{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-14", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "tool": { "slug": "resy", "name": "Resy", "vendor": "Resy (American Express)", "vendorUrl": "https://resy.com", "kind": "platform", "category": "local-bookings", "summary": "Resy is American Express's restaurant reservation app and website for diners, with Resy OS for venues. Since 11 August 2026 it also lists Tock's restaurants, wineries and experiences, over 25,000 venues in all.", "url": "https://www.anchorterminal.com/tools/resy", "markdownUrl": "https://www.anchorterminal.com/tools/resy.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/resy.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/resy.json", "license": "Proprietary service. Resy Network, Inc. publishes separate privacy and merchant terms for Resy and Tock", "transports": [], "packages": [], "auth": "oauth", "authNotes": "No public agent access. An MCP endpoint at https://apigw.americanexpress.com/dining/v1/mcp answers 401 and publishes OAuth metadata with one scope, 600003928_DINING_RESY_MCP_APPS. Its authorisation server supports only client_secret_jwt client authentication and lists no registration endpoint, so only clients American Express has registered can connect. No public documentation for it was found.", "pricing": "paid", "pricingNotes": "No prices for venues or for API access were found on resy.com/join, which asks venues to book a demo. Diner pricing could not be read, because resy.com renders by script.", "priceSummary": "Paid", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 on resy.com/join or the MCP endpoint's OAuth metadata (checked 2026-10-14).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-14" }, "capabilities": [ "booking.reservations", "booking.availability", "booking.venue" ], "tags": [ "not-for-agents", "sales-led", "hosted", "closed-source", "partner-only", "ios", "android", "restaurants" ], "graded": true, "anchor": { "graded": true, "score": 10.3, "grade": "F", "agentReady": false, "rank": 1068, "ranked": true, "rankOf": 1076, "categoryRank": 9, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 0, "maintenance": 25, "payments": 0, "reliability": 25, "schema": 0, "security": 3, "transparency": 30 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 25, "points": 5, "reason": "Read with the hosted lines. status.resy.com exists but loads by script and showed no components to our reader (10 of 20). No readable history (5). No published limits or retry guidance for an outside agent (0, 0). No SLA (0). The service is not labelled beta (10). Total 25." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 0, "points": 0, "reason": "Graded on the interface an outside agent can use. No public API, documentation or llms.txt was found. The Amex dining MCP endpoint publishes only OAuth metadata and accepts pre-registered clients, so there is no public contract to read (0 on every line). This says nothing about the service for diners." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 0, "points": 0, "reason": "Graded on the interface an outside agent can use. With none in public, every line scores nothing (0). This says nothing about the app for people." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 3, "points": 0.53, "reason": "Graded on the interface an outside agent can use. With none in public, the credential, least-privilege, injection and audit lines score nothing (0 of 30, 0 of 20, 0 of 15, 0 of 15). The security programme line is scored. The platform security page describes encryption, access controls and a fraud team, without a named certification, disclosure policy or bug bounty. resy.com serves its app page for /.well-known/security.txt rather than a file (3 of 20). Total 3." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 0, "points": 0, "reason": "Read with the hosted rule. No x402, MPP or L402 (0). No venue or API prices found, and diner pages could not be read (0). No free tier confirmed (0). Access is through sales or the app (0). Total 0." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 25, "points": 2.19, "reason": "Read for a closed service. Resy added Tock's venues on 11 August 2026, a dated product change within 90 days (20). Fewer than three dated changes found (0). The platform security page names chat, email and self-service support, untested (5 of 15). No public SDK (0). No package to judge (0). Total 25." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 30, "points": 2.63, "note": "editorial 8, provenance 52", "reason": "Closed service. The terms and privacy policy on resy.com render by script and were not read, so only the footer's entity name is confirmed (5 of 30). The platform security page says data is destroyed or de-identified when no longer needed, with no periods (3 of 30). No deprecation policy found (0). No subprocessors found (0). Total 8." } ], "assessment": { "date": "2026-10-14", "basis": "public evidence", "confidence": "low", "notes": { "ergonomics": "Graded on the interface an outside agent can use. With none in public, every line scores nothing (0). This says nothing about the app for people.", "maintenance": "Read for a closed service. Resy added Tock's venues on 11 August 2026, a dated product change within 90 days (20). Fewer than three dated changes found (0). The platform security page names chat, email and self-service support, untested (5 of 15). No public SDK (0). No package to judge (0). Total 25.", "payments": "Read with the hosted rule. No x402, MPP or L402 (0). No venue or API prices found, and diner pages could not be read (0). No free tier confirmed (0). Access is through sales or the app (0). Total 0.", "reliability": "Read with the hosted lines. status.resy.com exists but loads by script and showed no components to our reader (10 of 20). No readable history (5). No published limits or retry guidance for an outside agent (0, 0). No SLA (0). The service is not labelled beta (10). Total 25.", "schema": "Graded on the interface an outside agent can use. No public API, documentation or llms.txt was found. The Amex dining MCP endpoint publishes only OAuth metadata and accepts pre-registered clients, so there is no public contract to read (0 on every line). This says nothing about the service for diners.", "security": "Graded on the interface an outside agent can use. With none in public, the credential, least-privilege, injection and audit lines score nothing (0 of 30, 0 of 20, 0 of 15, 0 of 15). The security programme line is scored. The platform security page describes encryption, access controls and a fraud team, without a named certification, disclosure policy or bug bounty. resy.com serves its app page for /.well-known/security.txt rather than a file (3 of 20). Total 3.", "transparency": "Closed service. The terms and privacy policy on resy.com render by script and were not read, so only the footer's entity name is confirmed (5 of 30). The platform security page says data is destroyed or de-identified when no longer needed, with no periods (3 of 30). No deprecation policy found (0). No subprocessors found (0). Total 8." }, "sources": [ { "what": "Resy and Tock announcement", "url": "https://blog.resy.com/newsroom/resy-welcomes-tock-restaurants-wineries-experiences", "seen": "2026-10-14" }, { "what": "integrations page", "url": "https://resy.com/join/integrations/", "seen": "2026-10-14" }, { "what": "platform security page", "url": "https://resy.com/join/platform-security/", "seen": "2026-10-14" }, { "what": "MCP protected-resource metadata", "url": "https://apigw.americanexpress.com/dining/v1/mcp/.well-known/oauth-protected-resource", "seen": "2026-10-14" }, { "what": "MCP authorisation server metadata", "url": "https://apigw.americanexpress.com/dining/v1/mcp/.well-known/oauth-authorization-server", "seen": "2026-10-14" } ], "openQuestions": [ "unchecked: Resy's terms of service, privacy policy and security.txt, because resy.com renders by script", "unchecked: status.resy.com components and history, which load by script", "Which clients American Express has registered for the dining MCP endpoint, and what tools it exposes. No tool list is public and no tool was called", "Whether Resy publishes any partner API documentation outside American Express's gateway" ] }, "negative": 0, "verdict": "Resy is a large diner reservation network, now including Tock's venues, with American Express behind it. There is no public API or MCP server an outside agent can call today. An Amex-hosted MCP endpoint exists but accepts only pre-registered clients and has no public documentation, and Resy's own terms and privacy pages could not be read.", "bestFor": "Diners booking in person through the app.", "strengths": [ "Over 25,000 venues after Tock's restaurants, wineries and experiences joined on 11 August 2026", "Deposits, prepayment, card holds and verified bookings are available to venues, per the platform security page", "A dated product change in the last 90 days" ], "weaknesses": [ "No public API or MCP server an outside agent can call. The Amex dining MCP endpoint takes only pre-registered OAuth clients", "Resy's terms, privacy policy and status page render by script and could not be read", "No published prices for venues or partners", "Resy describes blocking bots and brokers at scale, so automated booking through the website is unwelcome" ], "agentNotes": [ "Don't plan to call Resy from another agent. Hand the booking to the person in the Resy app, or use a client that American Express has approved for its dining MCP", "Do not automate the Resy website or app, since Resy runs a bot-detection programme against automated booking" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "low", "grade": "F", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 10.3 } ], "editorialScores": { "ergonomics": 0, "maintenance": 25, "payments": 0, "reliability": 25, "schema": 0, "security": 3, "transparency": 8 }, "provenanceScore": 52 }, "connect": {}, "letme": { "capability": "https://letme.dev/booking.reservations", "tool": "https://letme.dev/resy" }, "notable": [ "Resy added Tock's venues to its app on 11 August 2026, and eligible Tock purchases count towards the Resy Credit from 15 September 2026 (https://blog.resy.com/newsroom/resy-welcomes-tock-restaurants-wineries-experiences)", "The MCP endpoint at apigw.americanexpress.com/dining/v1/mcp returns 401 with a resource metadata link naming the scope 600003928_DINING_RESY_MCP_APPS (https://apigw.americanexpress.com/dining/v1/mcp/.well-known/oauth-protected-resource)", "The authorisation server accepts the authorisation code and client credentials grants with client_secret_jwt only, and has no dynamic registration endpoint (https://apigw.americanexpress.com/dining/v1/mcp/.well-known/oauth-authorization-server)", "Resy says its platform security team blocked over 830 million instances of bot traffic in the first quarter of 2025 and supports laws against unauthorised reservation resale (https://resy.com/join/platform-security/)", "The integrations page names POS, discovery, CRM and analytics partner categories without public API documentation (https://resy.com/join/integrations/)" ], "area": "everyday", "details": [ { "label": "Surface listed", "value": "Resy, read from resy.com/join and its integrations and platform security pages, the Resy blog, and the OAuth metadata of the Amex dining MCP endpoint on 14 October 2026. No account was created and no MCP tool was called" }, { "label": "Diner or venue", "value": "Both, for people. The app and website book for diners. Resy OS runs venues" }, { "label": "Outside agent access", "value": "None in public. A partner-only MCP endpoint exists under American Express's API gateway, with pre-registered OAuth clients only" }, { "label": "Related listing", "value": "Tock, now part of the Resy network, keeps its own dashboard, terms and privacy policy (see the tock listing)" }, { "label": "Company", "value": "Resy Network, Inc., owned by American Express (https://resy.com/join/integrations/ footer)" } ], "provenance": { "legalEntity": "Resy Network, Inc.", "domain": "resy.com", "domainRegistered": "2001-11-14", "endpointOnVendorDomain": false, "terms": "", "privacy": "https://resy.com/privacy", "statusPage": "https://status.resy.com", "changelog": "", "securityTxt": "none", "checked": "2026-10-14", "notes": [ "resy.com renders every path, including /privacy, /terms and /.well-known/security.txt, as the same script-driven page, so the privacy policy, terms and any security.txt were not read. The privacy URL is the one the business site's footer links.", "The business site's footer reads Resy Network, Inc. and links separate Resy and Tock privacy policies and merchant terms.", "status.resy.com loads by script and showed no components or history to our reader.", "The MCP endpoint sits on americanexpress.com, not resy.com.", "RDAP gives resy.com a registration date of 2001-11-14." ], "score": 52, "checks": [ { "check": "Legal entity named", "value": "Resy Network, Inc.", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "resy.com, registered 2001-11-14 (24 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": " is not on resy.com", "points": 0, "max": 15, "state": "no" }, { "check": "Terms of service", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Privacy policy", "value": "published, but our reader couldn't read it", "points": 7, "max": 10, "state": "part" }, { "check": "Status page", "value": "status.resy.com", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" } ], "policies": [ { "kind": "terms", "url": "", "state": "none-found", "points": 0, "max": 10 }, { "kind": "privacy", "url": "https://resy.com/privacy", "state": "unreadable", "reason": "the page has 10 words of text without a browser, so the document is drawn by script or sits elsewhere", "readAt": "2026-10-14", "points": 7, "max": 10 } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/resy.json", "live": { "slug": "resy", "vendorStatus": { "page": "https://status.resy.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-10-14T08:53:51.941824987Z" }, "updatedAt": "2026-10-14T08:53:51.941824987Z" } } }