{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-08", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "tool": { "slug": "devin", "name": "Devin", "vendor": "Cognition AI, Inc.", "vendorUrl": "https://devin.ai", "kind": "harness", "category": "agent-harnesses", "summary": "Devin is Cognition's hosted coding agent. It works in its own cloud virtual machine to plan, edit code, run commands and open pull requests. Outside agents start and steer sessions through a REST API and a remote MCP server.", "url": "https://www.anchorterminal.com/tools/devin", "markdownUrl": "https://www.anchorterminal.com/tools/devin.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/devin.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/devin.json", "license": "Proprietary service under Cognition's Platform Terms of Service", "transports": [ "http" ], "remoteUrl": "https://mcp.devin.ai/mcp", "packages": [], "auth": "api-key", "authNotes": "A Bearer token with the `cog_` prefix on every request to https://api.devin.ai/v3. Service-user keys are provisioned by a person in Settings \u003e Devin API, shown once, and carry a role (Admin or Member on Teams, custom roles on Enterprise). Personal access tokens act as the user who made them and can expire. Legacy `apk_` keys work only with the deprecated v1 and v2 APIs. The MCP server takes the same keys, and enterprise keys and personal tokens add an `X-Org-Id` header. Access is self-serve, with no app review or sales approval for Teams.", "pricing": "freemium", "pricingNotes": "Free $0, Pro $20 a month, Max $200 a month, Teams $80 a month minimum with full seats at $40 each, Enterprise by quote (devin.ai/pricing, checked 2026-10-08). Paid plans include a daily or weekly usage quota, then prepaid on-demand credits described as usage at API pricing, with no unit rate on the page. The pricing page lists cloud agents from Pro upward, while the docs say Free includes limited Devin usage. Whether the API works on Free, and whether signup needs a card, wasn't established.", "priceSummary": "$20 / mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs index, the v3 OpenAPI spec or the pricing page (checked 2026-10-08).", "endpoints": [] }, "toolCount": 13, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-08" }, "docsUrl": "https://docs.devin.ai", "llmsTxt": "https://docs.devin.ai/llms.txt", "openapi": "https://docs.devin.ai/v3-openapi.yaml", "capabilities": [ "agent.harness", "agent.mcp-client", "agent.multi-agent" ], "tags": [ "hosted", "cloud-agent", "closed-source", "api-key", "rbac", "openapi", "llms-txt", "mcp", "status-page", "soc2", "freemium" ], "lastRelease": "2026-10-07", "graded": true, "anchor": { "graded": true, "score": 55.7, "grade": "C", "agentReady": false, "rank": 447, "ranked": true, "rankOf": 629, "categoryRank": 15, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 62, "maintenance": 63, "payments": 20, "reliability": 30, "schema": 80, "security": 72, "transparency": 69 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 30, "points": 6, "reason": "Hosted reading. Status page at www.devinstatus.com with 14 components and incident history (20). In the 90 days to 8 October 2026 it lists three critical incidents (22 July, 43 minutes of platform-wide queuing, 13 August, Devin Cloud unavailable for 2 hours 40 minutes, 24 September, the web app down for 2 hours) and six major ones on session start-up, so several majors (0). 429 is a documented response, but no rate limit figures were found (0). No Retry-After or backoff guidance found, and v3 session creation has no idempotency key, although the legacy v1 API had one (0). The platform terms supply the service as is with no service level, and enterprise terms weren't read (0). The v3 API is the current, recommended surface, with 44 of 239 operations marked beta under /v3beta1 (10)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 80, "points": 13, "reason": "API reading. Public OpenAPI 3.1 spec for v3 with 239 operations, and separate v1 and v2 specs (25). llms.txt with 376 lines and a Markdown twin of every page (10). Each endpoint page names its required permission, but 61 of 239 operations have no description and the MCP tool descriptions are one line each (10). Enums on fields such as `devin_mode`, `origin` and `category`, with most strings unconstrained and nullable (9). curl examples in the quick starts, and a problem+json error schema declared on every operation, without a catalogue of `error_code` values (11). Versioned paths (v1, v2, v3, v3beta1) and a dated API release notes page (15)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 62, "points": 10.07, "reason": "API and MCP reading. The MCP server documents 13 tools, several of them consolidated manage tools, and list endpoints take `first` to size a page (17). Cursor pagination on every v3 list endpoint and filters on session search by tag, playbook, origin, user and time (18). problem+json with `error_code`, field-level errors on 422 and a 400 that lists valid platform names, but no published code list (15). No idempotency key on v3 session creation. `max_acu_limit` caps what a session can spend, and the MCP tool annotations couldn't be read without a key (4). Only `prompt` is required to start a session. No official SDK found, only a Terraform provider (8)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 72, "points": 12.6, "reason": "Hosted reading. Service-user keys with roles and named permissions per endpoint, revocable, with rotation endpoints in beta for Enterprise and expiring personal tokens. Custom roles are an Enterprise option, and Teams has Admin and Member only (25). Security profiles restrict network, MCP servers, git and the Devin MCP to read-only, and read-only API permissions exist. They are opt-in, and session creation accepts `bypass_approval` (16). AI Guardrails screen user messages and pull request comments for prompt injection, on Enterprise only, and they don't cover web pages or repository content Devin reads (8). Audit logs through the API need an enterprise-level permission. Session events and insights are available on all plans (10). SOC 2 Type II and ISO/IEC 27001:2022, a disclosure address at security@cognition.ai, no security.txt, and the trust centre answers No to having a bug bounty (13)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 20, "points": 2.5, "reason": "Published rubric. No payment protocol (0). Plan prices are public, $20, $200 and $40 a seat with an $80 team minimum, but usage past the quota is billed at an unpublished rate (10). A Free plan exists. The pricing page lists cloud agents from Pro upward, and we couldn't confirm API use on Free or whether a card is needed (10). A person signs up in a browser and provisions the service user in settings (0)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 63, "points": 5.51, "reason": "Closed service. Newest release note dated 7 October 2026 (30). Nineteen dated release notes between 7 August and 7 October 2026, and API notes for August and September (20). Public release notes and a support address, with no public tracker or forum found (10). No official SDK found and the Devin MCP server didn't appear in a search of the official MCP registry (0). No public CI or packages to assess, with the docs and three OpenAPI specs kept current (3)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 69, "points": 6.04, "note": "editorial 61, provenance 77", "reason": "Editorial half. Closed source with clear terms from Cognition AI, Inc. (15). Terms, privacy policy, security page and data processing agreement agree with each other. Customer data may be used for model training by default on self-serve plans, with an opt-out on paid plans that also turns on zero data retention at model providers. Retention is stated as the length of the customer relationship, with no periods (18). Dated notices for the schedules endpoints (announced 10 September, creation refused from 24 September 2026) and the v2 clone endpoint, but no deprecation policy and no end date for v1 and v2 (10). Sub-processors listed with purpose and country, and 15 days' notice of additions (18)." } ], "assessment": { "date": "2026-10-08", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "API and MCP reading. The MCP server documents 13 tools, several of them consolidated manage tools, and list endpoints take `first` to size a page (17). Cursor pagination on every v3 list endpoint and filters on session search by tag, playbook, origin, user and time (18). problem+json with `error_code`, field-level errors on 422 and a 400 that lists valid platform names, but no published code list (15). No idempotency key on v3 session creation. `max_acu_limit` caps what a session can spend, and the MCP tool annotations couldn't be read without a key (4). Only `prompt` is required to start a session. No official SDK found, only a Terraform provider (8).", "maintenance": "Closed service. Newest release note dated 7 October 2026 (30). Nineteen dated release notes between 7 August and 7 October 2026, and API notes for August and September (20). Public release notes and a support address, with no public tracker or forum found (10). No official SDK found and the Devin MCP server didn't appear in a search of the official MCP registry (0). No public CI or packages to assess, with the docs and three OpenAPI specs kept current (3).", "payments": "Published rubric. No payment protocol (0). Plan prices are public, $20, $200 and $40 a seat with an $80 team minimum, but usage past the quota is billed at an unpublished rate (10). A Free plan exists. The pricing page lists cloud agents from Pro upward, and we couldn't confirm API use on Free or whether a card is needed (10). A person signs up in a browser and provisions the service user in settings (0).", "reliability": "Hosted reading. Status page at www.devinstatus.com with 14 components and incident history (20). In the 90 days to 8 October 2026 it lists three critical incidents (22 July, 43 minutes of platform-wide queuing, 13 August, Devin Cloud unavailable for 2 hours 40 minutes, 24 September, the web app down for 2 hours) and six major ones on session start-up, so several majors (0). 429 is a documented response, but no rate limit figures were found (0). No Retry-After or backoff guidance found, and v3 session creation has no idempotency key, although the legacy v1 API had one (0). The platform terms supply the service as is with no service level, and enterprise terms weren't read (0). The v3 API is the current, recommended surface, with 44 of 239 operations marked beta under /v3beta1 (10).", "schema": "API reading. Public OpenAPI 3.1 spec for v3 with 239 operations, and separate v1 and v2 specs (25). llms.txt with 376 lines and a Markdown twin of every page (10). Each endpoint page names its required permission, but 61 of 239 operations have no description and the MCP tool descriptions are one line each (10). Enums on fields such as `devin_mode`, `origin` and `category`, with most strings unconstrained and nullable (9). curl examples in the quick starts, and a problem+json error schema declared on every operation, without a catalogue of `error_code` values (11). Versioned paths (v1, v2, v3, v3beta1) and a dated API release notes page (15).", "security": "Hosted reading. Service-user keys with roles and named permissions per endpoint, revocable, with rotation endpoints in beta for Enterprise and expiring personal tokens. Custom roles are an Enterprise option, and Teams has Admin and Member only (25). Security profiles restrict network, MCP servers, git and the Devin MCP to read-only, and read-only API permissions exist. They are opt-in, and session creation accepts `bypass_approval` (16). AI Guardrails screen user messages and pull request comments for prompt injection, on Enterprise only, and they don't cover web pages or repository content Devin reads (8). Audit logs through the API need an enterprise-level permission. Session events and insights are available on all plans (10). SOC 2 Type II and ISO/IEC 27001:2022, a disclosure address at security@cognition.ai, no security.txt, and the trust centre answers No to having a bug bounty (13).", "transparency": "Editorial half. Closed source with clear terms from Cognition AI, Inc. (15). Terms, privacy policy, security page and data processing agreement agree with each other. Customer data may be used for model training by default on self-serve plans, with an opt-out on paid plans that also turns on zero data retention at model providers. Retention is stated as the length of the customer relationship, with no periods (18). Dated notices for the schedules endpoints (announced 10 September, creation refused from 24 September 2026) and the v2 clone endpoint, but no deprecation policy and no end date for v1 and v2 (10). Sub-processors listed with purpose and country, and 15 days' notice of additions (18)." }, "sources": [ { "what": "API overview and error codes", "url": "https://docs.devin.ai/api-reference/overview", "seen": "2026-10-08" }, { "what": "authentication, service users and personal tokens", "url": "https://docs.devin.ai/api-reference/authentication", "seen": "2026-10-08" }, { "what": "permissions and RBAC", "url": "https://docs.devin.ai/api-reference/v3/overview", "seen": "2026-10-08" }, { "what": "v3 OpenAPI spec", "url": "https://docs.devin.ai/v3-openapi.yaml", "seen": "2026-10-08" }, { "what": "pagination", "url": "https://docs.devin.ai/api-reference/concepts/pagination", "seen": "2026-10-08" }, { "what": "Devin MCP server and tools", "url": "https://docs.devin.ai/work-with-devin/devin-mcp", "seen": "2026-10-08" }, { "what": "MCP client and marketplace", "url": "https://docs.devin.ai/work-with-devin/mcp", "seen": "2026-10-08" }, { "what": "security profiles", "url": "https://docs.devin.ai/product-guides/security-profiles", "seen": "2026-10-08" }, { "what": "AI Guardrails", "url": "https://docs.devin.ai/enterprise/features/ai-guardrails", "seen": "2026-10-08" }, { "what": "pricing", "url": "https://devin.ai/pricing", "seen": "2026-10-08" }, { "what": "self-serve plans and credits", "url": "https://docs.devin.ai/admin/billing/self-serve", "seen": "2026-10-08" }, { "what": "usage metering", "url": "https://docs.devin.ai/admin/billing/usage", "seen": "2026-10-08" }, { "what": "status incidents", "url": "https://www.devinstatus.com/api/v2/incidents.json", "seen": "2026-10-08" }, { "what": "platform terms of service", "url": "https://cognition.com/legal/platform-terms-of-service", "seen": "2026-10-08" }, { "what": "privacy policy", "url": "https://cognition.com/legal/privacy-policy", "seen": "2026-10-08" }, { "what": "data processing agreement and sub-processors", "url": "https://cognition.com/legal/data-processing-statement", "seen": "2026-10-08" }, { "what": "security and data use", "url": "https://docs.devin.ai/admin/security", "seen": "2026-10-08" }, { "what": "trust centre", "url": "https://trust.cognition.ai/", "seen": "2026-10-08" }, { "what": "API release notes and deprecations", "url": "https://docs.devin.ai/api-reference/release-notes", "seen": "2026-10-08" }, { "what": "application release notes", "url": "https://docs.devin.ai/release-notes/2026", "seen": "2026-10-08" }, { "what": "migration guide for v1 and v2", "url": "https://docs.devin.ai/api-reference/getting-started/migration-guide", "seen": "2026-10-08" }, { "what": "official MCP registry search for devin, no result", "url": "https://registry.modelcontextprotocol.io/v0/servers?search=devin", "seen": "2026-10-08" } ], "openQuestions": [ "unchecked: security incidents or advisories in the last 12 months. Web search wasn't available, and no advisory page was found on the vendor's sites, so the deduction is 0 on what we could read.", "unchecked: whether the Free plan can create sessions through the API, and whether signup asks for a card. The pricing page and the docs describe Free differently.", "unchecked: the MCP server's tool schemas and annotations, which need a key. mcp.devin.ai/mcp answered 406 to a plain GET.", "unchecked: Enterprise Terms of Service, including any service level, and the documents on trust.cognition.ai, which need an NDA.", "No rate limit figures, on-demand unit rate or end date for the v1 and v2 APIs were found in the reviewed documentation.", "Devin CLI and Devin Desktop (formerly Windsurf) are separate local products on the same plans and weren't graded here." ] }, "negative": 0, "verdict": "The v3 API is well specified, with a public OpenAPI 3.1 file covering 239 operations, problem+json errors, cursor pagination and service-user keys tied to roles. The status page records three critical and several major incidents on the cloud agent between 22 July and 24 September 2026, and no rate limit figures or retry guidance were found in the reviewed documentation.", "bestFor": "A team that wants to hand whole tasks to a cloud agent and collect pull requests, driven from a pipeline or another agent.", "strengths": [ "Public OpenAPI 3.1 spec for the v3 API with 239 operations, each declaring 401, 403, 404, 409, 422 and 429 responses in RFC 9457 problem+json", "Service-user keys carry a role, every endpoint except GET /v3/self names the permission it needs, and audit logs list service users separately from people", "Security profiles can limit a session to a network allowlist, an MCP server allowlist, read-only git and a read-only Devin MCP", "Remote MCP server at mcp.devin.ai/mcp with 13 documented tools for sessions, playbooks, knowledge, schedules and repository documentation", "Dated release notes several times a week, the newest on 7 October 2026, and a separate API release notes page" ], "weaknesses": [ "www.devinstatus.com lists three critical incidents (22 July, 13 August, 24 September 2026) and six major ones on the cloud agent or web app since 10 July 2026", "No rate limit figures, Retry-After or backoff guidance found in the API docs, and v3 session creation has no idempotency key", "Customer data may be used for model training by default on self-serve plans. The opt-out is for paid plans only, per section 3.3.1 of the platform terms", "A person must sign up and provision the service user in the web app. No key-creation route exists for an agent starting from nothing", "No official SDK found, and the Devin MCP server was not found in the official MCP registry" ], "agentNotes": [ "Use a `cog_` service-user key with the Member role. Legacy `apk_` keys fail against v3 and the MCP server with 401 or 403", "Set `max_acu_limit` on every session you create. Usage is metered by the work done and has no published unit rate", "Session creation is not idempotent in v3. After a timeout, list sessions by tag before creating again", "Enterprise keys and personal access tokens must send `X-Org-Id` to the MCP server. Organisation-scoped keys resolve it automatically", "Create scheduled work as an automation. POST to the schedules endpoint returns 403 for migrated organisations since 24 September 2026" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 55.7 } ], "editorialScores": { "ergonomics": 62, "maintenance": 63, "payments": 20, "reliability": 30, "schema": 80, "security": 72, "transparency": 61 }, "provenanceScore": 77 }, "connect": { "http": "curl -X POST \"https://api.devin.ai/v3/organizations/$DEVIN_ORG_ID/sessions\" -H \"Authorization: Bearer $DEVIN_API_KEY\" -H \"Content-Type: application/json\" -d '{\"prompt\": \"Create a simple Python script that prints Hello World\"}'", "config": { "mcpServers": { "devin": { "headers": { "Authorization": "Bearer \u003cAPI_KEY\u003e", "X-Org-Id": "\u003cYOUR_ORG_ID\u003e" }, "serverUrl": "https://mcp.devin.ai/mcp" } } } }, "letme": { "capability": "https://letme.dev/agent.harness", "tool": "https://letme.dev/devin" }, "notable": [ "The v3 OpenAPI 3.1 spec has 158 paths and 239 operations, 44 of them under /v3beta1, and every operation declares problem+json errors (https://docs.devin.ai/v3-openapi.yaml)", "The Devin MCP server answers over streamable HTTP at https://mcp.devin.ai/mcp with 13 documented tools, and the older /sse endpoint is deprecated (https://docs.devin.ai/work-with-devin/devin-mcp)", "Security profiles bundle a network allowlist, an MCP server allowlist, a git access level and a read-only setting for the Devin MCP, bound to an organisation, an automation or a session (https://docs.devin.ai/product-guides/security-profiles)", "The platform terms of 30 June 2026 let Cognition use customer data for model training unless a paid customer opts out, and Enterprise data is not trained on without written consent (https://cognition.com/legal/platform-terms-of-service, https://docs.devin.ai/admin/security)", "The status page lists 13 incidents between 8 July and 24 September 2026, three marked critical (https://www.devinstatus.com/history)", "The v1 and v2 APIs are deprecated with no end date given. The migration guide says legacy keys will be removed soon (https://docs.devin.ai/api-reference/getting-started/migration-guide)" ], "area": "frameworks", "details": [ { "label": "Interfaces", "value": "REST API v3 at https://api.devin.ai/v3 (organisation and enterprise scopes), remote MCP server at https://mcp.devin.ai/mcp, web app, Slack, and a Terraform provider. Devin CLI and Devin Desktop are separate local products" }, { "label": "Session API", "value": "Create, list, get, message, terminate and archive sessions, with tags, attachments and insights. Only `prompt` is required. Options include `max_acu_limit`, `playbook_id`, `repos`, `devin_mode`, `structured_output_schema` (JSON Schema Draft 7, 64KB) and `security_profile`" }, { "label": "MCP tools", "value": "read_wiki_structure, read_wiki_contents, ask_question, list_available_repos, devin_session_create, devin_session_search, devin_session_interact, devin_session_events, devin_session_gather, devin_playbook_manage, devin_knowledge_manage, devin_schedule_manage, devin_list_integrations" }, { "label": "Credentials", "value": "Service-user keys with a role, shown once. Personal access tokens with optional expiry on Teams and mandatory expiry (365 days by default) on Enterprise. Key rotation and revocation endpoints for enterprise service users are in beta" }, { "label": "Permissions", "value": "Every endpoint except GET /v3/self needs a named permission, such as UseDevinSessions, ViewOrgSessions, ManageOrgSessions or ManageOrgSecrets" }, { "label": "Sandbox and network", "value": "Each session runs in a cloud virtual machine. A security profile can restrict it to an allowlist of hostnames and CIDR ranges, read-only git, and no GitHub CLI token. Without a profile, sessions can use any MCP server installed in the organisation" }, { "label": "MCP client", "value": "Devin connects to external MCP servers over stdio, SSE and HTTP, installed from a plugin marketplace or added as custom servers by an admin" }, { "label": "Pagination", "value": "Cursor-based on every v3 list endpoint, with `first` and `after`, returning `items`, `has_next_page`, `end_cursor` and sometimes `total`" }, { "label": "Errors", "value": "RFC 9457 application/problem+json with `title`, `status`, `detail`, an optional `error_code` and field errors on 422" }, { "label": "Rate limits", "value": "429 is documented as a response. No figures found in the reviewed documentation" }, { "label": "Metering", "value": "Usage accrues by the actions Devin takes plus virtual machine time. Sessions sleep after 30 minutes idle and use nothing while asleep. Windows sessions use about 9 per cent more" }, { "label": "Certifications", "value": "SOC 2 Type II since September 2024 per the docs, and ISO/IEC 27001:2022 and CCPA listed on trust.cognition.ai. Reports need an access request and an NDA" }, { "label": "Status", "value": "www.devinstatus.com on Atlassian Statuspage, 14 components, among them Cloud Agent, Cloud Web Client and Integrations" }, { "label": "Sub-processors", "value": "Listed with locations in Appendix C of the data processing agreement of 23 July 2026. Azure, AWS and Google Cloud for core processing, OpenAI, Anthropic and Google as model providers, all in the United States, and a Cognition affiliate in India for support" } ], "unitPrices": [ { "item": "Pro plan", "unit": "month", "usd": 20, "note": "one user, daily and weekly usage quota" }, { "item": "Max plan", "unit": "month", "usd": 200, "note": "one user, larger weekly quota" }, { "item": "Teams full seat", "unit": "seat-month", "usd": 40, "note": "$80 a month minimum per team, flex seats free and billed from shared credits" } ], "provenance": { "legalEntity": "Cognition AI, Inc.", "domain": "devin.ai", "domainRegistered": "2022-12-06", "endpointOnVendorDomain": true, "terms": "https://cognition.com/legal/platform-terms-of-service", "privacy": "https://cognition.com/legal/privacy-policy", "statusPage": "https://www.devinstatus.com", "changelog": "https://docs.devin.ai/release-notes/overview", "securityTxt": "none", "checked": "2026-10-08", "notes": [ "The Platform Terms of Service (last updated 30 June 2026) name Cognition AI, Inc. and govern the Cognition Platform for customers who register and use the services. Enterprise customers sign separate Enterprise Terms of Service.", "The privacy policy (last updated 9 March 2026) names Cognition AI, Inc and covers Devin and Windsurf as well as cognition.com. The data processing agreement gives the address 550 Third Street, San Francisco, CA 94107.", "devin.ai, cognition.com and api.devin.ai all return 404 for /.well-known/security.txt. The docs give security@cognition.ai for vulnerability reports.", "The API answers at api.devin.ai and the MCP server at mcp.devin.ai. status.devin.ai redirects to www.devinstatus.com.", "RDAP for devin.ai gives a registration date of 2022-12-06." ], "score": 77, "checks": [ { "check": "Legal entity named", "value": "Cognition AI, Inc.", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "devin.ai, registered 2022-12-06 (3 years)", "points": 7, "max": 15, "state": "part" }, { "check": "Endpoint on the vendor's domain", "value": "mcp.devin.ai", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "read, states 6 of the 7 things a reader expects, and has 1 clause that costs points", "points": 7.1, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "read, states 8 of the 8 things a reader expects, and has 1 clause that costs points", "points": 8, "max": 10, "state": "part" }, { "check": "Status page", "value": "www.devinstatus.com", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" } ], "policies": [ { "kind": "terms", "url": "https://cognition.com/legal/platform-terms-of-service", "state": "read", "readAt": "2026-10-08", "statedDate": "2026-06-30", "words": 5818, "points": 7.1, "max": 10, "expected": [ { "key": "terms.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last updated: June 30, 2026", "says": "Last updated 2026-06-30" }, { "key": "terms.law", "label": "Names the governing law or courts", "found": true, "quote": "12.6 Governing Law: This Agreement is governed by and construed in accordance with the internal laws of the State of New York without giving effect to any choice or conflict of law provision or rule that would require or permit the application of the laws of any jurisdiction other than those of the State of New York.", "says": "The law of the State of New York" }, { "key": "terms.liability", "label": "States a limit on its liability", "found": true, "quote": "10.2 NOTWITHSTANDING ANYTHING TO THE CONTRARY IN THIS AGREEMENT, IN NO EVENT WILL EITHER PARTY'S AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO ANY CLAIM ARISING IN CONNECTION WITH THIS AGREEMENT UNDER ANY LEGAL OR EQUITABLE THEORY, INCLUDING BREACH OF CONTRACT, TORT (INCLUDING NEGLIGENCE) AND STRICT LIABILITY, EXCE…", "says": "Capped at the greater of US$100 and the fees paid in the 6 months before the claim" }, { "key": "terms.termination", "label": "Says how the agreement or account can be ended", "found": true, "quote": "7.2 Subscription Termination: You may terminate your subscription at any time." }, { "key": "terms.changes", "label": "Says how changes to the terms are announced", "found": true, "quote": "This update may include material changes to your prior Terms of Service, and in such case, the prior terms shall control until 30 days from the posting of these Terms.", "says": "Gives 30 days of notice before a change" }, { "key": "terms.use", "label": "Lists what users may not do", "found": true, "quote": "2.3 Restrictions: You may not use the Services for any purposes beyond the scope of the access granted in this Agreement." }, { "key": "terms.sla", "label": "Refers to a service level or uptime commitment", "found": false } ], "toKnow": [ { "key": "training.optout", "label": "Says it may use customer content to train or improve models, and gives an opt-out", "found": true, "quote": "Cognition may use Customer Data for model training purposes and to improve and enhance the Services. If you subscribe to a paid Service Tier, you may opt out of this use (“Opt-Out”)." }, { "key": "terms.benchmark", "label": "Restricts benchmarking or competitive use", "found": true, "quote": "use the Services to create or develop any competing products or services, including to train competing artificial intelligence models except as expressly approved by Cognition in writing", "costsPoints": true }, { "key": "terms.cutoff", "label": "Says access can be ended without notice or for any reason", "found": true, "quote": "In addition, if you have a subscription, we may terminate the subscription at any time for any other reason." }, { "key": "terms.arbitration", "label": "Requires arbitration or waives class actions", "found": true, "quote": "11.1 IN THE EVENT A DISPUTE, CONTROVERSY, OR CLAIM ARISES OUT OF OR RELATING TO THESE TERMS (“DISPUTE”), THE DISPUTE WILL BE RESOLVED BY BINDING ARBITRATION RATHER THAN IN COURT." } ], "notes": [ { "date": "2026-10-08", "text": "Either party's total liability is capped at the greater of the amounts paid in the six months before the event or 100 US dollars.", "quote": "EXCEED THE GREATER OF (A) THE TOTAL AMOUNTS PAID TO COGNITION UNDER THIS AGREEMENT IN THE SIX MONTH PERIOD PRECEDING THE EVENT GIVING RISE TO THE CLAIM, OR (B) ONE HUNDRED DOLLARS (US$100)." }, { "date": "2026-10-08", "text": "Cognition may delete Customer Data when the terms or the subscription end, and the customer is responsible for its own backups.", "quote": "Upon termination of these Terms or your subscription, we may at our option delete any Customer Data or other data associated with your account." }, { "date": "2026-10-08", "text": "The customer agrees not to process medical information or sensitive personal data, such as birth dates, bank account numbers and card numbers, through the Services.", "quote": "You agree not to process any medical information or sensitive personal data such as social security numbers, birth dates, passport information, bank account, and credit card numbers in using the Services." } ] }, { "kind": "privacy", "url": "https://cognition.com/legal/privacy-policy", "state": "read", "readAt": "2026-10-08", "statedDate": "2026-03-09", "words": 2610, "points": 8, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last updated: March 9, 2026", "says": "Last updated 2026-03-09" }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "We collect and use your information in order to provide and improve our Services and your experience, protect the security and integrity of our platform, and meet our legal obligations." }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "How long we retain personal information includes considerations such as when the information was collected or created, whether it is necessary in order to continue offering you our Services, whether we are required to hold the information to comply with our legal obligations, or information preservation requirements." }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "We share your information with trusted third parties and service providers in order to offer our Services, fulfill legal requirements and for the purposes set out more fully below." }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": true, "quote": "We do not sell or share your personal information with third parties for targeted advertising purposes, nor have we done so in the past 12 months.", "says": "Says it does not sell personal data" }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "In the EEA and UK, you have the right to object to, and seek restrictions of this processing (“Legitimate Interests”) — specifically, our interest in being responsive to your requests and ensuring you have the best use of the Services" }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "If you have any questions, or to exercise any available rights, please contact us at privacy@cognition.ai.", "says": "privacy@cognition.ai" }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": true, "quote": "…these transfers of your personal information, including in some cases the European Commission's Standard Contractual Clauses and relevant local clauses (e.g., the UK's International Data Transfer Addendum) to facilitate the international and onward transfer of European personal data to third countries.", "says": "Relies on standard contractual clauses" } ], "toKnow": [ { "key": "training", "label": "Says it may use customer content to train or improve models, and no opt-out was found", "found": true, "quote": "To customize your experience with our Services and otherwise improve our Services including, depending on the terms that apply to your use of the Services, using User Content to train, fine tune and improve the models that power our Services.", "costsPoints": true } ], "notes": [ { "date": "2026-10-08", "text": "Administrators of an enterprise or business account may be able to access a member's User Content and control the member's account.", "quote": "In addition, administrators of any enterprise or business account may be able to access certain information associated with your account, including your User Content, and be able to control your account and such information." }, { "date": "2026-10-08", "text": "The privacy policy says users must be at least 18 years old to access the Services.", "quote": "As set out in our Terms, users must be at least 18 years old in order to access the Services." } ] } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/devin.json", "live": { "slug": "devin", "probe": { "target": "https://mcp.devin.ai/mcp", "method": "get", "lastAt": "2026-10-08T19:08:45.013833265Z", "lastOk": true, "lastStatus": 406, "lastMs": 426, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 450, "p95ms24h": 579, "samples24h": 19, "samples30d": 19, "days": [ { "date": "2026-10-08", "probes": 19, "ok": 19 } ] }, "vendorStatus": { "page": "https://www.devinstatus.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-08T19:06:34.332954915Z" }, "pages": [ { "url": "https://docs.devin.ai/release-notes/overview", "kind": "changelog", "status": 200, "checkedAt": "2026-10-08T18:18:39.860758812Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "a85f82787c20" }, { "url": "https://cognition.com/legal/privacy-policy", "kind": "privacy", "status": 200, "checkedAt": "2026-10-08T18:16:28.045423959Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "0ab177a921b1" }, { "url": "https://cognition.com/legal/platform-terms-of-service", "kind": "terms", "status": 200, "checkedAt": "2026-10-08T18:16:26.004141328Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "e794136b2fe5" } ], "updatedAt": "2026-10-08T19:08:45.013833265Z" } } }