The Security tag on apis.io holds 886 providers and 507 APIs, and the pair of numbers that frames it runs in opposite directions: 51.6% of its members have clear authentication documentation against 37.0% of the rest of the catalog, and 3.8% document idempotency against 4.4%. These are the companies you would expect to be careful about who may call an API. The numbers say they are, and that the care has not reached what happens when the same call arrives twice.
The top of the tag is exemplar, and two companies hold more than one slot, so this is one listing per company. Cloudflare leads at 80.6 on the Kin Score, carried by developer ergonomics at 91.1 across 651 API pages, and it is agent-native at 72.5 with idempotency, dry-run mode and documented reversibility all lit. Snyk, the developer security platform, scores 79.1 with operational transparency and access clarity at 92.1 each, while contract governance at 22.0 is the weakest facet in the five. Elastic follows at 77.6, led by discoverability at 82.1 and contract governance at 72.7; its separate Elastic Stack listing sits right behind at 77.0, and the two read differently, with idempotency and an MCP server lit on the Stack and dark on the company listing. Paubox, the HIPAA compliant email infrastructure company, scores 77.0 from only 13 API pages, with access clarity at 92.1 and an agent readiness of 63.3. Amazon Secrets Manager rounds it out at 76.8, with contract governance at 79.1, the strongest reading of that facet in the five, and seven API pages.
The cohort is ahead of the rest of the catalog, and the median shows it better than the mean. The 862 scored members average 27.3 against 20.5 for the 32,005 scored providers outside the tag, a gap of 6.8 points. The medians are 24.6 and 13.4, a gap of 11.2. The difference is at the bottom of the distribution: 25.6% of Security sits in the minimal band against 41.1% of everyone else, while exemplar is still rare at 2.8% against 1.7%, and strong is 7.9% against 4.7%. Security is not a category of leaders so much as a category with fewer empty listings. 29.3% of members reach developing or better, against 17.1% elsewhere.
Agent readiness is ahead by less, and at the very top it is behind. The tag averages 13.7 against 11.2, with 17.0% agent-ready against 13.0% and 46.4% human-only against 56.3%. Then the ladder inverts: 8 providers, 0.9% of the tag, are agent-native, against 1.7% of the rest of the catalog. The dimensions Security lights more than the market are the descriptive ones. Auth clarity leads at +14.6 points, then spec presence at 41.5% against 31.9%, error semantics at 30.4% against 21.8%, and agent skills at 20.6% against 13.7%. On the rest it is level or short. MCP server is 16.6% against 16.9%, rate limit signal 33.6% against 33.7%, and a well-known catalog 3.5% against 4.6%. Reversibility is documented by 7.7% and dry-run mode by 1.2%.
The leaders show what the top band actually asks for. Paubox has the second-highest agent readiness in the five at 63.3 and is agent-ready. Amazon Secrets Manager scores 42.8 and is agent-native. That is the rubric working: the top band is gated on idempotency and a stable error envelope, not on the score alone, and Paubox does not light idempotency. Neither do Snyk or Elastic. Among these five only Cloudflare and Amazon Secrets Manager do, and only Cloudflare pairs it with an MCP server.
Security has documented the door and not what happens after it opens. An agent pointed at this category is more likely than average to learn how to authenticate and to find a contract. At 96.2% of the tag it will not find a stated guarantee about a repeated call, and at 98.8% it cannot rehearse one. In most categories a duplicate is an annoyance. Here the writes are things like rotating a secret, changing a firewall rule or revoking a credential, and an agent that times out halfway through one has to guess. A category built around access has written down less about retries than the market has.