# ReqRes L4 · Runs on its own

ReqRes is a hosted mock backend and test sandbox for developers and AI agents.

**Can an AI agent use ReqRes? Yes, without signing up.** Our agent got into ReqRes on its own in 3 minutes and did 7 of its 8 core tasks.

Category: API testing and mocking · Connects by: MCP, API · Agent payments: None found · Driven: 26 Oct 2026

**How to connect**
- MCP server URL: `https://reqres.in/mcp` (streamable HTTP, tested in our drive). Source: https://reqres.in/mcp
- API base URL: `https://reqres.in` (documented). Source: https://reqres.in/openapi.json

**Level 4: Runs on its own.** An agent does the core work and can stop paying on its own.
- Got in by: No key needed (3 minutes, no account)
- Got as far as: Use: 7 of 8 core tasks (No payment made)
- To reach L5: Pay without a person.

**Test service.** Our lists and counts leave it out.

1 drive, awaiting confirmation

[What the levels mean](https://agentdrives.com/method/levels?via=md)

## From finding it to leaving

What an agent managed without a person, at each step.

1. **Find**: On its own. Docs it can act on: llms.txt, an OpenAPI and an MCP server. (9 doc pages read)
2. **Get in**: On its own. Got in without signing up. Sign-up by API: stopped by robots.txt; Email and password: stopped by a CAPTCHA. (3 minutes)
3. **Use**: On its own. Did: create collections and create, update, list and delete records, each read back; read seeded users and orders from the sandbox with no key. (7 of 8 core tasks)
4. **Pay**: Not reached. Paying needs an account.
5. **Leave**: On its own. Nothing to cancel, deletes what it made.

## Getting in

3 of 6 ways in worked without a person.

The way that worked: **No key needed**, 3 minutes. No inbox, browser or person needed.

- Agent on a server (API, MCP, CLI): Partly. Without an account (no key needed) it gets an API key, makes its first API call and does 7 of its 8 core tasks. Payment wasn't tried.
- Assistant in its own browser (Like ChatGPT agent): No. Signing up needs a person: it asks for a bot check.
- Signed agent: Not checked. Not checked: its robots.txt asks crawlers to stay off the sign-up page.

| Way in | What happened |
|---|---|
| No key needed | Worked |
| Runs locally, no account | Worked |
| Try first, claim later | Worked |
| Sign-up by API | Stopped by robots.txt |
| Email and password | Stopped by a CAPTCHA |
| Company single sign-on | Not tried: Needs a person's account |

- Crawlers: **robots.txt asks crawlers to stay off sign-up and the API.** Nothing to fix. It keeps these pages out of search and doesn't stop agents signing up.

[How agents get past bot checks](https://agentdrives.com/guides/let-signed-agents-past-your-bot-check.md?via=md)

## What an agent can do with ReqRes

7 of 8 core tasks done, and 3 of 15 others. One task not tried isn't counted.

- Reliability: core tasks that worked on all 3 runs: 90 of 100
- Handles mistakes: clear errors, retries without duplicates, honest limits: 80 of 100
- Surface tested: documented routes, tools and commands run and checked: 31 of 100
- Docs accuracy: documented operations that behaved as the docs say: 93 of 100
- Docs completeness: how fully the docs describe each operation: 47 of 100

Core tasks:

| Task | Result | Done through | Tried, not done | Offered, not tried |
|---|---|---|---|---|
| Create a project (hosted backend) | Done | MCP | – | API |
| Create a collection | Done | MCP | – | API |
| Create or update a record in a collection | Done | MCP | – | API |
| List and read records with filters | Done | MCP | – | API |
| List deterministic agent sandbox fixture data (users, orders) | Done | API | – | – |
| Trigger a deliberate failure scenario | Done | API | – | – |
| Simulate a payment (create, confirm, decline, refund) | Done | API | – | – |
| Run a scripted multi-step failure chain | Partly | – | API | – |
| Read demo fixture users with no signup or key | Blocked | – | API | – |

3 of 15 other tasks done:

- Read a keyless demo trajectory (sample benchmark run): Done
- Download a scenario pack (chains, seeds, expected trajectories): Done
- Complete an MFA challenge in the agent sandbox auth flow: Done
- Register a webhook on a sandbox payment event: Paid plan. They need the $49/mo agent key.
- List trajectories recorded from agent sandbox calls: Paid plan
- Diff two trajectories for divergence: Paid plan
- Register and log in a demo user: Blocked
- Authenticate an app's end users via magic-link login: Blocked
- Manage app users (create, update, delete): Blocked
- Execute a custom endpoint with a user-defined response: Blocked
- Run automations on collection data changes: Blocked
- Browse collections and inspect request logs (Data Explorer): Blocked
- Export stored objects from the Data Explorer: Blocked
- Generate an API from a UI screenshot (Image to API): Blocked
- Create and manage API keys with scoped permissions: Blocked
- Run the sandbox offline via a self-hosted Docker image: Blocked
- License ReqRes for commercial/company-wide use: Not tried
- Sponsor a placement on the site: Not tried

The plans they need:

- Run a scripted multi-step failure chain: Agent Developer ($49/mo)
- List trajectories: Agent Developer ($49/mo)
- Diff two trajectories: Agent Developer ($49/mo)
- Register a payments webhook: Agent Developer / Agent Platform
- 12 of 15 failure scenarios: Agent Developer ($49/mo)

Paid-plan tasks don't count toward the level. The drive used the free plan (no-account MCP project and keyless sandbox).

What it can't do, and why:

- Use the REST API, including the keyless demo users: Robots.txt closes /api/ to AI agents.
- Make a dashboard account: A visible Cloudflare Turnstile on the sign-up form.
- Filter records, change collections or delete a project: Only offered over the closed REST API; MCP has no tool.
- Run chains, trajectories, webhooks and 12 of 15 scenarios: They need the $49/mo agent key.
- Pay for a plan: Plans are bought in the dashboard, which needs an account.
- Create or revoke API keys: Keys are managed only in the dashboard.

**Surface audit:** 87 documented operations, 29 run, 27 passed, 2 not as documented, 58 blocked (sandbox or plan limits).

## How an agent connects

MCP, API, OpenAPI and llms.txt found.

Agent surfaces: API tested · MCP tested · CLI none found · SDK none found · Docs tested · Agent payments none found. Issues found: 12.

- **MCP server**: All tested. Official server. 7 tools, no auth. https://reqres.in/mcp In the MCP registry as `in.reqres/reqres`. (7 tools across its docs) 7 tools listed without signing in on 31 Oct 2026: `create_project`, `list_collections`, `create_collection`, `list_records`, `create_record`, `update_record`, `delete_record`.
- **API**: 20 tested. REST, 64 operations in openapi.json; /api/ closed to AI agents by robots.txt. (75 operations across its docs)
- **OpenAPI**: Yes. 3.0.3; payments sandbox routes missing.
- **CLI**: None found.
- **SDK**: None found.
- **llms.txt**: Yes. https://reqres.in/llms.txt
- **Agent payments**: None found. The checkout wasn't reached: Lite, $5 a month.
- **Docs**: Some gaps. Covers getting started, auth, error codes and code examples. 7 of 13 documented ways to do the core work worked when tried. (9 pages read)

[The standards](https://agentdrives.com/standard)

## Tips for agent builders

- Use the MCP server at https://reqres.in/mcp (no auth): create_project returns the keys; pass the manage key as the api_key argument of every tool.
- Wrap fields in {"data": {...}} only on REST; MCP create_record takes the fields in data directly.
- For error-handling tests call /agent/v1/scenarios/rate-limited, validation-error and malformed-json; filter on the X-Agent-Sandbox-Intentional header.
- Agent sandbox calls are byte-deterministic at a given seed and X-World-Version: pin both in assertions.
- Payments sandbox: send an Idempotency-Key on every POST; attach a payment method with POST /sim/payments/v1/payment_intents/{id} before /confirm.
- The free agent sandbox allows 100 calls a day per IP; check /agent/v1/health for remaining_today.
- On x86-64 the self-hosted image has no amd64 build: its app is plain Node (Cmd node selfhosted/server.js in /app, no native modules), so the unpacked layers run with a local node and PORT set; without DATABASE_URL chains and trajectories fail.
- For scripted failure chains without a paid key, run the self-hosted image's app (node selfhosted/server.js) and send X-Agent-Chain: flaky-then-recover with an X-Agent-Run-Id; reset with DELETE /agent/v1/chains/{name}/state.

## For the team behind ReqRes

**8 things to fix for agents.**

Agent blockers: 2 found · Agent surfaces: 10 issues found. Safety review: 2 issues found.

Our agent didn't reach Pay. Prove ReqRes is yours, then see where each issue is, read your safety findings and ask for a free drive after a fix. How to fix each one comes with the Audit.

- Find: Clear
- Get in: Clear
- Use: Clear
- Pay: Not reached
- Leave: Clear

[Claim ReqRes, free](https://agentdrives.com/app/products?add=reqres.in&ref=listing) · [What a drive covers](https://agentdrives.com/method?via=md)

## Where ReqRes fits

- Category: [Developer platform](https://agentdrives.com/categories/developer?via=md)
- Tasks: [Create or update a record](https://agentdrives.com/tasks/create-or-update-a-record), [Create a database](https://agentdrives.com/tasks/create-a-database), [Query records with filters](https://agentdrives.com/tasks/query-records-with-filters), [List databases and read their schema](https://agentdrives.com/tasks/list-databases-and-read-their-schema)
- Vendors: [Cloudflare](https://agentdrives.com/vendors/cloudflare) (on one way in)
- Standards: [MCP](https://agentdrives.com/standards/mcp) (tools an agent can call), [OpenAPI](https://agentdrives.com/standards/openapi) (its API, described), [llms.txt](https://agentdrives.com/standards/llms-txt) (its docs, listed for agents)
- Steps: [Find](https://agentdrives.com/access/find), [Get in](https://agentdrives.com/access/get-in), [Use](https://agentdrives.com/access/use), [Pay](https://agentdrives.com/access/pay), [Leave](https://agentdrives.com/access/leave)

Data: [JSON](https://agentdrives.com/api/tools/reqres.json?via=md) · [Markdown](https://agentdrives.com/tools/reqres.md?via=md) · [History](https://agentdrives.com/tools/reqres/history?via=md) · [Atom](https://agentdrives.com/feeds/tools/reqres.atom) · [JSON Feed](https://agentdrives.com/feeds/tools/reqres.json) · licence [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/)

**Found an error?** [Tell us on this page](https://agentdrives.com/tools/reqres?via=md#correct) or read [how corrections work](https://agentdrives.com/corrections?via=md).