# agent-site-audit — instructions for AI agents You are reading the agent-facing instructions of a paid, deterministic website-audit service. There is no signup and no API key: payment is the authentication. ## 1. MCP server (preferred if you speak Model Context Protocol) - **Endpoint:** `https://agent.audito.lat/mcp` - **Transport:** Streamable HTTP, JSON-RPC 2.0 (POST). `initialize` -> `tools/list` -> `tools/call` - **Protocol version:** `2025-06-18` (2025-03-26 and 2024-11-05 also accepted) - **Server name:** `agent-site-audit` · Registry: `lat.audito/agent-site-audit` ```jsonc // 1) handshake {"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{}}} // 2) discover tools {"jsonrpc":"2.0","id":2,"method":"tools/list"} // 3) free call {"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"scan_site","arguments":{"url":"https://example.com"}}} // 4) paid call: first without payment to receive the x402 challenge, // then retry with the signed payload {"jsonrpc":"2.0","id":4,"method":"tools/call","params":{"name":"audit_site","arguments":{"url":"https://example.com","payment":""}}} ``` ### Tools | Tool | Price | What you get | |---|---|---| | `service_info` | free | What this service sells, current prices and exactly how to pay. Call this first if you are unsure. | | `scan_site` | free | 3 of 9 checks: HTTP status, robots policy, latency, agent-readiness score. | | `audit_site` | 0.25 USDC | Flat JSON audit: status, latency, server, title, content fingerprint, robots policy, redirect chain, sitemap, viewport meta, JSON-LD, the full issue list and a 0-100 agent-readiness score. | | `deep_audit` | 0.25 USDC | Technical deep audit: TLS certificate, the 7 security headers, cookie flags, DNS and email security (SPF, DMARC, DKIM, CAA, MX), delivery, AI-agent readiness, every finding ranked with a copy-paste fix, a prioritised remediation plan and a URL to a human-readable HTML report. | ## 2. Payment (x402, USDC on Base) Call a paid tool **without** the `payment` argument: the reply contains the challenge. ``` scheme exact network eip155:8453 (Base mainnet) asset 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913 (USDC) extra {"name":"USD Coin","version":"2"} amount / maxAmountRequired 250000 (6 decimals = 0.25 USDC) payTo 0x6B60905d1a4bC09c3F8a0248bC2209B6Fe2388Bf maxTimeoutSeconds 60 ``` 1. Sign an **EIP-3009 `TransferWithAuthorization`** with the wallet that will pay. EIP-712 domain: `name: "USD Coin"`, `version: "2"`, `chainId: 8453`, `verifyingContract: 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913`. 2. Build the payload and base64-encode it: ```jsonc {"x402Version":2,"scheme":"exact","network":"eip155:8453", "payload":{"authorization":{"from":"0x…","to":"0x…","value":"250000","validAfter":"0", "validBefore":"","nonce":"0x<32 bytes>"},"signature":"0x…"}} ``` 3. Retry the same call passing that base64 string as `payment` (MCP) or as the `X-Payment` header (plain HTTP). **Rules you should expect, so you are not surprised:** - Each signature is **single use** — a repeated nonce is refused (`nonce_already_used`). - The paying wallet must hold at least 0.25 USDC; an unfunded wallet is refused with `payer_has_no_funds` and **no work is delivered**. - Nothing is billed unless the tool returns a result. ## 3. Plain HTTP (if you do not speak MCP) | Method | Path | Price | |---|---|---| | GET | `/scan?url=` | free — 3 of 9 checks | | GET | `/robots-policy?url=` | free — robots verdict | | GET | `/audit?url=` | 0.25 USDC — flat JSON audit | | GET | `/report?url=` | 0.25 USDC — self-contained HTML report | | GET | `/deep?url=` | 0.25 USDC — technical deep audit JSON | | GET | `/deep?url=&format=html` | 0.25 USDC — the same as a readable report | An unpaid call to a paid path answers `402 Payment Required` with the same challenge. Payments go in the `X-Payment` header (base64, same payload as above). ## 4. Discovery documents - `https://agent.audito.lat/llms.txt` — this service in one file for LLMs - `https://agent.audito.lat/for-agents.md` — this document - `https://agent.audito.lat/openapi.json` — OpenAPI 3.1 (3 paid resources) - `https://agent.audito.lat/.well-known/x402` — x402 discovery document - `https://agent.audito.lat/.well-known/agent.json` — capability manifest (agent.json v1.3) - `https://agent.audito.lat/.well-known/agent-card.json` — A2A agent card - `https://agent.audito.lat/.well-known/mcp/server-card.json` — MCP server card - `https://agent.audito.lat/sitemap.xml`, `/robots.txt`, `/.well-known/security.txt` **Results are deterministic: no AI inference is used or billed to serve them.** Targets are SSRF-guarded (private and link-local addresses are refused). Contact: agente@audito.lat