Powens

# Fix list: Powens

From Anchor Terminal's listing at https://www.anchorterminal.com/tools/powens, the October 2026 research run, assessed 9 October 2026. Grade E, 42.6 out of 100.

This is everything the published grade says the listing lacks, the biggest possible gain to the total first. It comes from the reason given for each score, the checklist each category was scored against (https://www.anchorterminal.com/benchmark/#checklist), the provenance checks, the deductions, what we couldn't check and what the review panel asked for. A fix counts at the next check, once it's public.

For a coding agent working on Powens: work through the items below in the product, its docs and its public pages. Each category gives the reason for its score, with the points each checklist item earned, and the checklist itself, so the gap is the items that earned less than their points. Change the product, not the wording, and keep a note of what you changed and where it's published.

## 1. Reliability, 27 out of 100, up to 14.6 more on the total

Why it scored 27: Graded with the hosted lines. No status page is linked from the home page, the product pages or the docs read. status.powens.com was a guess that our network could not reach, so this is scored absent and listed as unchecked (0 of 20). No readable incident history (5 of 30). The fair usage policy publishes sandbox limits of 30 calls a minute and 86,400 a day. Production limits are not published (10 of 15). The policy says rate limiting exists and asks for webhooks before polling. No 429 status, Retry-After, backoff guidance or idempotency key was found, and the response code table has no 429 (2 of 15). The conditions of sale carry no uptime figure. The site states 99.9 per cent historical API availability and a committed 95 per cent connection success rate as claims, not as a published SLA (0). Version 2.0 is the current API with no beta label (10).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-reliability):

Hosted APIs, MCP servers, models and platforms.

- 20, a public status page with component history (Statuspage, Instatus, BetterStack or the vendor's own).
- 0 to 30, the incident record for the last 90 days on that page. 30 for a clean record or trivial incidents only, 20 for minor incidents only, 10 for one major outage (an hour or more of a core API down, or errors across the board), 0 for several. 5 when there's no history we could read, and the note says so.
- 15, rate limits documented with numbers.
- 15, documented 429 or overload handling (Retry-After, backoff guidance), and idempotency keys or safe-retry guidance where writes are involved.
- 10, an SLA published for any paid tier.
- 10, the surface agents use is generally available, not beta or preview.

Local packages, SDKs, frameworks and stdio MCP servers.

- 20, installs from an official package with supported runtimes stated.
- 25, a public CI and test suite, passing on the default branch.
- 0 to 25, open crash or regression issues relative to activity (25 for few and handled, 0 for many, old and unanswered).
- 15, semver discipline and breaking changes called out in a changelog.
- 15, version 1.0 or later, or declared stable.

Protocols are read from their reference implementations, the public facilitators or servers, spec stability and test vectors.

## 2. Payments & pricing, 10 out of 100, up to 11.3 more on the total

Why it scored 10: No x402, MPP or L402 (0). No public prices. Fees are set in a purchase order by volume of users (0). A free, self-serve console account with a sandbox domain and a test connector, no card mentioned. No free live tier (10 of 20). A person signs up in the console (0).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-payments):

The published rubric, also on the [x402 page](https://www.anchorterminal.com/x402/).

- 40, a machine payment protocol (x402, MPP or L402) on the tool's own endpoints. 10 to 30 when it covers only some endpoints or only goes through a third party, and the note says which.
- 20, per-call or per-unit pricing published without a login. 10 for public plan-only pricing, 0 for "contact sales" or prices behind a login.
- 20, a free tier or trial that doesn't need a card.
- 20, autonomous onboarding, meaning an agent can get access without a person signing up in a browser (keyless use, x402, a programmatic key API).

Payment platforms and agent wallets rarely charge for their own API over a machine protocol, so the first line has steps for them, and the highest one that applies counts. 40 when x402, MPP or L402 runs on all their own endpoints, 30 when it runs on part of their own API, 25 when their merchants can accept one, 20 for running a facilitator, 15 for paying as a buyer, and 0 when the only protocol is their own. Merchant acceptance sits above a facilitator because the platform's own customers can charge agents through it, while a facilitator settles for sellers who wire up the protocol themselves. The counter-argument (a facilitator does more for the protocol as a whole) has a point. Each note says which step applied.

Open-source software you run yourself is scored on its hosted or paid option if it has one. A free, self-hosted package with nothing to buy gets 20, 20 and 20 for the last three lines, and 0 to 40 for the first only if it ships a payment protocol.

## 3. Schema & documentation, 48 out of 100, up to 8.5 more on the total

Why it scored 48: No OpenAPI file or other machine-readable contract was found. The reference is hand-written GitBook tables (0 of 25). Both docs spaces publish llms.txt and a Markdown twin of every page (10). Each resource page opens with what the resource is, and endpoints say which token they need and how soft-deleted items behave. Several endpoints have no description beyond the title (12 of 20). Parameters and objects are in tables with types, required marks and value lists for states and scopes. Configuration and client `config` are free key-value objects (9 of 15). Guides carry curl requests and JSON responses. The reference pages read have few examples, and the errors page lists five common codes and warns that others may appear (9 of 15). The version is in the path (2.0). The changelog is a Notion page that is drawn by script and was not read (8 of 15).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-schema):

APIs and MCP servers.

- 25, a machine-readable contract (a public OpenAPI file or similar; for MCP, typed JSON Schema inputs on every tool).
- 10, llms.txt or Markdown docs served for agents.
- 0 to 20, descriptions that say what a tool is for, when to use it and when not to, read from the tool definitions in the source or the API reference.
- 0 to 15, typed inputs with enums, constraints and required fields, and no free-form JSON blobs.
- 0 to 15, examples and documented error responses.
- 15, versioning and a public changelog.

Models are read from the API reference, the OpenAPI file, llms.txt, the structured-output and tool-use docs and the model cards. Frameworks from docs a model can follow, typed interfaces, examples and the API reference.

## 4. Agent ergonomics, 57 out of 100, up to 7 more on the total

Why it scored 57: Lists take `limit` up to 1,000 and `expand` pulls linked resources into one response. No field selection was found (17 of 25). `limit` and `offset` on most lists, opaque cursor links in `_links` on transactions, and `min_date`, `max_date`, `last_update`, value and wording filters (18 of 20). One error format with `code`, `description`, an optional bank message and `request_id`, and advice to branch on the code. The documented code list is short (13 of 20). No idempotency key was found, including on `POST /payments`. Reads are safe to repeat (4 of 20). A first data call needs a console domain, a client application, a user token, a temporary code and a browser consent. `limit` is required on transactions. The only SDK found is an iOS beta from 2024 (5 of 15).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-ergonomics):

- 0 to 25, context cost. For MCP, the number and size of the tool definitions (25 for ten or fewer compact tools, 15 for 11 to 30, 5 for more than 30, plus up to 10 back for toolsets, dynamic loading or read-only subsets). For APIs, whether responses can be sized (field selection, limits, summaries).
- 20, pagination, filtering and output-size controls.
- 20, actionable, documented error responses, codes and messages an agent can recover from.
- 20, idempotency or safe retries, and for MCP the `readOnlyHint` and `destructiveHint` annotations.
- 15, sensible defaults, few required parameters, and official SDKs in at least two languages.

Models are read for tool use, structured output, prompt caching, context length, batch and SDKs. Frameworks for how much code and how many defaults a tool-calling agent with MCP needs.

## 5. Security & auth, 60 out of 100, up to 7 more on the total

Why it scored 60: A client ID and secret from the console, sent in the request body, issue permanent user tokens that never expire and are revoked with `DELETE /auth/token` or `POST /auth/renew`. The secret can be reset with `PUT /clients/{clientAppId}`. Payment service tokens last 30 minutes and carry scopes. A user token has no read-only form. The Webview takes a 30-minute or single-use code in the URL in place of the token, so no deduction was taken (22 of 30). Payments have separate read-only, validate and cancel scopes, accounts stay disabled until the account holder consents, and `payment.max_amount` caps payment size. A user token can delete its user and connections (13 of 20). Responses carry bank-written transaction wording and bank error messages, and no guidance on treating them as untrusted was found (6 of 15). `GET /config/logs` lists configuration changes, connections have a logs endpoint, and errors carry a `request_id` (9 of 15). The site says Powens is ISO 27001 certified and that security is tested and audited each year, with no certificate published. security.txt returns 404, and no disclosure policy or bug bounty was found (10 of 20).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-security):

- 0 to 30, the credential model. 30 for OAuth 2.1 with scopes, or scoped and revocable keys with rotation. 20 for plain revocable API keys. 10 for one all-powerful key. 10 off when a secret can travel in a URL query string as a documented option.
- 0 to 20, read-only or least-privilege modes, and confirmation or approval for destructive actions.
- 0 to 15, prompt-injection posture where the tool returns untrusted content (documented mitigations or guidance). A tool that returns no untrusted content gets 10.
- 0 to 15, audit logs or per-call visibility for the operator.
- 0 to 20, a security programme. security.txt or a disclosure policy, a bug bounty, SOC 2 or ISO 27001, advisories handled in public.

Models are read for retention, whether API data trains models (and whether that's off by default), zero-retention options and certifications. Frameworks for telemetry defaults, approval hooks, guardrails and sandboxing.

## 6. Maintenance & community, 33 out of 100, up to 5.9 more on the total

Why it scored 33: The public changelog is a Notion page drawn by script and was not read, so recency is taken from the docs sitemap. The newest reference page change is dated 15 September 2026, 24 days before the check, scored 20 of 30 because docs metadata is weaker evidence than a release note. Docs pages changed on two dates in the last 90 days, 31 August and 15 September, and dated changelog entries could not be counted (0 of 20). Closed service with a linked changelog, a support desk on Jira and support hours of 9.30am to 7pm on working days in the conditions of sale (8 of 15). The iOS SDK is at 1.0.0-beta with its last commit on 1 October 2024, Android is marked coming soon, and no server-side SDK was found (3 of 15). The SDK repository holds a binary framework with no CI workflow (2 of 10).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-maintenance):

- 0 to 30, time since the last release, or the last published model or API change for a closed service. 30 within 30 days, 20 within 90, 10 within 180, 0 older.
- 20, at least three releases or dated changelog entries in the last 90 days.
- 0 to 25, responsiveness. Issues and pull requests answered on GitHub (the open issues and how recent the replies are). For closed services, a public changelog and a support or community channel that answers, 0 to 15.
- 15, presence in the official MCP registry under a verified namespace (MCP servers), or current official SDKs (APIs and models).
- 10, package health, current dependencies and CI.

Models are read for deprecation notice periods and model churn rather than release counts.

## 7. Transparency & trust, 63 out of 100, up to 3.2 more on the total

Made of editorial 64, provenance 61.

Why it scored 63: Closed service with public General Terms and Conditions of Sale under French law. The page has no version or date. The iOS SDK is LGPL-3.0 (15 of 30). The conditions of sale include a data protection annex, say collected data is destroyed at most 30 days after the contract ends, and the privacy policy gives retention periods by purpose. Neither page is dated, and the end-user terms say no data leaves the EU while the privacy policy lists business tools with transfers outside it (22 of 30). Obsolete and deprecated items are marked in the docs with no dates, and the conditions of sale say backward compatibility is assured but may be limited, with no notice period (5 of 20). The conditions of sale name Sewan and AWS, OVH and Gemalto in France and Unnax and CRIF in Spain and Italy, and commit to servers in the EU (17 of 20). Regulatory standing counts here as an addition to the checklist, as for the other bank data listings. Powens SAS is a payment institution registered with the ACPR under CIB 16948 (+5).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-transparency):

- 0 to 30, source availability and licence clarity. 30 for open source under an OSI licence, 15 for closed with clear terms, 0 for unclear terms.
- 0 to 30, data handling and retention statements that agree with each other (privacy policy, DPA, retention periods, subprocessors).
- 0 to 20, a deprecation policy or notices with dates.
- 0 to 20, telemetry disclosed with an opt-out (local software), or subprocessors and data locations disclosed (hosted).

The other half of Transparency and trust is the provenance score, computed from checked facts (below). The category score is the mean of the two.

Provenance checks not met in full (half of this category, computed from checked facts):

- Endpoint on the vendor's domain: {domain}.biapi.pro is not on powens.com (0 of 15)
- Terms of service: read, states 4 of the 7 things a reader expects (7.4 of 10)
- Privacy policy: read, states 6 of the 8 things a reader expects (8.5 of 10)
- Status page: not found (0 of 10)
- security.txt: not found (0 of 10)

## What we couldn't check

What we couldn't read counted as absent. Publishing it on a page a plain HTTP fetch can read (not only in a browser) lets the next check count it.

- unchecked: the public changelog on Notion, which is drawn by script. The last release date and the count of dated entries in 90 days were not established, and `lastRelease` is left empty
- unchecked: whether a status page exists. None is linked from the pages read, and status.powens.com could not be reached from our network
- unchecked: 27 of the 40 API reference pages, including balances, identities, investments and payment links. The operation count covers the nine resource pages read
- unchecked: the console itself (signup steps, whether a card is asked for, audit logs, production rate limits), which sits behind a login
- unchecked: GitHub stars and issue replies on the iOS SDK repository. The GitHub API was not queried
- The conditions of sale and the privacy policy carry no version or effective date
- The ISO 27001 claim on powens.com has no certificate, scope or issuing body published on the pages read
- Coverage is stated as 11 countries on one page, 12 on another and 12+ in the FAQ, and the coverage page lists 11 for Transactions
- Payments, virtual IBANs and transfers, partly from the former Unnax platform with its own developer site, were not graded. This listing covers the bank data API at biapi.pro

## Weaknesses

- No OpenAPI or other machine-readable contract was found. The reference is hand-written tables
- No public prices. Fees are set per volume of users in a signed purchase order
- No status page is linked from the site or docs read, and no uptime SLA appears in the conditions of sale
- No idempotency key or documented 429 handling was found, and production rate limits are not published
- The only SDK found is an iOS package at 1.0.0-beta, last changed on 1 October 2024

## What costs an agent a turn today

The notes we give agents before they call it. Each one is a workaround an agent shouldn't need.

- Ask the owner for the domain name, client ID and client secret from the console. Every call goes to `https://{domain}.biapi.pro/2.0`
- Send `limit` on every transactions list. It is required, at most 1,000, and the next page comes from `_links.next.href` used as given
- Enable an account with `POST` and `{"disabled": false}` only after the account holder consents. Accounts arrive disabled with no transactions
- Store the permanent user token as a secret. It does not expire, and the default webhook sends it in the `Authorization` header
- Stay under 30 calls a minute in the sandbox and use webhooks in place of polling, as the fair usage policy asks

## When it's done

Send what changed and where it's published as a dispute (https://www.anchorterminal.com/builders/#disputes, or `POST https://www.anchorterminal.com/api/v1/contact` with `"kind": "dispute"`). Disputes are answered in public, and the listing is checked again by the same checklist. Paying for an audit or a listing claim changes nothing here.