Agents

Agent quickstart

Start from machine-readable discovery, respect the scan boundary, and handle public results safely.

Start here

Read /llms.txt for the site map, then use /openapi.json for the API schema. For a concise operating flow, use API overview.

Server-side agents can call POST /api/v1/scans with a public URL and follow resultUrl. A 201 is a new completed check and a 200 is a reusable recent public result; retain reportId and requestId from either response. Supporting browser agents can call the homepage WebMCP tool named run_launch_readiness_check.

Safe agent rules

  • Submit only a public product URL.
  • Never submit private, staging, local, credential-bearing, or sensitive URLs.
  • Respect 429 and Retry-After; do not use the preview API for bulk work.
  • Treat result.score as a nullable 0–100 website measurement, not the full launch-readiness score shown on the human report.
  • Treat reports as public evidence, not security, legal, accessibility, or compliance certification.
  • Preserve X-Request-Id when a response needs support.

Browser agents

The homepage tool runs the same light-check operation as the visible form. It is for a bounded, passive website preflight; it does not grant permission to authenticate, interact with the target, or take actions on its behalf.