Simplismart

# Fix list: Simplismart

From Anchor Terminal's listing at https://www.anchorterminal.com/tools/simplismart, the October 2026 research run, assessed 28 October 2026. Grade F, 29.7 out of 100.

This is everything the published grade says the listing lacks, the biggest possible gain to the total first. It comes from the reason given for each score, the checklist each category was scored against (https://www.anchorterminal.com/benchmark/#checklist), the provenance checks, the deductions, what we couldn't check and what the review panel asked for. A fix counts at the next check, once it's public.

For a coding agent working on Simplismart: work through the items below in the product, its docs and its public pages. Each category gives the reason for its score, with the points each checklist item earned, and the checklist itself, so the gap is the items that earned less than their points. Change the product, not the wording, and keep a note of what you changed and where it's published.

## 1. Reliability, 15 out of 100, up to 17 more on the total

Why it scored 15: Hosted reading. No status page found. The docs and site link none, a search found none, and status.simplismart.ai could not be reached from our network (0). No readable incident history (5). No request or token rate limits are published for shared endpoints. The docs give GPU quotas for training, compilation and private deployments only, 1 H100 and 1 L40 on the Quotas page and 8 of each on the Organisation page (0). No 429 response, Retry-After header or retry guidance found; the OpenAPI files list only 400, 401 and 500 (0). No SLA document found. The homepage claims 99.99% uptime and a Simplismart post calls its autoscaling SLA-backed, but no terms state a commitment, and the terms provide the service as is (0). Shared endpoints carry no beta label, while Muse Spark Open is in beta (10). 0+5+0+0+0+10 = 15.

The checklist (https://www.anchorterminal.com/benchmark/#checklist-reliability):

Hosted APIs, MCP servers, models and platforms.

- 20, a public status page with component history (Statuspage, Instatus, BetterStack or the vendor's own).
- 0 to 30, the incident record for the last 90 days on that page. 30 for a clean record or trivial incidents only, 20 for minor incidents only, 10 for one major outage (an hour or more of a core API down, or errors across the board), 0 for several. 5 when there's no history we could read, and the note says so.
- 15, rate limits documented with numbers.
- 15, documented 429 or overload handling (Retry-After, backoff guidance), and idempotency keys or safe-retry guidance where writes are involved.
- 10, an SLA published for any paid tier.
- 10, the surface agents use is generally available, not beta or preview.

Local packages, SDKs, frameworks and stdio MCP servers.

- 20, installs from an official package with supported runtimes stated.
- 25, a public CI and test suite, passing on the default branch.
- 0 to 25, open crash or regression issues relative to activity (25 for few and handled, 0 for many, old and unanswered).
- 15, semver discipline and breaking changes called out in a changelog.
- 15, version 1.0 or later, or declared stable.

Protocols are read from their reference implementations, the public facilitators or servers, spec stability and test vectors.

## 2. Agent ergonomics, 17 out of 100, up to 13.5 more on the total

Why it scored 17: Model reading of the checklist (tool use, structured output, caching, context, batch, SDKs, errors). The LiveKit guide calls the LLM API fully OpenAI-compatible, but no page documents tools or tool_choice, and the OpenAPI files allow only system, user and assistant roles (3 of 20). No structured-output or JSON mode documented (0 of 15). No prompt caching documented for shared endpoints (0 of 15). Context lengths are not stated per model; output is capped at 4,096 tokens in the API files (3 of 15). No batch API for shared endpoints (0 of 10). Inference goes through the OpenAI client; the simplismart-sdk Python package and CLI manage repositories and deployments, not inference, and a community Pipecat package exists (5 of 10). Expired keys return a documented 401, and the SDK exposes status_code, message and payload, but no error codes or bodies are listed for the inference API (6 of 15). 3+0+0+3+0+5+6 = 17.

The checklist (https://www.anchorterminal.com/benchmark/#checklist-ergonomics):

- 0 to 25, context cost. For MCP, the number and size of the tool definitions (25 for ten or fewer compact tools, 15 for 11 to 30, 5 for more than 30, plus up to 10 back for toolsets, dynamic loading or read-only subsets). For APIs, whether responses can be sized (field selection, limits, summaries).
- 20, pagination, filtering and output-size controls.
- 20, actionable, documented error responses, codes and messages an agent can recover from.
- 20, idempotency or safe retries, and for MCP the `readOnlyHint` and `destructiveHint` annotations.
- 15, sensible defaults, few required parameters, and official SDKs in at least two languages.

Models are read for tool use, structured output, prompt caching, context length, batch and SDKs. Frameworks for how much code and how many defaults a tool-calling agent with MCP needs.

## 3. Security & auth, 35 out of 100, up to 11.4 more on the total

Why it scored 35: Model reading. Named Bearer keys with an expiry chosen at creation, a 401 after expiry and immediate deletion. No scopes or per-key limits found, keys belong to the organisation, and the SDK uses a separate Playground token (20 of 30). No statement on training on API data in the terms, the privacy policy, the AI policy or the docs (0 of 20). No retention or zero-retention statement for prompts and outputs. The privacy policy covers the website only (0 of 15). The Usage page shows request counts and a per-request timeline per model, and an LLM metrics call returns token counts and timings per request id. A Simplismart article claims exportable audit trails, not documented (8 of 15). The homepage shows GDPR, ISO 27001 v2022 and AICPA SOC 2 badges, and a Simplismart article says it holds a SOC 2 Type 2 report, available on request. No trust centre was reachable, security.txt answered 404, and no disclosure policy or bug bounty was found (7 of 20). 20+0+0+8+7 = 35.

The checklist (https://www.anchorterminal.com/benchmark/#checklist-security):

- 0 to 30, the credential model. 30 for OAuth 2.1 with scopes, or scoped and revocable keys with rotation. 20 for plain revocable API keys. 10 for one all-powerful key. 10 off when a secret can travel in a URL query string as a documented option.
- 0 to 20, read-only or least-privilege modes, and confirmation or approval for destructive actions.
- 0 to 15, prompt-injection posture where the tool returns untrusted content (documented mitigations or guidance). A tool that returns no untrusted content gets 10.
- 0 to 15, audit logs or per-call visibility for the operator.
- 0 to 20, a security programme. security.txt or a disclosure policy, a bug bounty, SOC 2 or ISO 27001, advisories handled in public.

Models are read for retention, whether API data trains models (and whether that's off by default), zero-retention options and certifications. Frameworks for telemetry defaults, approval hooks, guardrails and sandboxing.

## 4. Payments & pricing, 25 out of 100, up to 9.4 more on the total

Why it scored 25: No x402, MPP or L402 in the docs or pricing (0). Per-1M-token, per-image, per-audio-minute and per-GPU-hour prices are public without a login. The list omits current models such as Gemma 4 31B, which the quickstart uses, and doesn't say whether the single token price covers input and output (15 of 20). The billing page says new organisations may receive $5 of free credits; whether a card is needed isn't stated, and we did not sign up (10 of 20). A person signs up in the browser with a work email and a verification code, and makes keys in the console (0). 0+15+10+0 = 25.

The checklist (https://www.anchorterminal.com/benchmark/#checklist-payments):

The published rubric, also on the [x402 page](https://www.anchorterminal.com/x402/).

- 40, a machine payment protocol (x402, MPP or L402) on the tool's own endpoints. 10 to 30 when it covers only some endpoints or only goes through a third party, and the note says which.
- 20, per-call or per-unit pricing published without a login. 10 for public plan-only pricing, 0 for "contact sales" or prices behind a login.
- 20, a free tier or trial that doesn't need a card.
- 20, autonomous onboarding, meaning an agent can get access without a person signing up in a browser (keyless use, x402, a programmatic key API).

Payment platforms and agent wallets rarely charge for their own API over a machine protocol, so the first line has steps for them, and the highest one that applies counts. 40 when x402, MPP or L402 runs on all their own endpoints, 30 when it runs on part of their own API, 25 when their merchants can accept one, 20 for running a facilitator, 15 for paying as a buyer, and 0 when the only protocol is their own. Merchant acceptance sits above a facilitator because the platform's own customers can charge agents through it, while a facilitator settles for sellers who wire up the protocol themselves. The counter-argument (a facilitator does more for the protocol as a whole) has a point. Each note says which step applied.

Open-source software you run yourself is scored on its hosted or paid option if it has one. A free, self-hosted package with nothing to buy gets 20, 20 and 20 for the last three lines, and 0 to 40 for the first only if it ships a payment protocol.

## 5. Schema & documentation, 51 out of 100, up to 8 more on the total

Why it scored 51: Model reading. OpenAPI 3.1 files for seven LLMs and 3.0 or 3.1 files for Whisper, Flux, an LLM metrics call and training jobs. They cover a handful of the 150+ models, omit tools and response_format, show a streaming `delta` as the non-streaming response, and several name hosts on s9t.link instead of api.simplismart.live. The Llama 4 Maverick file gives `llama3_1` as its only model id, and /api-reference/openapi.json is the Flux spec (12 of 25). llms.txt and a Markdown copy of each docs page (10). The docs say when to use shared or dedicated endpoints; model pages carry one-line descriptions (10 of 20). Roles are enums, temperature is bounded 0 to 2, max_tokens 1 to 4096, and messages and model are required (10 of 15). curl and OpenAI-client Python examples. Errors are bare 400, 401 and 500 descriptions, plus an SDK example of a 404 payload (7 of 15). No changelog. Every spec reads version 1.0.0 (2 of 15). 12+10+10+10+7+2 = 51.

The checklist (https://www.anchorterminal.com/benchmark/#checklist-schema):

APIs and MCP servers.

- 25, a machine-readable contract (a public OpenAPI file or similar; for MCP, typed JSON Schema inputs on every tool).
- 10, llms.txt or Markdown docs served for agents.
- 0 to 20, descriptions that say what a tool is for, when to use it and when not to, read from the tool definitions in the source or the API reference.
- 0 to 15, typed inputs with enums, constraints and required fields, and no free-form JSON blobs.
- 0 to 15, examples and documented error responses.
- 15, versioning and a public changelog.

Models are read from the API reference, the OpenAPI file, llms.txt, the structured-output and tool-use docs and the model cards. Frameworks from docs a model can follow, typed interfaces, examples and the API reference.

## 6. Transparency & trust, 31 out of 100, up to 6 more on the total

Made of editorial 14, provenance 48.

Why it scored 31: Closed service. The terms, last updated 13 January 2023, name Verute Technologies Private Limited and Indian law but define the Service as the website, grant Simplismart a licence to use and redistribute posted Content, bar robots and automatic access, and rule out refunds. No API or platform terms were found (8 of 30). The privacy policy, effective 13 January 2023, is a website policy that says personal data is processed in India. It says nothing about prompts, outputs, logs or training, and no DPA, retention period or subprocessor list was found. A Simplismart article claims GDPR and HIPAA support (3 of 30). No deprecation policy or dated removals (0 of 20). Data goes to India per the privacy policy, and an article says workloads are kept in approved regions by scheduling policy. No subprocessor or hosting-provider list (3 of 20). 8+3+0+3 = 14.

The checklist (https://www.anchorterminal.com/benchmark/#checklist-transparency):

- 0 to 30, source availability and licence clarity. 30 for open source under an OSI licence, 15 for closed with clear terms, 0 for unclear terms.
- 0 to 30, data handling and retention statements that agree with each other (privacy policy, DPA, retention periods, subprocessors).
- 0 to 20, a deprecation policy or notices with dates.
- 0 to 20, telemetry disclosed with an opt-out (local software), or subprocessors and data locations disclosed (hosted).

The other half of Transparency and trust is the provenance score, computed from checked facts (below). The category score is the mean of the two.

Provenance checks not met in full (half of this category, computed from checked facts):

- Domain age: simplismart.ai, no registry record we could read (0 of 15)
- Endpoint on the vendor's domain: api.simplismart.live is not on simplismart.ai (0 of 15)
- Status page: not found (0 of 10)
- Changelog: not found (0 of 10)
- security.txt: not found (0 of 10)

## 7. Maintenance & community, 42 out of 100, up to 5.1 more on the total

Why it scored 42: Model reading for a closed service. Muse Spark Open was added in beta on 19 October 2026, and the docs sitemap shows pages changed on 7 October (30). No deprecation policy or notice period found (0 of 12). One dated model addition in the 90 days to 28 October and no recorded removals; the pricing page still lists Llama 3.1 405B and DeepSeek-R1, which the API reference doesn't cover, so the live model set is unclear (2 of 8). No public changelog or community channel. Support is support@simplismart.ai and a contact form, not tested (4 of 15). SDK issue replies not read, because github.com gave no readable robots.txt (0 of 10). simplismart-sdk for Python, documented with a CLI, and the OpenAI client for inference. No TypeScript SDK, and the PyPI page answered with a browser challenge, so the version and date are unchecked (6 of 15). CI not checked (0 of 10). 30+0+2+4+0+6+0 = 42.

The checklist (https://www.anchorterminal.com/benchmark/#checklist-maintenance):

- 0 to 30, time since the last release, or the last published model or API change for a closed service. 30 within 30 days, 20 within 90, 10 within 180, 0 older.
- 20, at least three releases or dated changelog entries in the last 90 days.
- 0 to 25, responsiveness. Issues and pull requests answered on GitHub (the open issues and how recent the replies are). For closed services, a public changelog and a support or community channel that answers, 0 to 15.
- 15, presence in the official MCP registry under a verified namespace (MCP servers), or current official SDKs (APIs and models).
- 10, package health, current dependencies and CI.

Models are read for deprecation notice periods and model churn rather than release counts.

## What we couldn't check

What we couldn't read counted as absent. Publishing it on a page a plain HTTP fetch can read (not only in a browser) lets the next check count it.

- unchecked: a status page or incident history. None is linked, and status.simplismart.ai could not be reached from our network.
- unchecked: the SOC 2 Type II report and ISO 27001 certificate, which are claims on Simplismart's pages; no trust centre was reachable.
- Whether prompts and outputs on shared endpoints are logged, retained or used for training. No public statement found.
- Whether tool calling, JSON mode and prompt caching work on shared endpoints, and each model's context length. Not documented, and no call was made.
- Whether the single per-1M-token price covers input and output tokens. One Simplismart article says only generated tokens are billed.
- Whether the $5 free credits need a card. The billing page says new organisations 'may receive' them.
- unchecked: the simplismart-sdk version and date on PyPI, which answered with a browser challenge, and the SDK repository on GitHub, whose robots.txt answered 403.
- Which default GPU quota applies. The Quotas page says 1 H100 and 1 L40, the Organisation page 8 of each.
- No valuation with a stated basis was found. A KuCoin flash headline says the Series B was 'at $100M valuation', and earlier reports said NVIDIA was in talks to lead a $20M round at $100M; neither states a basis.

## Weaknesses

- No request or token rate limits, 429 handling or retry guidance found in the docs; only GPU quotas, given as 1 and as 8 H100s on two pages
- No status page, incident history or SLA document found; the 99.99% uptime figure is a homepage claim
- Tool calling, structured output, prompt caching and context lengths are not documented for the shared endpoints
- The terms (13 January 2023) and privacy policy cover the website and say nothing about prompt retention or training on API data
- The pricing page lists older models (Llama 3.1, DeepSeek-R1) and omits Gemma 4 31B, the model the quickstart uses

## What costs an agent a turn today

The notes we give agents before they call it. Each one is a workaround an agent shouldn't need.

- Point an OpenAI-compatible client at https://api.simplismart.live with SIMPLISMART_API_KEY as a Bearer token, and take model ids from the marketplace or the per-model API pages.
- Set a key expiry and rotate before midnight UTC on the expiry date, because an expired key returns 401.
- Cap retries yourself with exponential backoff, because no rate limits, 429 format or retry guidance are published.
- Check that a model supports tools or JSON output with a test call before relying on it, because neither is documented.
- Confirm the per-token price of the exact model in the console before running large jobs, because the public price list is incomplete.

## When it's done

Send what changed and where it's published as a dispute (https://www.anchorterminal.com/builders/#disputes, or `POST https://www.anchorterminal.com/api/v1/contact` with `"kind": "dispute"`). Disputes are answered in public, and the listing is checked again by the same checklist. Paying for an audit or a listing claim changes nothing here.