Smartcat

# Fix list: Smartcat

From Anchor Terminal's listing at https://www.anchorterminal.com/tools/smartcat, the October 2026 research run, assessed 29 October 2026. Grade C, 54.3 out of 100.

This is everything the published grade says the listing lacks, the biggest possible gain to the total first. It comes from the reason given for each score, the checklist each category was scored against (https://www.anchorterminal.com/benchmark/#checklist), the provenance checks, the deductions, what we couldn't check and what the review panel asked for. A fix counts at the next check, once it's public.

For a coding agent working on Smartcat: work through the items below in the product, its docs and its public pages. Each category gives the reason for its score, with the points each checklist item earned, and the checklist itself, so the gap is the items that earned less than their points. Change the product, not the wording, and keep a note of what you changed and where it's published.

## 1. Security & auth, 42 out of 100, up to 10.1 more on the total

Why it scored 42: Basic authentication with the account ID and an API key that an administrator creates under Settings, API. Several keys can exist, but no scopes, expiry or per-key permissions are documented, and revocation is not described in the reviewed documentation. No query-string secret option was found (15 of 30). Each key reaches the whole workspace, with no read-only key. Delete calls for projects, documents and translation memories take no confirmation. Sandbox workspaces are listed only from the Anticipate plan (5 of 20). The API returns machine and human translations and strings written by linguists, and no guidance on untrusted content was found (3 of 15). `GET /api/integration/v1/audit/logs` returns events with user, type and payload, filterable by date. The security programme page says user activity logs are kept up to 1 year, and the Smartwords report records each translate call by `requestUid` (12 of 15). No security.txt on www.smartcat.com or developers.smartcat.com, and no disclosure policy, bug bounty or public advisories were found. SOC 2 Type II is claimed on the security programme page and the pricing FAQ, with no report or trust centre found. Penetration test results are available on request under NDA (7 of 20).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-security):

- 0 to 30, the credential model. 30 for OAuth 2.1 with scopes, or scoped and revocable keys with rotation. 20 for plain revocable API keys. 10 for one all-powerful key. 10 off when a secret can travel in a URL query string as a documented option.
- 0 to 20, read-only or least-privilege modes, and confirmation or approval for destructive actions.
- 0 to 15, prompt-injection posture where the tool returns untrusted content (documented mitigations or guidance). A tool that returns no untrusted content gets 10.
- 0 to 15, audit logs or per-call visibility for the operator.
- 0 to 20, a security programme. security.txt or a disclosure policy, a bug bounty, SOC 2 or ISO 27001, advisories handled in public.

Models are read for retention, whether API data trains models (and whether that's off by default), zero-retention options and certifications. Frameworks for telemetry defaults, approval hooks, guardrails and sandboxing.

## 2. Payments & pricing, 25 out of 100, up to 9.4 more on the total

Why it scored 25: No x402, MPP or L402 (0). Plan prices are public. The help centre (20 October 2026) gives Adapt $1,200, Accelerate $24,000 and Anticipate $60,000 a year with 100,000, 1,000,000 and 2,000,000 Smartwords, while the pricing page (26 October 2026) shows Adapt from $1,200 and the rest as custom. No top-up price per Smartword was found, so plan-only credit (10). A 15-day trial with 15,000 Smartwords and no card. The pricing FAQ says the trial includes API access, while the plan table and the help centre list API access only from Anticipate, and the trial article doesn't mention the API, so 5 points are withheld for the conflict (15 of 20). A person signs up in a browser and an administrator creates the key (0).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-payments):

The published rubric, also on the [x402 page](https://www.anchorterminal.com/x402/).

- 40, a machine payment protocol (x402, MPP or L402) on the tool's own endpoints. 10 to 30 when it covers only some endpoints or only goes through a third party, and the note says which.
- 20, per-call or per-unit pricing published without a login. 10 for public plan-only pricing, 0 for "contact sales" or prices behind a login.
- 20, a free tier or trial that doesn't need a card.
- 20, autonomous onboarding, meaning an agent can get access without a person signing up in a browser (keyless use, x402, a programmatic key API).

Payment platforms and agent wallets rarely charge for their own API over a machine protocol, so the first line has steps for them, and the highest one that applies counts. 40 when x402, MPP or L402 runs on all their own endpoints, 30 when it runs on part of their own API, 25 when their merchants can accept one, 20 for running a facilitator, 15 for paying as a buyer, and 0 when the only protocol is their own. Merchant acceptance sits above a facilitator because the platform's own customers can charge agents through it, while a facilitator settles for sellers who wire up the protocol themselves. The counter-argument (a facilitator does more for the protocol as a whole) has a point. Each note says which step applied.

Open-source software you run yourself is scored on its hosted or paid option if it has one. A free, self-hosted package with nothing to buy gets 20, 20 and 20 for the last three lines, and 0 to 40 for the first only if it ships a payment protocol.

## 3. Reliability, 56 out of 100, up to 8.8 more on the total

Why it scored 56: Hosted reading, for the REST API and its real-time translation endpoint. status.smartcat.ai is a Statuspage site with three components, the European, American and Asian regions, and no separate API component (20). Its history lists 11 incidents between 1 August and 29 October 2026. Among them are a 4-hour slowdown on 2 September that could stop changes being saved, an access outage in the Americas from 15:28 to 17:27 UTC on 21 September, and access outages marked critical of 38 minutes on 22 September and about 10 minutes on 10 October. Two incidents of an hour or more count as several majors (0 of 30). Limits are published per method group, 35 requests a second for all integration methods down to 30 a minute for translation memory methods (15). A 429 carries Retry-After in whole seconds, other responses carry `x-rate-limit-remaining` and `x-rate-limit-reset`, and the guide says to wait and retry. Writes take no idempotency key, and the glossary guide warns that a repeated create request makes duplicates (11 of 15). The pricing page names Standard, Priority and Enterprise SLAs, but no SLA document or uptime figure was found, and the Customer Agreement disclaims all warranties and sells the services as is (0). The API is generally available. Only custom document segmentation is labelled experimental (10).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-reliability):

Hosted APIs, MCP servers, models and platforms.

- 20, a public status page with component history (Statuspage, Instatus, BetterStack or the vendor's own).
- 0 to 30, the incident record for the last 90 days on that page. 30 for a clean record or trivial incidents only, 20 for minor incidents only, 10 for one major outage (an hour or more of a core API down, or errors across the board), 0 for several. 5 when there's no history we could read, and the note says so.
- 15, rate limits documented with numbers.
- 15, documented 429 or overload handling (Retry-After, backoff guidance), and idempotency keys or safe-retry guidance where writes are involved.
- 10, an SLA published for any paid tier.
- 10, the surface agents use is generally available, not beta or preview.

Local packages, SDKs, frameworks and stdio MCP servers.

- 20, installs from an official package with supported runtimes stated.
- 25, a public CI and test suite, passing on the default branch.
- 0 to 25, open crash or regression issues relative to activity (25 for few and handled, 0 for many, old and unanswered).
- 15, semver discipline and breaking changes called out in a changelog.
- 15, version 1.0 or later, or declared stable.

Protocols are read from their reference implementations, the public facilitators or servers, spec stability and test vectors.

## 4. Agent ergonomics, 57 out of 100, up to 7 more on the total

Why it scored 57: API reading of the checklist. `limit`, `skip` and `offset` cap list sizes, the v1 project list has `include` flags for documents, quotes, custom fields and clients, and one translate call takes several texts and target languages. No field selection was found (15 of 25). `offset` and `limit` on the v2 project list, a cursor with `afterConceptId` and `hasMore` on glossary concepts, `pageSize` up to 5,000 on audit logs, and filters by name, creator, assignee, client and `externalTag` (16 of 20). Errors return a JSON `ErrorResponse` with type, code, message and `requestId`, translate marks each failed text with `error`, and a 429 body is plain text (14 of 20). No idempotency keys. Callbacks are retried 8 times over about 2 hours with a `lastErrors` endpoint, and translate charges can be looked up later by `requestUid` (5 of 20). Translate needs a profile ID made in the web app, project creation needs `assignToVendor`, and the only official client is a PHP library besides the CLI binaries and a Postman collection (7 of 15).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-ergonomics):

- 0 to 25, context cost. For MCP, the number and size of the tool definitions (25 for ten or fewer compact tools, 15 for 11 to 30, 5 for more than 30, plus up to 10 back for toolsets, dynamic loading or read-only subsets). For APIs, whether responses can be sized (field selection, limits, summaries).
- 20, pagination, filtering and output-size controls.
- 20, actionable, documented error responses, codes and messages an agent can recover from.
- 20, idempotency or safe retries, and for MCP the `readOnlyHint` and `destructiveHint` annotations.
- 15, sensible defaults, few required parameters, and official SDKs in at least two languages.

Models are read for tool use, structured output, prompt caching, context length, batch and SDKs. Frameworks for how much code and how many defaults a tool-calling agent with MCP needs.

## 5. Schema & documentation, 67 out of 100, up to 5.4 more on the total

Why it scored 67: An OpenAPI 3.0.1 file with 151 paths and 187 operations is public at smartcat.com/api/methods/v1/swagger.json behind a Swagger UI. The developer site does not link it, and it declares no security scheme (22 of 25). developers.smartcat.com has no llms.txt or Markdown copies. www.smartcat.com has an llms.txt and Markdown twins of its marketing pages, which don't cover the API (3 of 10). 185 of 187 operations have a one-line summary and 28 a description. The guides explain when to use permanent or temporary projects and the real-time endpoint, with little on when not to call a method (10 of 20). 66 enums and 234 required markers, but four JSON content types per body, multipart uploads whose JSON sits in an unnamed form part, and request bodies marked optional on calls that need them (9 of 15). The guides carry curl examples and a status code table, and 400, 403 and 404 are documented on most operations. The OpenAPI file holds one explicit example and no 429 response (10 of 15). Paths are versioned at v1 and v2, and the changelog is dated with a pending-changes section, though it had no entry between 18 March 2024 and 2 October 2026 (13 of 15).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-schema):

APIs and MCP servers.

- 25, a machine-readable contract (a public OpenAPI file or similar; for MCP, typed JSON Schema inputs on every tool).
- 10, llms.txt or Markdown docs served for agents.
- 0 to 20, descriptions that say what a tool is for, when to use it and when not to, read from the tool definitions in the source or the API reference.
- 0 to 15, typed inputs with enums, constraints and required fields, and no free-form JSON blobs.
- 0 to 15, examples and documented error responses.
- 15, versioning and a public changelog.

Models are read from the API reference, the OpenAPI file, llms.txt, the structured-output and tool-use docs and the model cards. Frameworks from docs a model can follow, typed interfaces, examples and the API reference.

## 6. Maintenance & community, 69 out of 100, up to 2.7 more on the total

Why it scored 69: The latest API change is the charges method of 16 October 2026 (30). Three dated changelog entries in 90 days, on 2, 14 and 16 October 2026 (20). Closed service with a public changelog, a support address on it and a help centre that says replies come within one business day. On GitHub, the PHP client's issues from 2021 to 2024 and a February 2026 report about the CLI install steps have no reply, while the PHP 8.4 issue was closed on 14 October 2026 (8 of 15). One official client, `smartcat/smartcat-api` 3.0.1 for PHP of 14 October 2026, and CLI binaries with no version number on the download page (8 of 15). The PHP client has no CI workflow in the repository, and Dependabot bumps for guzzle and psr7 from July and August 2026 are still open (3 of 10).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-maintenance):

- 0 to 30, time since the last release, or the last published model or API change for a closed service. 30 within 30 days, 20 within 90, 10 within 180, 0 older.
- 20, at least three releases or dated changelog entries in the last 90 days.
- 0 to 25, responsiveness. Issues and pull requests answered on GitHub (the open issues and how recent the replies are). For closed services, a public changelog and a support or community channel that answers, 0 to 15.
- 15, presence in the official MCP registry under a verified namespace (MCP servers), or current official SDKs (APIs and models).
- 10, package health, current dependencies and CI.

Models are read for deprecation notice periods and model churn rather than release counts.

## 7. Transparency & trust, 74 out of 100, up to 2.3 more on the total

Made of editorial 56, provenance 91.

Why it scored 74: Closed service with published Terms of Use (18 September 2026) and Customer Agreement (22 September 2026). The PHP client is GPL-3.0-or-later and the CLI is a closed binary (15). The DPA (17 September 2025) returns or deletes data within 30 days of a written request and lists subprocessors. The privacy policy (23 June 2026) keeps personal data as long as required or advisable. A help article says Smartcat doesn't share user information with third parties, beside a DPA list of eleven AI, OCR and dubbing providers. The claim that customer content never trains public models appears on the pricing page and llms.txt, not in the agreements we read. Data centres are the EU, the US and China in the DPA and Asia in the help centre (14 of 30). The changelog has a pending-changes section and a 2022 deprecation of `GET /v1/project/list` with a September 2022 date, yet that method is still in the OpenAPI file with no deprecated flag. Experimental segmentation may change without notice, and the terms and DPA can be changed by notice (10 of 20). Subprocessors named with location and purpose, region chosen at signup, data residency choice on Autonomous only, and 24 hours' notice of subprocessor changes under the SCC clause (17 of 20).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-transparency):

- 0 to 30, source availability and licence clarity. 30 for open source under an OSI licence, 15 for closed with clear terms, 0 for unclear terms.
- 0 to 30, data handling and retention statements that agree with each other (privacy policy, DPA, retention periods, subprocessors).
- 0 to 20, a deprecation policy or notices with dates.
- 0 to 20, telemetry disclosed with an opt-out (local software), or subprocessors and data locations disclosed (hosted).

The other half of Transparency and trust is the provenance score, computed from checked facts (below). The category score is the mean of the two.

Provenance checks not met in full (half of this category, computed from checked facts):

- security.txt: not found (0 of 10)

## What we couldn't check

What we couldn't read counted as absent. Publishing it on a page a plain HTTP fetch can read (not only in a browser) lets the next check count it.

- Whether a trial or Adapt account can create API keys. The pricing FAQ (26 October 2026) says the 15-day trial includes API access, while the plan table and the help centre plan overview (20 October 2026) list API access only on Anticipate and Autonomous, and the trial article (14 October 2026) doesn't mention it. Not settled without signing up, which we didn't do.
- "Sandbox access for testing" on the translation API page has one sentence and no detail. The pricing table lists one sandbox workspace, 'isolated environments to test skills and workflows safely', on Anticipate and Autonomous only. No separate sandbox API host was found.
- The OpenAPI file is public at smartcat.com/api/methods/v1/swagger.json, reached through the Swagger UI that the PHP client's composer.json names. The developer docs don't link it.
- llms.txt exists on www.smartcat.com for the marketing site, with Markdown twins of its pages. developers.smartcat.com/llms.txt answers 404 and the developer docs list no Markdown copies.
- The status page at status.smartcat.ai (status.smartcat.com redirects there) disallows /api/ in robots.txt, so incidents were read from /history and three incident pages, not the JSON feed.
- unchecked: the SOC 2 Type II report. No trust centre or report link was found, so it stays Smartcat's claim, as do '20% of the Fortune 500', '100x less cost' and the G2 figures.
- Whether API keys can be scoped, expired or revoked. Not described in the developer guides or the help centre API article.
- The plan prices differ by page. The help centre gives Accelerate $24,000 and Anticipate $60,000 a year, and the pricing page updated 26 October 2026 shows both as custom.
- No MCP server was found in the smartcatai repositories or on the site. The official MCP registry wasn't searched again; the founder's listing check of 29 October found none.
- The terms forbid robots, spiders, scrapers or other automated access to the platform without authorisation, which matters before any probe outside the API. Recorded as a fact, with no deduction.
- Smartcat doesn't do LocalGhost's or letme's job. Anthropic, whose models wrote this grade, is one of Smartcat's listed AI subprocessors, and a 14 October 2026 commit to the PHP client is co-authored by a Claude model. No score depends on either.
- slator.com, which reports the Series B and the Series C participants, disallows anthropic-ai in robots.txt and wasn't read.

## Weaknesses

- API access is listed only from the Anticipate plan, $60,000 a year per the help centre, while the pricing FAQ says the trial includes it
- API keys are account-wide, with no scopes, expiry or read-only option in the reviewed documentation
- The status page lists a 4-hour slowdown on 2 September 2026 and a 2-hour access outage in the Americas on 21 September
- The OpenAPI file isn't linked from the developer docs and declares no security scheme
- No security.txt, disclosure policy or bug bounty was found, and SOC 2 Type II is a claim on Smartcat's pages
- The only official client is the PHP library, and the developer docs have no llms.txt or Markdown copies

## What costs an agent a turn today

The notes we give agents before they call it. Each one is a workaround an agent shouldn't need.

- Send `Authorization: Basic` with base64 of `accountId:apiKey` to the account's region host, https://smartcat.ai, https://us.smartcat.ai or https://ea.smartcat.ai.
- On 429, wait the seconds in Retry-After before retrying. The 429 itself carries no `x-rate-limit-*` headers.
- Create a smart translation profile in the web app first and pass its ID as `profile` to `smartTranslation/translate`.
- Store each `requestUid` and look charges up later with `smartTranslation/charges`, since the translate response doesn't include the cost.
- Treat callbacks as hints and poll project, document or export status as a fallback, because failed deliveries are dropped after the last retry.

## When it's done

Send what changed and where it's published as a dispute (https://www.anchorterminal.com/builders/#disputes, or `POST https://www.anchorterminal.com/api/v1/contact` with `"kind": "dispute"`). Disputes are answered in public, and the listing is checked again by the same checklist. Paying for an audit or a listing claim changes nothing here.