Research Agents Need APIs for Repeatable Source Work

For MAFU-SHERPA, the industry label "mechanical engineering" is not enough. What matters are concrete signals on a company website: named CNC machines, small production runs, job vacancies or investment in new machining centres. The research system we built reads those sources, assesses the findings and prepares an outreach draft. In our implementation, a person reviews the draft before it is sent. The published case study shows why a research agent needs more than a summary. The same website sentence may be a strong buying signal, outdated promotion or a passing mention. Without its source, date and assessment rule, those cases cannot be separated later.

Turn the research question into fields first

In the MAFU-SHERPA project, the target signals were set before the crawl. The agent looked for machine manufacturers, workpiece range, production-run size and open CNC positions, among other things. It could therefore write a finding into a defined field instead of generating a free-form story from every website. When information was missing, the field stayed empty.

Unknown is a valid research result.

This rule comes from our first-party work. Every important value carries a source and timestamp. A plausible unsupported value is worse than a visible gap because it survives into the next report as if it were a fact.

Five practices make the run repeatable

This checklist transfers to supplier, market, competitor and sales research. It follows from our project workflow and the source-backed security boundaries below:

• Define the fields and allowed sources before the first retrieval.
• Store the URL, retrieval date and exact evidence for every important field.
• Separate observed fact, derived assessment and unknown information.
• Preserve contradictions and send unclear cases for review instead of inventing an average.
• Accept the result through a named dataset or dossier, never through the agent's "done" message.

The final point is not pedantry. A study of real coding-agent sessions documented inaccurate self-reporting and rare self-correction. The research concerns code and remains a preprint. It does not establish an error rate for research, but it does support a clean acceptance rule: inspect the dossier and its sources, not the tool's account of itself.

Reading is not the dangerous step

A research agent necessarily reads outside websites, PDFs or email. That content is untrusted even when the source looks reputable. Germany's BSI explicitly names prompt injection as a risk and recommends minimal permissions, separated access, approval gates and regular log review in its guidance on AI agents.

Simon Willison's "lethal trifecta" model gives the architecture test: untrusted content, private data and a way to communicate externally. When all three meet, an injected instruction can send private information out. We would remove at least one leg in a research system. The reading agent gets no send tool. A separate step drafts from approved fields, and a person sends.

Contradictions belong in the dossier

Suppose a machinery page names a HERMLE machining centre while a newer job posting mentions only turning. The agent should conclude neither "milling company" nor "not a milling company". It stores both dated pieces of evidence and flags the question. The responsible person decides whether the signal is sufficient for the intended purpose. That changes the role of the carried example: the MAFU-SHERPA system does not prioritise firms through a polished summary. It exposes the technical signals it found and lets sales review the draft. This separation keeps research useful when sources are incomplete or contradictory.

The second run tests the source model

More than a report remains after the first run. Stored fields, sources and dates allow a later comparison. A changed machine list, a removed vacancy or a new investment announcement then appears as a sourced change instead of a newly worded claim. Start with a few real cases. Ask a domain expert to check every field against the original evidence and record which gaps or contradictions the agent missed. Only when the same rules survive the second run is a broader API retrieval worthwhile.

The pillar on APIs over screens explains the technical access. Research, however, succeeds through the source model: fields, evidence, gaps, contradictions and separate approval. If you want to map a research task to this model, discuss a concrete workflow with us.