    No trust center, no named certification (SOC 2, ISO 27001, PCI DSS, HIPAA, FedRAMP)
    and no compliance page found on either host. probe-security-programs.py returned
    vdp=none trust=none. No Compliance or TrustCenter pointer is emitted.