anyapi — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited anyapi (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
AnyAPI is a unified marketplace for scraping and data APIs: any API, one wallet, USD, no subscriptions. One key reaches the whole catalog; every API has a normalized input/output JSON Schema; failed calls are never charged (AnyAPI fails over across providers automatically under one price reservation).
https://api.getanyapi.com (REST) and https://api.getanyapi.com/mcp (MCP, Streamable HTTP)https://getanyapi.com/dashboardhttps://getanyapi.com/docsEvery run needs an AnyAPI key (an aa_live_... secret) in the ANYAPI_API_KEY environment variable, sent as Authorization: Bearer $ANYAPI_API_KEY. Discovery over MCP works without a key; running an API always requires one. Never hardcode or print the secret.
If `ANYAPI_API_KEY` is already set, use it. Otherwise mint one right here — no dashboard trip, no sign-in:
curl -s -X POST https://api.getanyapi.com/agent/signup \
-H "Content-Type: application/json" \
-d '{ "sponsorEmail": "<their email>", "label": "<your tool or repo name>" }'The response returns secret (the aa_live_... key — shown once), claimToken, and expiresAt. Put secret in ANYAPI_API_KEY and start working; it's seeded with a small USD grant so calls succeed immediately. Keep the claimToken; never print the secret.
claimed. Tell the user how to upgrade it — claiming lifts the cap, makes it permanent, and adds the one-time $1 account credit:
Sign in at https://getanyapi.com/dashboard with <their email>, open API keys → Claim agent key, and paste this token: <claimToken>Claiming upgrades the same key already in ANYAPI_API_KEY and moves it onto the user's funded wallet — nothing to swap. (If you passed sponsorEmail, that address also gets an approve/block email.)
list_apis, get_api, run_api, get_balancefrom the anyapi server): prefer it. Same catalog, schema-validated, structured output.
stick with it for the session.
list_apis with {"query": "<keywords>"} (and/or category).curl -s "https://api.getanyapi.com/v1/apis?query=<keywords>" -H "Authorization: Bearer $ANYAPI_API_KEY"SKUs are <platform>.<resource> slugs, e.g. reddit.search, instagram.profile, tiktok.profile, google.search, web.scrape.
get_api with {"sku_id": "<sku>"}.curl -s "https://api.getanyapi.com/v1/apis/<sku>" -H "Authorization: Bearer $ANYAPI_API_KEY"The response includes priceUsd, inputSchema, and outputSchema. Most APIs bill per result returned (baseUsd + perItemUsd × items) — set limit in the input to cap how many results you get and what you pay; simple lookups are flat per request. Build the input strictly from the schema's required and properties — invalid input is rejected without charge.
run_api with {"sku_id": "<sku>", "input": {...}}.curl -s -X POST "https://api.getanyapi.com/v1/run/<sku>" -H "Authorization: Bearer $ANYAPI_API_KEY" -H "Content-Type: application/json" -d '<input JSON>'Success returns {output, provider, costUsd}. output matches the SKU's output schema; provider is always "AnyAPI".
run_api returns the full normalized result by default. When a result would be large (many rows, or rows with many fields), trim what comes back so it doesn't flood your context. These are opt-in — MCP: pass them as fields on the run_api input; REST: append them as query params on /v1/run/{sku}:
fields — comma-separated keys to keep on each result item (dotted paths likeauthor.name descend into nested objects). The biggest saver: a page becomes a small object.
max_items — cap the number of result rows returned. A _truncated note reportshow many were withheld, so you can page via the SKU's own limit.
summary — return only a structural outline (top-level keys and item counts),not the bulk data. Useful to learn a result's shape before fetching it in full.
They change only what is returned to you, never what you are charged — costUsd reflects the full result the API produced. Example (REST):
curl -s -X POST "https://api.getanyapi.com/v1/run/reddit.search?fields=title,score&max_items=10" \
-H "Authorization: Bearer $ANYAPI_API_KEY" -H "Content-Type: application/json" -d '<input JSON>'Every successful run charges the wallet costUsd (typically fractions of a cent; the exact per-request price is on the SKU as priceUsd). Before a bulk job (more than ~20 calls), compute and state the estimated total cost (calls × priceUsd) and get the user's confirmation. Check the balance with get_balance (MCP) or GET /v1/balance (REST) when a run fails with insufficient funds, and point the user at the dashboard to top up. Never retry a failed run in a tight loop — failures are unbilled but retries won't fix invalid input or an empty wallet.
Many output schemas use the envelope {found: boolean, data: object|null}. {"found": false} is a successful, billed response meaning the entity doesn't exist upstream (e.g. a deleted profile) — do not treat it as an error or retry it.
Errors are machine-readable prefixes (MCP tool errors) or HTTP statuses (REST). None of these are charged:
| MCP prefix / REST status | Meaning | What to do |
|---|---|---|
unauthorized / 401 | Missing or invalid key | Check ANYAPI_API_KEY; mint one via self-signup (see Authentication) |
sku_not_found / 404 | Unknown SKU | Re-run discovery; don't guess slugs |
invalid_input / 400 | Input failed schema validation | Re-read the input schema and fix the payload |
key_cap_exceeded / 402 | Starter key hit its spend cap | Have the user claim the key (see Authentication) to uncap it |
insufficient_credits / 402 | Wallet too low | Ask the user to top up at getanyapi.com/dashboard |
all_providers_failed / 502 | Every provider errored | Transient; retry once after a pause, then report |
no_providers | SKU has no enabled providers | Report; pick another SKU |
neither should you.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.