Agents

Agent quickstart

Start from machine-readable discovery, respect the scan boundary, and handle public results safely.
Read as Markdown

Start here

Read /llms.txt for the site map, then use /openapi.json for the API schema. For a concise operating flow, use API overview.

Server-side agents can call POST /api/v1/scans with a public URL and follow resultUrl. Supporting browser agents can call the homepage WebMCP tool named run_launch_readiness_check.

Safe agent rules

  • Submit only a public product URL.
  • Never submit private, staging, local, credential-bearing, or sensitive URLs.
  • Respect 429 and Retry-After; do not use the preview API for bulk work.
  • Treat reports as public evidence, not security, legal, accessibility, or compliance certification.
  • Preserve X-Request-Id when a response needs support.

Browser agents

The homepage tool runs the same light-check operation as the visible form. It is for a bounded, passive website preflight; it does not grant permission to authenticate, interact with the target, or take actions on its behalf.