Your API's newest users are agents...
Who called your API last? For us, the honest answer is more and more often an agent. Claude Code debugging a flow. An assistant looking up an order. Someone's custom GPT. Our tools still assume a human pressing Send. This post is about that gap. How we ran into it ourselves, how most teams handle it today, and what we changed. How we ran into it We run ApyHub, a catalog of utility APIs. This year…
Your API's newest users are increasingly agents, according to ApyHub. The company, a catalog of utility APIs, recently built an MCP server to allow assistants like Claude, ChatGPT, and Le Chat to call APIs directly. However, they soon realized the drawbacks of this approach.
The main issues they encountered include updating both the existing API and the MCP server when changes are made, and testing the MCP side, which proved to be a tedious process. They identified three main problems: your own coding agent debugging, someone else's agent calling an endpoint, and testing an MCP server.
To address these issues, ApyHub implemented a solution where requests exist as plain Markdown files in the repository. With a single command, a coding agent can now list, run, and inspect those requests. This allows the agent to call the real endpoint and read the real response, eliminating the need for manual intervention.
The same approach is applied to testing MCP servers. By saving calls, adding assertions, and running them in CI, ApyHub ensures that the responses match the expectations, just like with REST APIs. This approach provides a single description of the API, reducing the chances of discrepancies between different versions of the API.
All three solutions live in a single file, and changes go through a pull request, making permission decisions a review trail. ApyHub believes that giving agents access to an API should be a permission decision, and they are curious about how others handle this aspect.
The company plans to continue refining and improving this system, as they have found it beneficial for their daily use. They are open to hearing about others' experiences and approaches in managing agent access to APIs.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
