Report · As of 2026-09-22
How agent-ready are 21 German B2B SaaS APIs?
AI agents (Claude, ChatGPT, Copilot & Co.) can only operate software on their own if the API is built for it: an MCP endpoint (Model Context Protocol), clean OAuth-standard authentication, machine-readable documentation. We put the APIs of 21 German B2B SaaS providers from the office and accounting software, ERP, HR, e-commerce, real estate, and communications sectors through a public surface assessment, using the same automated test our free MCP live test runs for every API.
Ranking
| # | Company | Score | MCP |
|---|---|---|---|
| 1 | awork | 53/100 (C) | official |
| 2 | Clockodo | 37/100 (D) | official |
| 3 | Personio | 33/100 (D) | official |
| 4 | seven.io | 30/100 (D) | official |
| 5 | JTL-Software | 18/100 (F) | — |
| 6 | Xentral ERP | 18/100 (F) | — |
| 7 | easybill | 15/100 (F) | — |
| 8 | sevdesk | 12/100 (F) | — |
| 9 | PlentyONE (plentymarkets) | 12/100 (F) | — |
| 10 | propstack | 8/100 (F) | — |
| 11 | Maileon | 8/100 (F) | — |
| 12 | rexx systems | 8/100 (F) | — |
| 13 | Zammad | 5/100 (F) | — |
| 14 | Lexware Office | 5/100 (F) | — |
| 15 | weclapp | 5/100 (F) | — |
| 16 | softgarden | 5/100 (F) | — |
| 17 | onOffice | 5/100 (F) | — |
| 18 | Userlike (jetzt Lime Connect) | 5/100 (F) | — |
| 19 | pretix | 2/100 (F) | — |
| 20 | Collmex | 2/100 (F) | — |
| 21 | d.vinci | 0/100 (F) | — |
Key findings
Methodology
Tested per company: (1) MCP endpoint at the documented address; for vendors without a documented endpoint, derived hosts (mcp./api./docs./developers./developer. of the vendor domain) are additionally checked with a handshake scan: initialize/tools/list, Streamable HTTP, legacy SSE fallback, protocol version incl. server/discover per specification 2026-07-28; (2) authentication signals: 401/403 behavior, WWW-Authenticate with resource_metadata, OAuth Protected Resource Metadata (RFC 9728), Authorization Server Metadata (RFC 8414); (3) MCP Server Card (working group draft: /.well-known/mcp.json among others); (4) documentation surface: OpenAPI/Swagger at standard paths, at addresses verified during research and, if no spec is found there, on derived hosts (docs./api./developers./developer. of the vendor domain), robots.txt policies for 13 known AI crawlers (GPTBot, ClaudeBot, PerplexityBot among others), llms.txt (rated as cosmetic, since a Google study from 6/2026 found no effect), security.txt. Scoring: 40 points for a real MCP offering (handshake 15, listable tools 10, current specification level 5, server card 10), 25 points for authentication and safety signals, 20 points for machine-readable documentation, 15 points for tool description quality. The point distribution is deliberately designed so that a company without an MCP offering cannot mathematically reach the top grade. A dozen blog articles do not replace an endpoint. Limitations: The assessment is a snapshot of the public surface (September 19–20, 2026; corrected run on September 22, 2026, after the detection of specs at standard paths was repaired: sevdesk turns out to have a previously overlooked OpenAPI spec at api.sevdesk.de/openapi.yaml; a second full run with extended host detection confirmed all remaining values) and does not replace a security audit. What this test cannot see (live runs of real agents, tool permissions in detail, tenant separation, GDPR data flows) is the subject of our paid audit.
Every check result for all 21 companies — crawler policies, discovered specs, authentication signals — is published in the detailed German report.
Open the detailed report (German)We test your API for free, or deliver the full diagnosis with live agent tests at a fixed price.
Start the free MCP live test