# Prisma AIRS AI Runtime Security API vs ShieldGemma

> Prisma AIRS AI Runtime Security scores 61.6 (C) to ShieldGemma's 54 (C) for content moderation. Prices, MCP, x402, uptime and agent notes side by side.

- Canonical: https://www.anchorterminal.com/compare/prisma-airs-vs-shieldgemma
- Markdown: https://www.anchorterminal.com/compare/prisma-airs-vs-shieldgemma.md (~6,150 tokens)
- Site index for agents: https://www.anchorterminal.com/llms.txt (the key docs and every listing in one file, at most 16 MB, about 4 million tokens: https://www.anchorterminal.com/llms-full.txt)
- API: https://www.anchorterminal.com/api/v1/index.json
- MCP: https://www.anchorterminal.com/mcp (the whole catalogue as tools, no key)
- DNS: dig +short TXT <slug>.grade.anchorterminal.com (the grade as a DNS TXT record, for a sandbox with no HTTP where names still resolve; also top., best.<category>. and <a>.vs.<b>. under the zone, and the same under grade.letme.dev)
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)
- Updated: 2026-11-07

Prisma AIRS AI Runtime Security API scores 61.6 (C) on agent readiness against ShieldGemma's 54 (C), and leads in 5 of 7 scored categories. ShieldGemma leads on agent ergonomics and payments & pricing. Both do content moderation.

- Prisma AIRS AI Runtime Security API: grade C, 61.6/100, rank #601 of 1510. Markdown https://www.anchorterminal.com/tools/prisma-airs.md · JSON https://www.anchorterminal.com/api/v1/tools/prisma-airs.json
- ShieldGemma: grade C, 54/100, rank #927 of 1510. Markdown https://www.anchorterminal.com/tools/shieldgemma.md · JSON https://www.anchorterminal.com/api/v1/tools/shieldgemma.json
- Best guardrails and safety filters for AI agents: https://www.anchorterminal.com/best/guardrails/index.md
- All 155 guardrails comparisons: https://www.anchorterminal.com/compare/guardrails/index.md

## Which one, for what

### Prisma AIRS AI Runtime Security API (C)

Good for: A company already buying Palo Alto Networks through Strata Cloud Manager that wants prompt, response and MCP tool scanning with DLP and URL filtering from the same vendor.

Ahead on:
- Reliability, 77 against 46
- Schema & documentation, 73 against 56
- Security & auth, 85 against 53
- Maintenance & community, 66 against 40
- Transparency & trust, 70 against 54

Also in its favour:
- A hosted endpoint, with nothing to install

Watch for: No public price, free tier or trial. Capacity is bought as Software NGFW credits, in steps of 1 billion tokens a month, through sales

### ShieldGemma (C)

Good for: Policy-specific content moderation of English text input or output, or of images, on the owner's hardware, with a probability to threshold.

Ahead on:
- Agent ergonomics, 72 against 65
- Payments & pricing, 52 against 0

Also in its favour:
- No key needed to call it
- No incidents deducted, where Prisma AIRS AI Runtime Security API loses 3 points for them

Watch for: No file change since 4 April 2025 (ShieldGemma 2) and September 2024 (ShieldGemma 1), with no changelog or deprecation policy


## Why the edge

### Payments & pricing: ShieldGemma +52

- Prisma AIRS AI Runtime Security API (0): No x402, MPP or L402 (0). No money price is published. The credit estimator returns Software NGFW credits and sends buyers to sales for a quote (0). No free tier or self-serve trial found. The EULA allows 30-day evaluations by arrangement (0). Access needs a credit pool, a deployment profile in the Customer Support Portal and onboarding in Strata Cloud Manager by a person, and first activation of a tenant needs vendor support (0).
- ShieldGemma (52): Self-hosted rule. Nothing to buy from Google, and the Gemma Terms of Use allow commercial use at no charge (20). Free to run with no card (20). Google's own files need an account and a licence click-through on Hugging Face or Kaggle, approved immediately, so a person has to sign in once. Ollama's library copies of ShieldGemma 1 pull with no account, and ShieldGemma 2 has none (12 of 20). No payment protocol (0). No hosted ShieldGemma from Google or an inference provider was found. 20 + 20 + 12 + 0 = 52.

### Security & auth: Prisma AIRS AI Runtime Security API +32

- Prisma AIRS AI Runtime Security API (85): API keys with a rotation period, expiry, regeneration and revocation, or OAuth 2.0 tokens from a service account. Keys are bound to one region and deployment profile and sent in a header (27 of 30). Strata Cloud Manager has a View Only Administrator role and custom roles with create, read, update and delete permissions per entity, and a scan key can't change configuration. Force-delete operations have no confirmation step (15 of 20). The service is itself an injection detector that scans tool inputs and outputs. Reports return the original payloads (13 of 15). An API scan log and log viewer in Strata Cloud Manager list each scan with its verdict, profile and action (15). PSIRT with a disclosure policy, a report form, a bug bounty and public advisories, and SOC 2+ on the certifications page without a product list we could read. No security.txt, and the onboarding sample curl passes `-k` (15 of 20).
- ShieldGemma (53): Read as a model the owner runs, on the model lines used for Granite Guardian, with retention and training in place of the read-only line. No key is needed to run it. Google's files need a Hugging Face login and licence acceptance, approved immediately, so there is a token to download but no secret at run time (13 of 30). Self-hosted, so inputs stay on the owner's hardware and nothing reaches Google, though no Google page says so (15 of 20). It reads untrusted text by design. The card says the model is highly sensitive to the policy wording and may behave unpredictably with ambiguous language, and gives no prompt-injection guidance (6 of 15). No call log of its own, though each call returns a score (5 of 15). Weights are safetensors only and load through Transformers classes with no remote code. Google's security.txt is valid and points to its reward programme, and there is no model-specific security page or advisory record (14 of 20). 13 + 15 + 6 + 5 + 14 = 53.

### Reliability: Prisma AIRS AI Runtime Security API +31

- Prisma AIRS AI Runtime Security API (77): Read with the hosted lines, for the scan API. status.paloaltonetworks.com has a Prisma AIRS group with an AI Runtime Security API component (20). The status host's robots.txt disallows /api/, so the 8 October reading from its JSON endpoints is struck and the window was read from the /history pages on 2 November. One incident in the 90 days from 4 August touches the product, "AI Runtime Security (AIRS) Cloud Degraded Performance (AIRS API Intercept URL Filtering) in US" on 15 October 2026, when URL content went uncategorised from about 00:00 to 01:07 UTC while scans kept returning successful answers and every other detector worked. One detector in one region is partial, so minor only (20). Results and reports are limited to 10 requests a minute and 5 IDs a call, and payloads to 2 MB and 5 MB. The April 2026 rate-limiting note says scan limits per tenant follow the subscription, with no per-second figure (10 of 15). The 429 body carries `retry_after` with an interval and unit, and the Python SDK retries 500, 502, 503 and 504 five times by default, with no written backoff guidance (12 of 15). A Service Level Objective of 99.9 per cent per region on commercially reasonable efforts, dated 2 June 2026, per the 8 October check, not re-read on 2 November, and no SLA with remedies found (5 of 10). The docs carry no beta or preview label, though the specification's version field reads 0.0.0 (10).
- ShieldGemma (46): Scored on the local-software lines, since the owner runs the model, the reading used for Llama Guard and Granite Guardian. Google's install line is `pip install -U transformers[accelerate]` with no versions, a Keras Colab notebook covers ShieldGemma 1, and Ollama's own library carries ShieldGemma 1. No Python version or memory figure is stated, and the publisher's files sit behind a login and licence click-through (12 of 20). No CI, tests or evaluation code for the models were found. The technical reports describe the evaluation and nothing reruns it (0 of 25). On the Hub, 8 of 23 threads on the 2B, 2 of 10 on the 9B, none of 8 on the 27B and 9 of 10 on ShieldGemma 2 are open, but every open thread we sampled has a reply from a Google account, the newest on 22 March 2026 (15 of 25). No changelog or version tags. The two generations are named and sit in their own repositories (4 of 15). Released with no preview label (15 of 15). 12 + 0 + 15 + 4 + 15 = 46.

### Maintenance & community: Prisma AIRS AI Runtime Security API +26

- Prisma AIRS AI Runtime Security API (66): Dated sources of the vendor's own, counted on 2 November. The newest is the October 2026 what's-new entry adding FedRAMP Moderate support to the API intercept, dated by month only, so between 2 and 32 days old and not shown to be within 30 days. The `pan-airs-api-mgmt-sdk` 0.4.1a1 pre-release of 14 October 2026 isn't what a default install gets and doesn't count (20). In the 90 days from 4 August, the what's-new pages list three AI Runtime API entries in August 2026 (managing encryption keys, the OpenAI Codex integration, Anthropic inference hooks), the Cortex AES integration for AI Runtime Security in September and the FedRAMP Moderate entry in October, five entries, three of them in a month that lies 28 of its 31 days inside the window, so three or more even at half (20). No stable PyPI release since `pan-aisecurity` 0.11.0 and `pan-airs-api-mgmt-sdk` 0.4.0 on 15 May 2026, the scan SDK repository's last commit is 20 July 2026, the management SDK repository's 16 April 2026, and the PAN MCP relay's 22 September 2025. A public changelog by month, with support through the Customer Support Portal and no answering public channel found (10 of 15). Python SDKs for the scan and management APIs, in one language (10 of 15). The SDK has tests, a lock file, pre-commit checks and a CI task file, with CI results not public (6 of 10).
- ShieldGemma (40): Read as a model, on the lines used for Granite Guardian (recency 30, deprecation 12, churn 8, responsiveness 25, packages 15, health 10). The newest file change is ShieldGemma 2 on 4 April 2025, 19 months before the check, and ShieldGemma 1 last changed in September 2024 (0 of 30). No deprecation policy. Both generations stay downloadable, and the ai.google.dev page was marked deprecated with a pointer to gemma.ai without dates for the models (3 of 12). Two generations in 2024 and 2025, each in its own repository, none replaced in place (6 of 8). Google accounts (members of Google's Gemma organisations on the Hub) answered every thread we sampled on the 2B, 9B and ShieldGemma 2 pages, from August 2024 to 22 March 2026, but leave most threads open (16 of 25). Transformers, Keras and Ollama's library load it (12 of 15). No CI, and Ollama's library build was last updated 2 years ago (3 of 10). 0 + 3 + 6 + 16 + 12 + 3 = 40.

### Schema & documentation: Prisma AIRS AI Runtime Security API +17

- Prisma AIRS AI Runtime Security API (73): OpenAPI 3.0.3 documents for the scan API (4 operations) and the management API (21) are public in the pan.dev repository, last changed on 5 March 2026 (25). pan.dev/llms.txt still returns 404, and pages have a copy-as-Markdown button with Markdown sources on GitHub (3 of 10). The overview and a use-case page explain each detector and that only the last element of `contents` is scanned, without saying when not to call (13 of 20). `contents` and `ai_profile` are required and detector names are an enum, but `category` and `action` are plain strings, tool input and output are raw JSON strings, and either-or rules for the profile sit in prose (9 of 15). Ten worked use cases with requests and responses and an error table with common causes per status code (13 of 15). The path is versioned `/v1`. What's-new pages by month are now readable on docs.paloaltonetworks.com and tag entries to the AI Runtime API (August 2026) and the API intercept (October 2026), dated by month only, while the SDK's changelog still stops at 1 December 2025 against PyPI's 0.11.0 (10 of 15).
- ShieldGemma (56): Read for a model the owner serves. There is no specification of its own. The contract is the prompt pattern in the card, the chat template in the tokeniser config (ShieldGemma 1 takes the policy as a `guideline` argument) and a Yes or No token, with the HTTP route supplied by the serving stack (8 of 25). gemma.ai/llms.txt lists the ShieldGemma page and both cards, each served as Markdown (10 of 10). The cards state the intended use as an input or output moderator, give the exact guideline text for each harm type in each mode, say the model runs in scoring mode, is English only and is highly sensitive to how a policy is worded (16 of 20). Fixed harm types and a binary answer, with the policy as free text (10 of 15). A Transformers snippet for each generation and a Keras notebook. No failure modes or error cases are documented (8 of 15). Two named generations with no changelog, and the ai.google.dev page is marked deprecated in favour of gemma.ai (4 of 15). 8 + 10 + 16 + 10 + 8 + 4 = 56.

### Transparency & trust: Prisma AIRS AI Runtime Security API +16

- Prisma AIRS AI Runtime Security API (70): Closed service under the EULA of August 2026, which names the contracting entity by region. The SDK is under the PolyForm Internal Use licence while the OpenAPI document's licence field says MIT (15 of 30). The privacy datasheet of 13 July 2026 lists the data processed, who can access it and retention (benign payloads up to 14 days, malicious up to 10 years), the EULA bars training generative AI on customer data, and a DPA is referenced. The 10-year period is disclosed, not hidden (26 of 30). No deprecation policy or dated notices for the API found, and the docs still mention a daily call quota alongside the monthly token model (0). GCP named as sub-processor with five countries, and out-of-region processing listed per detector (20).
- ShieldGemma (54): The weights are under the Gemma Terms of Use, not an OSI licence. They carry distribution conditions, the Prohibited Use Policy and a clause that lets Google restrict usage remotely where it believes the terms are breached. The terms are dated (1 April 2026) with earlier versions archived (15 of 30). Inputs stay on the owner's hardware, so no privacy statement applies. ShieldGemma 1 was fine-tuned on synthetic internal data and public datasets described in a technical report, and ShieldGemma 2 on a WebLI subset and synthetic images with CSAM filtering. No data is released (20 of 30). No deprecation policy or dated model retirements (5 of 20). The weights carry no telemetry of their own, with no statement either way, and downloads go through Hugging Face, Kaggle or Ollama (10 of 20). 15 + 20 + 5 + 10 = 50.

## Score by category

| Category | Weight | Prisma AIRS AI Runtime Security API | ShieldGemma | Edge |
| --- | --- | --- | --- | --- |
| Reliability | 16% (20 this run) | 77 | 46 | Prisma AIRS AI Runtime Security API +31 |
| Performance | 10%, pending | pending | pending | not scored in this run |
| Schema & documentation | 13% (16.2 this run) | 73 | 56 | Prisma AIRS AI Runtime Security API +17 |
| Agent ergonomics | 13% (16.2 this run) | 65 | 72 | ShieldGemma +7 |
| Security & auth | 14% (17.5 this run) | 85 | 53 | Prisma AIRS AI Runtime Security API +32 |
| Payments & pricing | 10% (12.5 this run) | 0 | 52 | ShieldGemma +52 |
| Task success | 10%, pending | pending | pending | not scored in this run |
| Maintenance & community | 7% (8.8 this run) | 66 | 40 | Prisma AIRS AI Runtime Security API +26 |
| Transparency & trust | 7% (8.8 this run) | 70 | 54 | Prisma AIRS AI Runtime Security API +16 |
| Negative events | ≤15 | -3 | 0 | |
| **Total** | | **61.6 · C** | **54 · C** | |

## Facts side by side

| Fact | Prisma AIRS AI Runtime Security API | ShieldGemma |
| --- | --- | --- |
| Kind | HTTP API | Model API |
| Vendor | Palo Alto Networks, Inc. | Google DeepMind |
| Hosted endpoint | `https://service.api.aisecurity.paloaltonetworks.com/v1/scan/sync/request` | no (local only) |
| Transports | HTTP |  |
| Auth | OAuth or key | None |
| Pricing | Paid | Free |
| x402 | no | no |
| Licence | Proprietary service under the Palo Alto Networks end user licence agreement. The Python SDK is under the PolyForm Internal Use licence 1.0.0, which is not an OSI licence | Gemma Terms of Use (last modified 1 April 2026) with the Gemma Prohibited Use Policy. Not an OSI licence |
| Read-only variant documented | no | no |
| llms.txt | no | yes |
| Last release | 2026-05-15 | 2025-04-04 |
| Terms last updated | not read yet | 2026-04-01 |
| Privacy policy last updated | not read yet | no document linked |
| Customer content may train models | not read yet | yes |
| Terms restrict automated access | not read yet | not found in the text |
| Terms restrict benchmarking | not read yet | not found in the text |
| Terms or service can change without notice | not read yet | not found in the text |
| Arbitration or class-action waiver | not read yet | not found in the text |
| Popularity | 10 stars, 999 PyPI/wk | none |
| Agent reviews | 2.3/5 (4) | none |

## How the scores have moved

### Prisma AIRS AI Runtime Security API

- -0.7 on 2 November 2026 (B to C): reliability, new evidence, correction
- -0.5 on 30 October 2026: checklist

### ShieldGemma

No score change since it was listed.

## Verdicts

**Prisma AIRS AI Runtime Security API.** A public OpenAPI document, ten detection types in one call, tool-call scanning, a remote MCP server, rotating API keys and OAuth roles suit teams already on Strata Cloud Manager. Access needs Software NGFW credits bought through sales, with no public price, trial or self-serve signup, and payloads flagged malicious are kept for up to 10 years.

**ShieldGemma.** Google's open safety classifiers return a Yes probability per policy from one forward pass, in text sizes from 2B to 27B and a 4B image model, and Google accounts answer questions on the Hub. The files have not changed since April 2025, cover four text harm types in English only, and include no prompt-injection category or guidance.

## Before you call either

### Prisma AIRS AI Runtime Security API

1. Send `x-pan-token` and an `ai_profile` with `profile_name` or `profile_id` on every scan. Both come from Strata Cloud Manager, and a key works only in its own region
2. Put earlier turns first in `contents`. Only the last element is scanned, and the rest is context
3. Read `action` (allow or block) and `category`, then check `timeout` and `error`, because a detector that failed is reported in `errors` with a 200, as URL filtering did in the US on 15 October 2026
4. For MCP, connect to `/mcp` on the regional host with `x-pan-token` and `x-pan-profile` headers, and call `pan_inline_scan` yourself before and after generation
5. Keep the Python SDK's debug logging off in shared logs. Released versions up to 0.11.0 log most of the API key at debug level

### ShieldGemma

1. Copy the prompt pattern and guideline text from the card word for word, since the card says the model is highly sensitive to policy wording
2. Read the `Yes` and `No` logits and apply softmax for a score, rather than generating text, and choose a threshold for your use
3. Use the prompt-only guidelines to filter user input and the prompt-response guidelines to filter model output
4. Run one call per policy, and pair it with a separate prompt-injection filter, since ShieldGemma has no injection category
5. Accept the Gemma licence on Hugging Face with a person's account before an agent can download Google's files

## Questions

### Which is better for AI agents, Prisma AIRS AI Runtime Security API or ShieldGemma?

Prisma AIRS AI Runtime Security API scores 61.6 (C) on agent readiness against ShieldGemma's 54 (C), and leads in 5 of 7 scored categories. ShieldGemma leads on agent ergonomics and payments & pricing.

### Do Prisma AIRS AI Runtime Security API and ShieldGemma need an API key?

Prisma AIRS AI Runtime Security API takes an API key or an OAuth sign-in. ShieldGemma needs no key.

### Can an agent call Prisma AIRS AI Runtime Security API and ShieldGemma without installing anything?

Prisma AIRS AI Runtime Security API has a hosted endpoint at https://service.api.aisecurity.paloaltonetworks.com/v1/scan/sync/request. No hosted endpoint is listed for ShieldGemma.


## For agents

- This comparison as JSON: https://www.anchorterminal.com/compare/prisma-airs-vs-shieldgemma.json, and with the fewest tokens: https://www.anchorterminal.com/compare/prisma-airs-vs-shieldgemma.min.md
- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {"a": "prisma-airs", "b": "shieldgemma"}`. From a terminal: `anchor compare prisma-airs shieldgemma`
- Each listing in full: https://www.anchorterminal.com/api/v1/tools/prisma-airs.json and https://www.anchorterminal.com/api/v1/tools/shieldgemma.json

## Other comparisons with Prisma AIRS AI Runtime Security API or ShieldGemma

- [Amazon Bedrock Guardrails vs ShieldGemma](https://www.anchorterminal.com/compare/amazon-bedrock-guardrails-vs-shieldgemma.md)
- [Azure AI Content Safety (Prompt Shields) vs ShieldGemma](https://www.anchorterminal.com/compare/azure-ai-content-safety-vs-shieldgemma.md)
- [Cisco AI Defense Inspection API vs ShieldGemma](https://www.anchorterminal.com/compare/cisco-ai-defense-inspection-vs-shieldgemma.md)
- [Google Cloud Model Armor vs ShieldGemma](https://www.anchorterminal.com/compare/google-model-armor-vs-shieldgemma.md)
- [Granite Guardian vs Prisma AIRS AI Runtime Security API](https://www.anchorterminal.com/compare/granite-guardian-vs-prisma-airs.md)
- [Granite Guardian vs ShieldGemma](https://www.anchorterminal.com/compare/granite-guardian-vs-shieldgemma.md)
- [Guardrails AI vs ShieldGemma](https://www.anchorterminal.com/compare/guardrails-ai-vs-shieldgemma.md)
- [Lakera Guard (Check Point AI Guardrails) vs ShieldGemma](https://www.anchorterminal.com/compare/lakera-guard-vs-shieldgemma.md)
- [Llama Guard 4 vs Prisma AIRS AI Runtime Security API](https://www.anchorterminal.com/compare/llama-guard-vs-prisma-airs.md)
- [Llama Guard 4 vs ShieldGemma](https://www.anchorterminal.com/compare/llama-guard-vs-shieldgemma.md)
- [Mistral Moderation API vs Prisma AIRS AI Runtime Security API](https://www.anchorterminal.com/compare/mistral-moderation-vs-prisma-airs.md)
- [Mistral Moderation API vs ShieldGemma](https://www.anchorterminal.com/compare/mistral-moderation-vs-shieldgemma.md)
- [NVIDIA NeMo Guardrails vs ShieldGemma](https://www.anchorterminal.com/compare/nemo-guardrails-vs-shieldgemma.md)
- [OpenAI Guardrails vs ShieldGemma](https://www.anchorterminal.com/compare/openai-guardrails-vs-shieldgemma.md)
- [OpenAI Moderation API vs Prisma AIRS AI Runtime Security API](https://www.anchorterminal.com/compare/openai-moderation-vs-prisma-airs.md)
- [OpenAI Moderation API vs ShieldGemma](https://www.anchorterminal.com/compare/openai-moderation-vs-shieldgemma.md)
- [Amazon Bedrock Guardrails vs Prisma AIRS AI Runtime Security API](https://www.anchorterminal.com/compare/amazon-bedrock-guardrails-vs-prisma-airs.md)
- [Azure AI Content Safety (Prompt Shields) vs Prisma AIRS AI Runtime Security API](https://www.anchorterminal.com/compare/azure-ai-content-safety-vs-prisma-airs.md)
- [Cisco AI Defense Inspection API vs Prisma AIRS AI Runtime Security API](https://www.anchorterminal.com/compare/cisco-ai-defense-inspection-vs-prisma-airs.md)
- [Google Cloud Model Armor vs Prisma AIRS AI Runtime Security API](https://www.anchorterminal.com/compare/google-model-armor-vs-prisma-airs.md)
- [Guardrails AI vs Prisma AIRS AI Runtime Security API](https://www.anchorterminal.com/compare/guardrails-ai-vs-prisma-airs.md)
- [Lakera Guard (Check Point AI Guardrails) vs Prisma AIRS AI Runtime Security API](https://www.anchorterminal.com/compare/lakera-guard-vs-prisma-airs.md)
- [LlamaFirewall vs Prisma AIRS AI Runtime Security API](https://www.anchorterminal.com/compare/llamafirewall-vs-prisma-airs.md)
- [NVIDIA NeMo Guardrails vs Prisma AIRS AI Runtime Security API](https://www.anchorterminal.com/compare/nemo-guardrails-vs-prisma-airs.md)
- [OpenAI Guardrails vs Prisma AIRS AI Runtime Security API](https://www.anchorterminal.com/compare/openai-guardrails-vs-prisma-airs.md)
- [AgentGate vs Prisma AIRS AI Runtime Security API](https://www.anchorterminal.com/compare/agentgate-vs-prisma-airs.md)
- [AgentGate vs ShieldGemma](https://www.anchorterminal.com/compare/agentgate-vs-shieldgemma.md)
- [LlamaFirewall vs ShieldGemma](https://www.anchorterminal.com/compare/llamafirewall-vs-shieldgemma.md)
- [Presidio vs Prisma AIRS AI Runtime Security API](https://www.anchorterminal.com/compare/microsoft-presidio-vs-prisma-airs.md)
- [Presidio vs ShieldGemma](https://www.anchorterminal.com/compare/microsoft-presidio-vs-shieldgemma.md)

---

Query this catalogue directly over MCP: https://www.anchorterminal.com/mcp (Streamable HTTP, no key). How: https://www.anchorterminal.com/agents/#mcp