# Agent quickstart

> Start from machine-readable discovery, respect the scan boundary, and handle public results safely.

## Start here

Read [/llms.txt](/llms.txt) for the site map, then use [/openapi.json](/openapi.json) for the API schema. For a concise operating flow, use [API overview](/docs/api/overview).

Server-side agents can call `POST /api/v1/scans` with a public URL and follow `resultUrl`. Supporting browser agents can call the homepage WebMCP tool named `run_launch_readiness_check`.

## Safe agent rules

- Submit only a public product URL.
- Never submit private, staging, local, credential-bearing, or sensitive URLs.
- Respect `429` and `Retry-After`; do not use the preview API for bulk work.
- Treat reports as public evidence, not security, legal, accessibility, or compliance certification.
- Preserve `X-Request-Id` when a response needs support.

## Browser agents

The homepage tool runs the same light-check operation as the visible form. It is for a bounded, passive website preflight; it does not grant permission to authenticate, interact with the target, or take actions on its behalf.