Picture this: your team is weighing WSO2 API Manager, and you open the APIs.io profile to see how it looks to an agent before you commit. The headline is good. WSO2 scores 83.0 on the Kin Score, in the exemplar band, flat at 0.1 below the last run. Its Agent Readiness is 35.4, agent-ready. The post calls that one of the stronger records an API management vendor holds on the network.
You keep reading, because the number is only where the story starts. The record counts 9 published APIs: Publisher v4, DevPortal v3, Admin v4, Gateway v2, Service Catalog v1, DevOps v0 and Governance v1, along with a client registration API. Those were split into 90 OpenAPI contracts, with 142 JSON Schemas pulled out of them. None of the 90 is marked as derived, and the rubric counts all of them as callable.
Then you look at where the server entries fall. Admin v4 has 51 and DevPortal v3 has 29. Gateway v2 has 10, Governance v1 has 4, and DevOps v0 and Service Catalog v1 have 2 each. Client Registration v0.17 has 1. Publisher v4 has none.
That is the API you would use to create an API, version it, attach policies and push it to a gateway. It is the first documentation link in WSO2's own pointer list, and it has no contract on apis.io. The word "publisher" shows up in eight of the files, but none is served from /api/am/publisher/v4. The post says plainly that the catalog dropped it somewhere in the split. In its words, this is the catalog's defect, not WSO2's.
You also notice something about the hosts. Every one of the 90 servers is apis.wso2.com, the placeholder host WSO2's own definitions ship with. API Manager is software you run yourself, and the examples inside the same contracts call https://localhost:9443. So a callable score of 100.0 only means the contracts declare a server. It does not mean an agent outside your installation can reach one. For your evaluation, that is the caveat that counts.
The facet scores give you the shape of the record. Access clarity is 92.1, operational transparency 86.8 and discoverability 83.3. Contract quality is 64.1, contract governance 62.9 and developer ergonomics 57.7.
The agent section is where the post turns on its own catalog a second time. The agentic-access file maps 268 operations, 122 of them acting and 6 human-in-the-loop. It is derived, and so are the Agent Skills, so neither counts as WSO2's work. The scope file holds 51 scopes under the password grant. The record also lists a "WSO2 MCP Server" at apis.wso2.com that requires OAuth. When the post read the source, that turned out not to be a server WSO2 runs. It comes from the DevPortal's /mcp-servers endpoints, which list the MCP servers an installation publishes to its own developers. The post finds that capability genuinely interesting, since WSO2 is turning a gateway into an MCP registry. But it describes a feature of the product, not an endpoint the catalog probed, and the record should say so. That is also the catalog's defect.
One more figure keeps the score honest. Of the 103.3 rubric points the record earns, at least 42.0 come from artifacts WSO2 published itself.
So you adjust how you read the profile. The 83.0 is real, but it sits on a record with a missing contract, a placeholder host and a mislabeled MCP entry. The post names three fixes. The catalog needs to restore Publisher v4 as a contract and relabel the MCP entry as a product capability. WSO2 could document idempotency on its write operations, which is one of the dimensions still dark in the Agent Readiness record. Protected resource metadata, dynamic client registration and a well-known catalog are dark too.
What you take away is practical. Check which contracts a score actually covers before you lean on it. Treat placeholder hosts as a sign that you will run the thing yourself. Notice that a catalog willing to list its own mistakes is giving you better evidence than a clean number would. The post closes by saying WSO2 has published a management plane most vendors keep private, and the catalog should show all of it.
Read the original: https://apis.io/2026/10/24/wso2-scores-83-on-ninety-contracts-and-none-of-them-is-the-publisher-api/