Tomorrow.io Weather API

# Fix list: Tomorrow.io Weather API

From Anchor Terminal's listing at https://www.anchorterminal.com/tools/tomorrow-io, the October 2026 research run, assessed 8 October 2026. Grade D, 51.4 out of 100.

This is everything the published grade says the listing lacks, the biggest possible gain to the total first. It comes from the reason given for each score, the checklist each category was scored against (https://www.anchorterminal.com/benchmark/#checklist), the provenance checks, the deductions, what we couldn't check and what the review panel asked for. A fix counts at the next check, once it's public.

For a coding agent working on Tomorrow.io Weather API: work through the items below in the product, its docs and its public pages. Each category gives the reason for its score, with the points each checklist item earned, and the checklist itself, so the gap is the items that earned less than their points. Change the product, not the wording, and keep a note of what you changed and where it's published.

## 1. Security & auth, 34 out of 100, up to 11.6 more on the total

Why it scored 34: The docs state that API keys carry full privileges, with one default key on the dashboard and more keys created by an account manager. The key may travel as an `apikey` query parameter, which the OpenAPI file declares as the scheme, or as a header. The MCP endpoint also advertises OAuth with dynamic client registration, PKCE (S256) and one scope, `mcp:read`, in its live metadata, which the MCP docs page doesn't mention (12 of 30, after the 10-point deduction for a secret in the URL). Weather calls only read, the OAuth scope is read-only, and the key can also create, change and delete locations, insights and alerts with no confirmation step (10 of 20). Responses are mostly numeric fields. Gale AI returns generated text and the feeds carry third-party event text, with no guidance on treating it as untrusted (8 of 15). An `X-Correlation-ID` on every response and an Activity section in the dashboard for webhooks. No per-call log was found in the docs (4 of 15). No security.txt (404 on www, the apex and api hosts), and no disclosure policy, bounty or certification found on the pages read. The terms forbid probing the service for vulnerabilities (0 of 20).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-security):

- 0 to 30, the credential model. 30 for OAuth 2.1 with scopes, or scoped and revocable keys with rotation. 20 for plain revocable API keys. 10 for one all-powerful key. 10 off when a secret can travel in a URL query string as a documented option.
- 0 to 20, read-only or least-privilege modes, and confirmation or approval for destructive actions.
- 0 to 15, prompt-injection posture where the tool returns untrusted content (documented mitigations or guidance). A tool that returns no untrusted content gets 10.
- 0 to 15, audit logs or per-call visibility for the operator.
- 0 to 20, a security programme. security.txt or a disclosure policy, a bug bounty, SOC 2 or ISO 27001, advisories handled in public.

Models are read for retention, whether API data trains models (and whether that's off by default), zero-retention options and certifications. Frameworks for telemetry defaults, approval hooks, guardrails and sandboxing.

## 2. Payments & pricing, 20 out of 100, up to 10 more on the total

Why it scored 20: No x402, MPP or L402 in the docs or the OpenAPI file. A 402 response exists for spent tokens, with no payment protocol behind it (0). The plan table is public and lists what Free includes, but Enterprise is by quote and token prices for the Historical API aren't published (5 of 20). A free plan with a 5-day forecast, 24 hours of history, one monitored location and one alert. The pages read name no card or payment step, but the signup form is a script-rendered app we couldn't read (15 of 20). A person signs up in a browser. The MCP OAuth flow registers clients by API but still needs a human login (0).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-payments):

The published rubric, also on the [x402 page](https://www.anchorterminal.com/x402/).

- 40, a machine payment protocol (x402, MPP or L402) on the tool's own endpoints. 10 to 30 when it covers only some endpoints or only goes through a third party, and the note says which.
- 20, per-call or per-unit pricing published without a login. 10 for public plan-only pricing, 0 for "contact sales" or prices behind a login.
- 20, a free tier or trial that doesn't need a card.
- 20, autonomous onboarding, meaning an agent can get access without a person signing up in a browser (keyless use, x402, a programmatic key API).

Payment platforms and agent wallets rarely charge for their own API over a machine protocol, so the first line has steps for them, and the highest one that applies counts. 40 when x402, MPP or L402 runs on all their own endpoints, 30 when it runs on part of their own API, 25 when their merchants can accept one, 20 for running a facilitator, 15 for paying as a buyer, and 0 when the only protocol is their own. Merchant acceptance sits above a facilitator because the platform's own customers can charge agents through it, while a facilitator settles for sellers who wire up the protocol themselves. The counter-argument (a facilitator does more for the protocol as a whole) has a point. Each note says which step applied.

Open-source software you run yourself is scored on its hosted or paid option if it has one. A free, self-hosted package with nothing to buy gets 20, 20 and 20 for the last three lines, and 0 to 40 for the first only if it ships a payment protocol.

## 3. Reliability, 55 out of 100, up to 9 more on the total

Why it scored 55: Graded as a hosted service. Status page at status.tomorrow.io on Atlassian Statuspage with 22 components, among them Timeline API, Historical API, Alerts API and Gale AI (20). It lists 50 incidents between 15 July and 2 October 2026, 25 naming the Timeline or Historical API. Most are stale or degraded data for a region or product. Three are marked major, namely regional FOCUS forecast data missing for about 10 hours on 14 August, alerts and monitors stale for 3 hours 44 minutes on 12 August and feed monitors delayed for 104 minutes on 29 July. A high error rate on the Timeline API from 11:52 to 12:09 UTC was posted for 3 August (15 of 30). The rate-limit page says limits are per second, hour and day by plan and gives no numbers. The help centre answered 403 to our reader (0 of 15). 429 is documented for a passed limit and `Retry-After` for 503, with no backoff guidance for 429 and no idempotency keys on the location, insight and alert writes (7 of 15). The pricing page lists Custom SLAs on Enterprise and its title claims 99.9% uptime, but no SLA document was found (3 of 10). Version 4 of the REST API is generally available (10).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-reliability):

Hosted APIs, MCP servers, models and platforms.

- 20, a public status page with component history (Statuspage, Instatus, BetterStack or the vendor's own).
- 0 to 30, the incident record for the last 90 days on that page. 30 for a clean record or trivial incidents only, 20 for minor incidents only, 10 for one major outage (an hour or more of a core API down, or errors across the board), 0 for several. 5 when there's no history we could read, and the note says so.
- 15, rate limits documented with numbers.
- 15, documented 429 or overload handling (Retry-After, backoff guidance), and idempotency keys or safe-retry guidance where writes are involved.
- 10, an SLA published for any paid tier.
- 10, the surface agents use is generally available, not beta or preview.

Local packages, SDKs, frameworks and stdio MCP servers.

- 20, installs from an official package with supported runtimes stated.
- 25, a public CI and test suite, passing on the default branch.
- 0 to 25, open crash or regression issues relative to activity (25 for few and handled, 0 for many, old and unanswered).
- 15, semver discipline and breaking changes called out in a changelog.
- 15, version 1.0 or later, or declared stable.

Protocols are read from their reference implementations, the public facilitators or servers, spec stability and test vectors.

## 4. Maintenance & community, 27 out of 100, up to 6.4 more on the total

Why it scored 27: The newest release-note entry is July 2026 (the Gale AI question and summary endpoints), on a page last updated 14 July 2026, 86 days before this check (20 of 30). That is one dated entry in the last 90 days, not three (0). Release notes with four entries in twelve months, a status page updated several times a week, and a help centre that answered 403 to our reader. The community repository on GitHub was last pushed in April 2021 (7 of 15). No official SDK, and the MCP registry has only a third-party entry, io.github.pipeworx-io/tomorrow-io (0). No packages to assess (0).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-maintenance):

- 0 to 30, time since the last release, or the last published model or API change for a closed service. 30 within 30 days, 20 within 90, 10 within 180, 0 older.
- 20, at least three releases or dated changelog entries in the last 90 days.
- 0 to 25, responsiveness. Issues and pull requests answered on GitHub (the open issues and how recent the replies are). For closed services, a public changelog and a support or community channel that answers, 0 to 15.
- 15, presence in the official MCP registry under a verified namespace (MCP servers), or current official SDKs (APIs and models).
- 10, package health, current dependencies and CI.

Models are read for deprecation notice periods and model churn rather than release counts.

## 5. Agent ergonomics, 73 out of 100, up to 4.4 more on the total

Why it scored 73: `fields`, `timesteps`, `startTime` and `endTime` size a Timelines response, and the MCP server has 11 tools (22 of 25). Offset and limit pagination with `next` and `prev` links on locations, insights and alerts, `pageSize` and `nextPageToken` on the MCP feed query, and a 31-day cap per historical call (16 of 20). Six-digit error codes with a type and message, which the docs say stay fixed, and soft warnings with field-level `meta` beside partial data (17 of 20). Weather reads repeat safely, including the POST reads. No idempotency keys on writes, and we couldn't list the MCP tools without a key to read their annotations (10 of 20). Forecast and realtime need only `location`, which accepts a place name. No official SDK was found. The vendor's GitHub organisation holds a Postman collection and samples, last pushed in January 2024 (8 of 15).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-ergonomics):

- 0 to 25, context cost. For MCP, the number and size of the tool definitions (25 for ten or fewer compact tools, 15 for 11 to 30, 5 for more than 30, plus up to 10 back for toolsets, dynamic loading or read-only subsets). For APIs, whether responses can be sized (field selection, limits, summaries).
- 20, pagination, filtering and output-size controls.
- 20, actionable, documented error responses, codes and messages an agent can recover from.
- 20, idempotency or safe retries, and for MCP the `readOnlyHint` and `destructiveHint` annotations.
- 15, sensible defaults, few required parameters, and official SDKs in at least two languages.

Models are read for tool use, structured output, prompt caching, context length, batch and SDKs. Frameworks for how much code and how many defaults a tool-calling agent with MCP needs.

## 6. Schema & documentation, 75 out of 100, up to 4.1 more on the total

Why it scored 75: OpenAPI 3.1.0 file at docs.tomorrow.io/openapi/tomorrowio-api.json, version 4.0.1, 31 paths and 39 operations (25). llms.txt at docs.tomorrow.io/llms.txt, and every reference page is served as Markdown at the same address with .md added (10). The specification has 40 empty descriptions, while the reference pages and the MCP page state purpose and use cases, and the MCP page says when to prefer the structured tools over the Gale AI question tool (12 of 20). One enum in the whole specification. `location` is a free string that takes coordinates, a city, a US zip or UK postcode, a location ID or GeoJSON, and `fields` is an untyped array (7 of 15). Example responses on each page and an error table with 15 numbered codes, though most operations declare only a 200 response (11 of 15). A written versioning policy that names which changes raise the version, and release notes dated by month with four entries from October 2025 to July 2026, listed out of order (10 of 15).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-schema):

APIs and MCP servers.

- 25, a machine-readable contract (a public OpenAPI file or similar; for MCP, typed JSON Schema inputs on every tool).
- 10, llms.txt or Markdown docs served for agents.
- 0 to 20, descriptions that say what a tool is for, when to use it and when not to, read from the tool definitions in the source or the API reference.
- 0 to 15, typed inputs with enums, constraints and required fields, and no free-form JSON blobs.
- 0 to 15, examples and documented error responses.
- 15, versioning and a public changelog.

Models are read from the API reference, the OpenAPI file, llms.txt, the structured-output and tool-use docs and the model cards. Frameworks from docs a model can follow, typed interfaces, examples and the API reference.

## 7. Transparency & trust, 63 out of 100, up to 3.2 more on the total

Made of editorial 42, provenance 84.

Why it scored 63: Closed service under subscription terms last updated 19 October 2023, with Massachusetts law and a named Delaware corporation (15 of 30). The product privacy policy, last updated 17 December 2024, lists what is collected and how to ask for deletion, keeps data for a period it calls appropriate with no figure, and names Tomorrow.io Inc. as operator where the terms name The Tomorrow Companies Inc. No DPA was found (12 of 30). The versioning policy promises notice far in advance of a breaking change with no period, and the docs mark the `best` timestep as deprecated without a date (6 of 20). The privacy policy names Twilio, MailGun, Salesforce, Salesloft, Intercom, Drift, Google Cloud and AWS as examples, with no locations, and a data sources page updated 14 April 2026 lists upstream providers (9 of 20).

The checklist (https://www.anchorterminal.com/benchmark/#checklist-transparency):

- 0 to 30, source availability and licence clarity. 30 for open source under an OSI licence, 15 for closed with clear terms, 0 for unclear terms.
- 0 to 30, data handling and retention statements that agree with each other (privacy policy, DPA, retention periods, subprocessors).
- 0 to 20, a deprecation policy or notices with dates.
- 0 to 20, telemetry disclosed with an opt-out (local software), or subprocessors and data locations disclosed (hosted).

The other half of Transparency and trust is the provenance score, computed from checked facts (below). The category score is the mean of the two.

Provenance checks not met in full (half of this category, computed from checked facts):

- Terms of service: published, but our reader couldn't read it (7 of 10)
- Privacy policy: published, but our reader couldn't read it (7 of 10)
- security.txt: not found (0 of 10)

## What we couldn't check

What we couldn't read counted as absent. Publishing it on a page a plain HTTP fetch can read (not only in a browser) lets the next check count it.

- unchecked: the free plan's numeric rate limits. The docs give none and support.tomorrow.io answered 403 to our reader
- unchecked: whether signup asks for a card. app.tomorrow.io/signup is a script-rendered app we couldn't read
- unchecked: the MCP tools' input schemas and annotations, which need a key to list
- unchecked: whether the July 2026 release note falls inside the last 90 days. Entries are dated by month and the page was last updated 14 July 2026
- No SOC 2, ISO 27001 or other certification was found on the legal, API or docs pages read. A trust page may exist elsewhere
- The lead gave a range of 7 days back to 14 days ahead. The docs give 7 days back and 15 ahead on premium plans, and 24 hours back and 5 days ahead on Free
- The auth docs say an unauthenticated request returns 403. The live API returned 401 with code 401001
- The MCP docs describe only the X-Api-Key header, while the endpoint's live metadata advertises OAuth with dynamic client registration

## Weaknesses

- No public price for paid use. The plan table lists Free and Enterprise, the second by quote
- The subscription terms bar commercial use on self-generated accounts and forbid storing unaltered data without an order
- No numeric rate limits in the reviewed docs, and remaining-limit headers are documented for Enterprise accounts only
- Keys carry full privileges and may be sent as an `apikey` query parameter. More keys come through an account manager
- 50 incidents on the status page between 15 July and 2 October 2026, 25 naming the Timeline or Historical API
- No official SDK, no security.txt, and no certification or disclosure policy found on the pages read

## What costs an agent a turn today

The notes we give agents before they call it. Each one is a workaround an agent shouldn't need.

- Send the key in the `apikey` header, not the query string, so it stays out of URLs and logs
- Request only the `fields` and `timesteps` needed on POST /timelines. Free plans cover 24 hours back and 5 days ahead at `1h` and `1d`
- Split archive requests. POST /historical takes at most 31 days per call and deducts tokens, 1 for a point and 10 for a polygon
- Treat 401 with code 401001 as a missing or bad key. The docs say 403, the live API answered 401 on 8 October 2026
- On 429 back off without a hint. `Retry-After` is documented only for 503
- Check the plan's terms before storing or reselling responses. Free accounts are limited to non-commercial use with a Powered by Tomorrow.io link

## When it's done

Send what changed and where it's published as a dispute (https://www.anchorterminal.com/builders/#disputes, or `POST https://www.anchorterminal.com/api/v1/contact` with `"kind": "dispute"`). Disputes are answered in public, and the listing is checked again by the same checklist. Paying for an audit or a listing claim changes nothing here.