A short piece of fiction, written by API Evangelist. The reader is imagined; the post they read, and every number and quotation in it, is real: "Twenty-Four Agent Bundles And Not One MCP Server," Kin Lane, October 6, 2026, https://apievangelist.com/2026/10/06/twenty-four-agent-bundles-and-not-one-mcp-server/
Tomas opened the post because of the headline, and he opened it ready to argue. His team had spent the spring building an MCP server for their invoicing API. It was on the roadmap slide. It was, as far as his manager was concerned, the agent strategy.
The post did not argue with him. It counted. APIMatic, a company that has generated SDKs from OpenAPI for eleven years, had published twenty-four agent context bundles, and the author had pulled their catalog.json and read the runtime field on every one. Twenty-four out of twenty-four said there was no MCP server inside. What was inside instead was markdown: the same eight skill files in every bundle, a ninth in eighteen of them, and generated SDKs in .NET, Python and TypeScript.
Tomas scrolled to the list of skill files and read it slowly. Getting started. Authentication. Client initialization. Calling endpoints. Models. Error handling. Configuration and resilience. Testing. He thought about the last three support tickets his team had answered, and every one of them was a question from that list. None of them was a question an MCP tool call would have answered, because each was asked while someone was still writing the integration, before there was anything to call.
That was the distinction the post kept making. MCP is for an agent calling something at runtime. These bundles were aimed at the agent writing the integration. "You cannot serve that over a tool call," the author wrote. "You serve it as text the agent reads before it writes a line."
He kept reading, still a little defensive, and then he got to the health ladder.
APIMatic had published a five-point scale in the same file, in their own words, from "Known gaps in output" up to "Checked against the live API," and given every bundle a number on it. Nine were at the top. Fourteen were at 2, built from the published spec only and labeled "Not verified." One, Plaid, had no number at all. The author called the ladder the single most credible thing on the site, and Tomas understood why. He had never seen a directory admit which of its own entries it hadn't checked.
Then came the part he read twice. The author sorted the nine verified bundles and the fourteen unverified ones and found a line between them. Most of the verified ones were read-only feeds such as crypto prices, equities, sports scores, currency rates and a scraper, where a test call is free and changes nothing. The exceptions the author pointed to were Square and Twilio, which both have a safe place to test: Square a sandbox with fake money, Twilio a trial with test credentials. The unverified ones included payments, Slack, Notion and a car company, APIs where a test call does something real.
"You can check a read," the post said. "You cannot casually check a write."
Tomas's API sends invoices. A test call sends an invoice to someone. There is no sandbox. There had been a ticket for one, opened three years ago and moved to every next quarter since.
"The APIs where an agent most needs correct, tested integration knowledge are exactly the APIs nobody can afford to test against." He copied that line into the team channel without comment and watched the typing indicators start and stop.
The post ended with a short list of asks. Publish a health ladder for whatever you generate. Stop treating MCP as the scoreboard. And build the sandbox, because "Fourteen unverified bundles is a provider-side problem wearing a vendor-side costume."
Tomas did not take the MCP server off the roadmap. The post had not told him to, and the author said plainly that both layers are going to exist. But he did two things before lunch. He reopened the three-year-old sandbox ticket and moved it above the MCP work. And he started a markdown file in the repo called authentication.md, because when he looked, his own docs didn't have one.