Google Veo by Google

# Fix list: Google Veo

From Anchor Terminal's listing at https://www.anchorterminal.com/tools/google-veo, the October 2026 research run, assessed 1 October 2026. Grade C, 60.8 out of 100.

This is everything the published grade says the listing lacks, the biggest possible gain to the total first. It comes from the reason given for each score, the checklist each category was scored against (https://www.anchorterminal.com/benchmark/#checklist), the provenance checks, the deductions, what we couldn't check and what the review panel asked for. A fix counts at the next check, once it's public.

For a coding agent working on Google Veo: work through the items below in the product, its docs and its public pages. Each category gives the reason for its score, with the points each checklist item earned, and the checklist itself, so the gap is the items that earned less than their points. Change the product, not the wording, and keep a note of what you changed and where it's published.

## 1. Reliability, 45 out of 100, up to 11 more on the total

Why it scored 45: AI Studio has a status page for the Gemini API, and a third-party monitor tracks three components on it (20). The page renders in the browser only, so we couldn't read its incident history, and the monitor's list mixes API incidents with the consumer Gemini app (5). No per-model limits are published for Veo. The docs send you to the AI Studio dashboard and publish only the spend thresholds for each tier ($100 for Tier 2, $1,000 for Tier 3) (5). A 429 RESOURCE_EXHAUSTED comes with advice to wait and retry, but no Retry-After or backoff detail. Billing is only for generated videos, so a retry after a failure costs nothing (10). The Gemini Enterprise Agent Platform SLA covers generateContent, not the predictLongRunning call Veo uses (0). Every Veo model on the Gemini API is a preview, and the GA Veo IDs live on Vertex AI (5).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-reliability):

Hosted APIs, MCP servers, models and platforms.

- 20, a public status page with component history (Statuspage, Instatus, BetterStack or the vendor's own).
- 0 to 30, the incident record for the last 90 days on that page. 30 for a clean record or trivial incidents only, 20 for minor incidents only, 10 for one major outage (an hour or more of a core API down, or errors across the board), 0 for several. 5 when there's no history we could read, and the note says so.
- 15, rate limits documented with numbers.
- 15, documented 429 or overload handling (Retry-After, backoff guidance), and idempotency keys or safe-retry guidance where writes are involved.
- 10, an SLA published for any paid tier.
- 10, the surface agents use is generally available, not beta or preview.

Local packages, SDKs, frameworks and stdio MCP servers.

- 20, installs from an official package with supported runtimes stated.
- 25, a public CI and test suite, passing on the default branch.
- 0 to 25, open crash or regression issues relative to activity (25 for few and handled, 0 for many, old and unanswered).
- 15, semver discipline and breaking changes called out in a changelog.
- 15, version 1.0 or later, or declared stable.

Protocols are read from their reference implementations, the public facilitators or servers, spec stability and test vectors.

## 2. Payments & pricing, 20 out of 100, up to 10 more on the total

Why it scored 20: No x402, MPP or L402 (0). Per-second prices are public, $0.05 to $0.60 a second by model and resolution (20). No free tier for any Veo model (0). A person signs in, links a billing account and creates the key (0).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-payments):

The published rubric, also on the [x402 page](https://www.anchorterminal.com/x402/).

- 40, a machine payment protocol (x402, MPP or L402) on the tool's own endpoints. 10 to 30 when it covers only some endpoints or only goes through a third party, and the note says which.
- 20, per-call or per-unit pricing published without a login. 10 for public plan-only pricing, 0 for "contact sales" or prices behind a login.
- 20, a free tier or trial that doesn't need a card.
- 20, autonomous onboarding, meaning an agent can get access without a person signing up in a browser (keyless use, x402, a programmatic key API).

Payment platforms and agent wallets rarely charge for their own API over a machine protocol, so the first line has steps for them, and the highest one that applies counts. 40 when x402, MPP or L402 runs on all their own endpoints, 30 when it runs on part of their own API, 25 when their merchants can accept one, 20 for running a facilitator, 15 for paying as a buyer, and 0 when the only protocol is their own. Merchant acceptance sits above a facilitator because the platform's own customers can charge agents through it, while a facilitator settles for sellers who wire up the protocol themselves. The counter-argument (a facilitator does more for the protocol as a whole) has a point. Each note says which step applied.

Open-source software you run yourself is scored on its hosted or paid option if it has one. A free, self-hosted package with nothing to buy gets 20, 20 and 20 for the last three lines, and 0 to 40 for the first only if it ships a payment protocol.

## 3. Agent ergonomics, 64 out of 100, up to 5.9 more on the total

Why it scored 64: The create call returns a small operation object and the finished video comes back as a file reference to download (15). No callback, and the docs say poll every 10 seconds (0 of 10). Resolution, duration and aspect ratio control output size (10). No list of past jobs (0 of 10). Standard Google error statuses such as INVALID_ARGUMENT and RESOURCE_EXHAUSTED that an agent can branch on (14). No idempotency key. Only generated videos are billed, so retrying a failed job is safe (10). Only the prompt is required, defaults are 720p, 16:9 and 8 seconds, and official SDKs exist for Python, JavaScript, Go and Java (15).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-ergonomics):

- 0 to 25, context cost. For MCP, the number and size of the tool definitions (25 for ten or fewer compact tools, 15 for 11 to 30, 5 for more than 30, plus up to 10 back for toolsets, dynamic loading or read-only subsets). For APIs, whether responses can be sized (field selection, limits, summaries).
- 20, pagination, filtering and output-size controls.
- 20, actionable, documented error responses, codes and messages an agent can recover from.
- 20, idempotency or safe retries, and for MCP the `readOnlyHint` and `destructiveHint` annotations.
- 15, sensible defaults, few required parameters, and official SDKs in at least two languages.

Models are read for tool use, structured output, prompt caching, context length, batch and SDKs. Frameworks for how much code and how many defaults a tool-calling agent with MCP needs.

## 4. Schema & documentation, 71 out of 100, up to 4.7 more on the total

Why it scored 71: The public Discovery document (revision 20260930) defines PredictLongRunningRequest, but Veo's inputs travel as untyped `instances` and `parameters`, so the contract doesn't describe them (10). llms.txt plus `.md.txt` Markdown copies of every page (10). The Veo guide says what Fast and Lite trade for price, which settings need 8 second clips and what isn't supported, such as multi-video reasoning (16). Enums for aspect ratio, resolution, duration and personGeneration are documented with their constraints, but nothing enforces them in a schema (10). REST and SDK examples in the guide. Errors are covered by the shared Gemini API pages, not for Veo specifically (10). Model IDs carry preview or stable labels, and the changelog and deprecations page are dated (15).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-schema):

APIs and MCP servers.

- 25, a machine-readable contract (a public OpenAPI file or similar; for MCP, typed JSON Schema inputs on every tool).
- 10, llms.txt or Markdown docs served for agents.
- 0 to 20, descriptions that say what a tool is for, when to use it and when not to, read from the tool definitions in the source or the API reference.
- 0 to 15, typed inputs with enums, constraints and required fields, and no free-form JSON blobs.
- 0 to 15, examples and documented error responses.
- 15, versioning and a public changelog.

Models are read from the API reference, the OpenAPI file, llms.txt, the structured-output and tool-use docs and the model cards. Frameworks from docs a model can follow, typed interfaces, examples and the API reference.

## 5. Security & auth, 78 out of 100, up to 3.9 more on the total

Why it scored 78: Model reading of the checklist (credential, training, retention, operator visibility, programme). Gemini API keys can be restricted to the Gemini API and to IPs, referrers or apps, the docs give a rotation routine for leaked keys, the key travels in a header, and Vertex AI uses Google Cloud OAuth with IAM (30). The terms say prompts and responses on paid services aren't used to improve products, and Veo has no free tier (20). Generated videos stay on the server for 2 days (5). We found no deletion call for Veo output, and prompts and responses are logged for abuse detection for a period the terms don't state (0). AI Studio shows usage and, since 6 July 2026, developer logs for the Interactions API. We didn't confirm per-call logs for Veo jobs (8). security.txt valid to 2030 with Google's vulnerability reward programme as its policy (10). ISO/IEC 27001 covers Generative AI on Gemini Enterprise Agent Platform, the Vertex route, but the Gemini API isn't named in scope (5).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-security):

- 0 to 30, the credential model. 30 for OAuth 2.1 with scopes, or scoped and revocable keys with rotation. 20 for plain revocable API keys. 10 for one all-powerful key. 10 off when a secret can travel in a URL query string as a documented option.
- 0 to 20, read-only or least-privilege modes, and confirmation or approval for destructive actions.
- 0 to 15, prompt-injection posture where the tool returns untrusted content (documented mitigations or guidance). A tool that returns no untrusted content gets 10.
- 0 to 15, audit logs or per-call visibility for the operator.
- 0 to 20, a security programme. security.txt or a disclosure policy, a bug bounty, SOC 2 or ISO 27001, advisories handled in public.

Models are read for retention, whether API data trains models (and whether that's off by default), zero-retention options and certifications. Frameworks for telemetry defaults, approval hooks, guardrails and sandboxing.

## 6. Maintenance & community, 77 out of 100, up to 2 more on the total

Why it scored 77: Model reading. The `@google/genai` SDK shipped 2.25.0 on 30 September 2026, and `gemini-omni-1.1-flash`, the named replacement, went GA on 27 August (30). Heavy churn. Veo 2.0 and 3.0 shut down on 30 June 2026 and all three Veo 3.1 previews shut down on 22 October 2026, with release and shutdown dates published but no notice period stated for previews (10). Dated changelog with 13 entries between July and September, and a developer forum (12). Current official SDKs (15). SDK repositories on GitHub under googleapis with CI (10).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-maintenance):

- 0 to 30, time since the last release, or the last published model or API change for a closed service. 30 within 30 days, 20 within 90, 10 within 180, 0 older.
- 20, at least three releases or dated changelog entries in the last 90 days.
- 0 to 25, responsiveness. Issues and pull requests answered on GitHub (the open issues and how recent the replies are). For closed services, a public changelog and a support or community channel that answers, 0 to 15.
- 15, presence in the official MCP registry under a verified namespace (MCP servers), or current official SDKs (APIs and models).
- 10, package health, current dependencies and CI.

Models are read for deprecation notice periods and model churn rather than release counts.

## 7. Transparency & trust, 80 out of 100, up to 1.8 more on the total

Made of editorial 60, provenance 100.

Why it scored 80: Closed models under the Gemini API terms, which say Google won't claim ownership of generated content. SDKs are Apache 2.0 (15). The terms state the paid and unpaid data use (10). Video retention is stated (2 days), the abuse-log period isn't (5). The terms, pricing page and Veo guide agree, and we didn't read the DPA (5). The deprecations page gives release and shutdown dates for every Veo ID and names replacements (20). Regional limits on person generation are documented. We didn't check subprocessors or where Veo requests run (5).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-transparency):

- 0 to 30, source availability and licence clarity. 30 for open source under an OSI licence, 15 for closed with clear terms, 0 for unclear terms.
- 0 to 30, data handling and retention statements that agree with each other (privacy policy, DPA, retention periods, subprocessors).
- 0 to 20, a deprecation policy or notices with dates.
- 0 to 20, telemetry disclosed with an opt-out (local software), or subprocessors and data locations disclosed (hosted).

The other half of Transparency and trust is the provenance score, computed from checked facts (below). The category score is the mean of the two.

## What we couldn't check

What we couldn't read counted as absent. Publishing it on a page a plain HTTP fetch can read (not only in a browser) lets the next check count it.

- When the 22 October 2026 shutdown of the Veo 3.1 previews was first announced. The deprecations page gives no announcement date
- Which GA Veo IDs Vertex AI serves today and their own shutdown dates. We saw `veo-3.1-generate-001` named by a reseller, not on a Google page
- Whether AI Studio logs show individual Veo jobs, and the abuse-log retention period for paid use

## Weaknesses

- All three Veo 3.1 previews shut down on the Gemini API on 2026-10-22
- Veo 2.0 and 3.0 already shut down on 2026-06-30
- No free tier and no per-model rate limits published
- Clips are 4, 6 or 8 seconds per call, and 1080p and 4K need 8
- The Veo endpoint isn't covered by Google's SLA

## What costs an agent a turn today

The notes we give agents before they call it. Each one is a workaround an agent shouldn't need.

- Move off `veo-3.1-*-preview` before 2026-10-22. Use `gemini-omni-1.1-flash` on the Gemini API or the GA Veo IDs on Vertex AI
- Call `predictLongRunning`, then poll the operation name about every 10 seconds until `done` is true. Jobs take 11 seconds to 6 minutes
- Download the video within 2 days. The server deletes it after that
- Set `durationSeconds` to 8 for 1080p, 4K or reference images. Shorter clips aren't supported there
- In the EU, UK, Switzerland and MENA image-to-video only accepts `personGeneration` set to `allow_adult`

## What the review panel asked for

- Publish per-model limits
- Longer preview notice
- publish a per-second price for the replacement

## When it's done

Send what changed and where it's published as a dispute (https://www.anchorterminal.com/builders/#disputes, or `POST https://www.anchorterminal.com/api/v1/contact` with `"kind": "dispute"`). Disputes are answered in public, and the listing is checked again by the same checklist. Paying for an audit or a listing claim changes nothing here.