AgentDrives
Free check
Heapheap.io

Can an AI agent use Heap (heap.io)?

As of 12 Oct 2026, an AI agent can't use Heap on its own: reCAPTCHA image puzzle on sign-up form.

Level 1 · Needs a personAgents can't get in on their own.

To reach L2 · Gets in: let an agent sign up on its own.

With an account set up by a person: not measured yet.

What the levels mean
Visit Heap Follow changes

Driven 12 Oct 2026Same level in 2 drives in a rowRules of 15 Oct 2026Claim this page

Written and checked by our agents from this drive's record. How we write.

Who gets in

  • Agents on a serverStopped by a CAPTCHA on the sign-up form.
  • Signed agentsThe sign-up page opens. The CAPTCHA on the form stops them too.
  • Agents in a person's browserNot measured yet.

Sign-up page checked 12 Oct 2026. Signed agents: the ones Cloudflare verifies. Where agents come from

What an agent can do in Heap (heap.io).

On its own

  • Read all of Heap's technical documentation automatically, including a version written for AI tools.
  • Understand the error messages the API gives back.

What it can't, and why

  • Create a Heap accountThe sign-up form shows an image puzzle that only a person can solve.
  • Send data, view charts, or use any analytics featureAll of these require a logged-in account, which could not be created.
  • Get an API keyHeap only hands out API keys inside the web app after logging in.
Needs a person

Can an AI agent sign up for Heap on its own?

No. Sign-up: needs a human. Web form only (heapanalytics.com/signup). On submit a reCAPTCHA v2 image puzzle appeared.

No MCP server found

Does Heap (heap.io) have an MCP server, and can an agent connect to it?

No. The drive found no MCP server for Heap.

A new agent can't get in on its own: in the drive of 12 Oct 2026, our agent stopped at sign up (it needs a person).

What the drive found

APIOpenAPI–CLIllms.txt–Webhooks–Sandbox

Not reached in this drive: the API key, deleting the account and paying. Every checkpoint, in detail

For the team behind Heap.

Where agents stop in Heap (heap.io) today, and the fixes that get them further, highest impact first.

Stops at sign up

The fixes, highest impact first

  1. Let verified agents sign upStep-by-step guide
  2. Let agents create API keys headlessStep-by-step guide
  3. Publish an official Heap MCP server
2 more fixes
  1. Add a billing API or agent rail Step-by-step guide
  2. Return problem+json errors on the API
  • Claim it free and reply next to the result.
  • A Drive, $49: your private report, with where agents stop, the evidence and the fixes that move your level.
  • Fixed something? Order a Drive ($49) any time, or the Monthly drive ($29/month).
Get a DriveClaim it free
See the example report
Details

Your API, MCP server or CLI is the product? An Audit ($299) also checks every documented route, MCP tool and CLI command against your docs. Compare plans.

Already claimed it? Open it in your dashboard.

Rather not be driven? Block AgentDrivesAgent in robots.txt or write to us. We stop driving it ourselves; this page stays, with its date.

Embed the badge on your site

Driven · L1 · Needs a person badge

Behind the level.

Our agent couldn't get into Heap (heap.io), so the work, its reliability and the crash test aren't measured. The part scores are what it could judge from the outside.

Part scores · level history

Part scores

Agent-ready setup

  • llms.txt
  • OpenAPI
  • CLI

Not measured in this drive: Holds up, Docs match (part of an Audit).

Level history

  1. 6 Oct 2026L1Needs a person
  2. 12 Oct 2026L1Needs a person

For agents and builders.

The drive as data, every checkpoint and all 12 attempts.

How an agent connects · 3 tips

/api/tools/heap.json/tools/heap.mdMCP get_tool {"slug":"heap"}

  • Start at developers.heap.io/llms.txt; every page has a .md version with an embedded OpenAPI 3.1.0 definition
  • Server-side endpoints live on heapanalytics.com (EU: c.eu.heap-api.com); Track is limited to 30 requests per 30 s per identity per app_id
  • A human must sign up (reCAPTCHA) and generate the API key in the web app
Every checkpoint, in detail · 9 checkpoints
  1. DocsHeadlessdevelopers.heap.io/llms.txt (200 text/plain); .md pages and Accept: text/markdown give text/markdown with Vary: Accept; OpenAPI 3.1.0 embedded in each server-side reference page.
  2. Sign upNeeds a humanWeb form only (heapanalytics.com/signup). On submit a reCAPTCHA v2 image puzzle appeared.
  3. VerifyNot reachedNot reached: sign-up stopped at reCAPTCHA.
  4. KeyNot reachedNot reached. Docs: API key generated in the web app (Account > Manage > Privacy & Security); POST /api/public/v0/auth_token swaps app_id:api_key for a token.
  5. First callNot reachedNot reached: server-side APIs need your own workspace app_id.
  6. First actionNot reachedNot reached.
  7. PayNot reachedNo 402 on any host, no MPP/Stripe Projects/Bazaar listing, no billing API in docs. Pricing: Free up to 10k monthly sessions; Growth 'Sign up and install the free snippet to get an estimate!'. Checkout behind sign-up, not seen. We paid nothing.
  8. CancelNot reachednot tested: no plan or trial was started. No billing API documented; cancel presumably in the web app (unknown).
  9. DeleteNot reachedNo account was created, so nothing to delete. Docs list no account-deletion API (only the end-user User Deletion API).
The attempt log · 12 attempts
CapabilityRouteResultEvidence
docs: Find developer docs and llms.txtapidone ✓developers.heap.io/llms.txt 200 text/plain lists client-side and server-side API reference as .md; robots.txt of developers.heap.io has "# LLM Information: https://developers.heap.io/llms.txt"
markdown docs: Accept: text/markdown and .md URL on a reference pageapidone ✓GET developers.heap.io/reference/track-1 with Accept: text/markdown -> 200 content-type text/markdown, vary: Accept, Accept-Encoding; /reference/track-1.md -> 200 text/markdown
agent cards / aipref: robots.txt Content-Usage, ai-catalog, agent-card, MCP, OAuth PRMapifailed ✓www.heap.io/robots.txt: "User-Agent: *" + Sitemap, no Content-Usage/Content-signal. /.well-known/ai-catalog.json and /.well-known/agent-card.json 404 text/html on www.heap.io; agent-card 404 on heapanalytics.com; heapanalytics.com/.well-known/oauth-protected-resource 404 html; www.heap.io/llms.txt 404; pay_probe: mcp.heap.io no such host, heap.io/mcp 308 to site. No MCP server found.
sign up: Create a Heap free-trial account (web form is the only route)browserblocked ✓heapanalytics.com/signup: React form (first/last name, work email, password, optional phone, company, size, storage region, ToS). Headless: page loads google.com/recaptcha/api.js, no documented sign-up API. Browser: after Start Free Trial a reCAPTCHA image puzzle ("Select all images with bicycles") appeared (pw visible_challenge: true, shot 003.png).
verify: verify after sign-upnoneblocked
credentials: credentials after sign-upnoneblocked
The first call: The first call after sign-upnoneblocked
The first action: The first action after sign-upnoneblocked
public API error shapes: Unauthenticated calls on documented server-side endpointsapidone ✓POST heapanalytics.com/api/track without app_id -> 400 text/plain "postBody should have required property 'app_id'"; POST /api/public/v0/auth_token without Basic auth -> 401 text/plain "Unauthorized"; POST /api/public/v0/user_deletion without token -> 401 text/plain "Unauthorized". No WWW-Authenticate, no 402, no problem+json, no RateLimit headers.
pay step public probes: Find an agent way to pay: 402, registries, billing API, checkoutapidone ✓pay_probe.json: no 402 challenges, no MPP/Stripe Projects/Bazaar listings, no x402./mpp./agents./api. hosts, heap.io/llms.txt 404. pay_tx.json: refused, "no 402 on the product's own domain asks for USDC". Own probes: /api/track, /api/public/v0/* answer 400/401 text/plain, no 402. developers.heap.io/llms.txt lists no billing API. Pricing page: Free (up to 10k monthly sessions, Get Started -> heapanalytics.com/signup), Growth ("Sign up and install the free snippet to get an estimate!"), Pro, higher tiers. Sign-up page CSP allows js.chargebee.com (card checkout lead, not seen: behind sign-up).
cancel plan: Cancel a started plannoneskippednot tested: no plan or trial was started (no account: sign-up stopped at reCAPTCHA). No billing API in developers.heap.io/llms.txt.
delete account: Delete the accountnoneskippedNo account was created (sign-up stopped at reCAPTCHA image puzzle), so nothing to delete. Docs: only a User Deletion API for end users in a workspace (developers.heap.io/reference/user-deletion.md); no account-deletion API listed.

Also in Product analytics.

All of Product analytics, by level