Week of July 12 – July 20, 2026
Agent Skills Land in the Toolchain, and a Benchmark Lands Right Behind Them
There is a rhythm to how a technology enters the API world. First somebody ships it. Then everybody reprints it. Then, eventually — usually years later, usually after enough people have been burned — somebody builds the thing that tells you whether yours is any good. Agent Skills compressed that whole arc into about six days this week, and that compression is the story.
6,229 posts went out in the last seven days across the 3,652 API-bearing providers I track, and 4,447 of them carried an API-related signal in the title. Last week I wrote that MCP had grown an economy — auth, cost, tool design, incidents. This week the spotlight moved one layer up the stack, to Agent Skills, and it moved fast enough that the quality layer showed up before the hype cycle finished.
Agent Skills Land in the Toolchain
Last week Agent Skills were something providers published. This week they became something your development environment ships with.
- JetBrains put AI Agent Skills and MCP tools into DataGrip 2026.2 for data source management, and shipped Agent Skills in WebStorm 2026.2 alongside TypeScript 7 support — two IDEs, one release cycle.
- Microsoft built .NET and Azure expertise into Visual Studio as built-in Agent Skills — not a marketplace download, not a config file you assemble yourself, but expertise shipped as a default.
- Amazon Managed Service for Apache Flink now offers AI Agent Skills for building and operating Flink applications — and it landed in more than fifteen of my provider repos at once, which is how AWS announcements always tell you they touched a nerve.
- NVIDIA post-trained Cosmos 3 in a day using Agent Skills and ran an autoresearch workflow with RL Agent Skills and NeMo — skills as a research instrument, not just a docs wrapper.
- Hashnode shipped an official GQL Agent Skill that teaches coding agents how to use its GraphQL API from Claude Code, Cursor, and Copilot — the small-provider version of the same move, and one I added to Hashnode’s profile in my catalog this week.
Here is what I want you to notice. An Agent Skill is documentation that executes. It is the how-to-use-my-API knowledge that used to live in a getting-started guide, packaged so a machine can act on it. When JetBrains and Microsoft build that into the IDE, they are making a claim about where API knowledge belongs — not on your developer portal where a human goes to read it, but inside the tool where the work happens. If your API’s usage knowledge only exists as prose on a docs site, you are publishing to an audience that is quietly moving out of the room.
And the Quality Layer Arrives With Them
This is the part that genuinely surprised me. Normally the “is yours any good” tooling trails the technology by years. This time it showed up in the same news cycle.
- Arcade published SkillBench, a quality benchmark for Agent Skills — an actual scoring harness for a format that is roughly a year old.
- Microsoft published how to test agent skills without hitting real APIs — the mocking-and-fixtures discipline, which is the least glamorous sign that something is being taken seriously.
- Nango surveyed the best MCP servers for agent API integrations in 2026 — the comparison-shopping genre, which only exists once there are enough options to be wrong about.
Benchmarks are how a format stops being a vibe. SkillBench and a testing methodology in the same week as four major vendors shipping skills means the people building this are not waiting for the reckoning — they are front-running it. I have spent sixteen years watching API formats arrive without a way to evaluate them, and watching the evaluation arrive a decade late, after everyone had already shipped something unmeasurable. This is better. It is also a warning: once a benchmark exists, “we shipped an Agent Skill” stops being the accomplishment and starts being the entry fee.
MCP Settles Into Infrastructure
MCP did not slow down; it just stopped being the headline and started being the plumbing, which is the more meaningful promotion.
- Solo.io demonstrated warm scale-to-zero MCP servers with agentgateway and Agent Substrate — the cost-control argument from last week turned into an actual runtime pattern.
- Microsoft showed how to build long-running MCP tools on Azure Functions — because the first generation of MCP tools all assumed the work finished inside one request, and real work does not.
- Meta made its ads MCP server available to developers — campaign creation, performance insights, and catalog management through natural language, from one of the largest advertising APIs in existence. I added it to Facebook Business Manager’s profile this week.
- Spike introduced its MCP server for incident payloads, root-cause digging, and on-call schedules — incident response becoming conversational, which is either wonderful or terrifying at 2am.
- GoDaddy launched a developer platform explicitly framed as “domain APIs for developers and their agents” — note the “and their agents” in the launch title itself. That phrasing was a novelty a year ago.
- And Bump.sh white-labeled the MCP server, which I wrote about, because when your docs vendor generates the MCP server for you, the bottleneck stops being production and becomes discovery.
Scale-to-zero, long-running jobs, and white-label generation are all late-stage concerns. You do not optimize the cold-start cost of something nobody runs. The interesting problem is no longer building an MCP server — it is finding the right one, which is exactly the discovery gap I have been building toward.
From My Desk: The Governance Toolchain Got Built
I keep saying there is no platform for API governance. This week I stopped complaining and shipped the pieces — nine days, and it hangs together as one argument.
- I stated the thesis outright: there is no platform for API governance, and laid out the OpenAPI governance toolchain as the alternative — many small sharp tools instead of one product nobody will buy.
- Memory and provenance: on API governance needing memory, then governance memory in practice, running OWASP across my own APIs, plus a registry of adoptable, provenanced governance rulesets and a federated API governance rule registry.
- Rules that mean something: a grounded Spectral ruleset for the OWASP API Security Top 10, from a prose style guide to a grounded Spectral ruleset, and the uncomfortable question how much of your API do your rules actually check?
- Process and proof: a reference pipeline for API governance in CI/CD, scoring your Spectral CI setup against a maturity rubric, making governance exceptions sanctioned, owned, and expiring, and tamper-evident certificates for API governance.
- Tying it together: binding governance building blocks into one navigable graph, and every schema property has a history worth documenting.
The through-line: governance fails not because the rules are wrong but because it has no memory, no provenance, no measure of its own coverage, and no honest way to say “we are knowingly breaking this rule until March.” A waiver that expires is worth more than a rule nobody can follow. And a certificate you can verify beats a dashboard you have to trust.
I also made some of this commercial, which I will say plainly rather than bury: you can now hire me to score your API’s agent readiness, APIs.io is the first to license the API Evangelist rating system, and I explained why I am doubling down on API discovery and governance and how I am monetizing my APIs and MCP without walling off the map.
Profiling, Onboarding, and the Front Door
I ran two long threads alongside the governance work: how deeply you can profile a provider, and whether anyone can actually get in the door.
- Profiling: what actually goes into profiling Stripe, using Stripe as the blueprint for a deeper profiling process, then what goes into profiling Twilio and how Twilio stress-tests the blueprint I built on Stripe. Building a process on your best example and then breaking it on your second one is the only way to learn what the process actually is.
- Onboarding: Gravitee gets closer than most, what programmatic onboarding looks like when the gateway is Tyk, WSO2 API Manager already speaks programmatic onboarding, IBM API Connect has a real consumer API but not a real front door, and Zuplo has the onboarding API, it just points it at the wrong door.
- Overlays, still the most underused tool in the box: for adding tool-specific content without polluting the spec, for SDK generation prep, and for separation of concerns when you do not own the spec.
The onboarding reviews keep landing on the same finding, and it connects straight back to the top of this newsletter. Four of the five platforms I looked at have the onboarding API. They just point it at an internal audience, or behind a console, or at the wrong door. An agent cannot navigate a wrong door any better than it can click “Generate API Key.” You can ship built-in Agent Skills and a scale-to-zero MCP server and still be unreachable, because the credential path at the very start still assumes a human with a mouse.
Sprawl, Specs, and the Public Record
The last thread was the structural one — what we have collectively built, and who gets to keep it.
- I tried to define the term everyone uses loosely: what API sprawl actually is, followed by the organizational roots of API sprawl. Sprawl is not a tooling failure. It is an org chart with an API surface.
- The volatile and selfish API specification landscape — my least diplomatic post of the week, and I stand by it.
- Two pieces of genuinely good news from the public sector: Germany built the API authorization blueprint the rest of government needs, and OGC quietly built the API reuse register the rest of us keep talking about. Both are the unglamorous institutional work that outlasts every vendor cycle in this newsletter.
- And the one that got the most argument: VCs screwed themselves by restricting interoperability.
That is the week. Agent Skills moved into the toolchain and brought their own benchmark, MCP quietly became infrastructure, and I spent nine days building the governance toolchain I keep insisting no vendor is going to hand you. Next week I will be watching whether SkillBench gets adopted or ignored — because a benchmark nobody runs is just a blog post, and the difference between those two outcomes tells you whether Agent Skills are a format or a fashion.
If you want this analysis applied to your own API operations, that’s what I do.
