Docs

Scan API and response formats

The scan reads public pages. You do not need an account, an API key or OAuth.

Scan a domain

POST /api/scan with a domain. The response contains its scorecard and an ID for the permanent /r/<id> page.

curl -X POST https://letagentsin.com/api/scan \
  -H 'content-type: application/json' \
  -d '{"domain": "example.com"}'

The response includes id, domain and scorecard. Each check has points, max and a readable detail. Divide the total by measurable for the score share.

inconclusive: true

The check scored zero because it could not be measured. Excluded from the measurable denominator.

notApplicable: true

The check does not apply to this product. Excluded from the measurable denominator.

max

Full theoretical maximum. It can include checks that were not measurable or applicable.

{
  "id": "example-com-202608072143",
  "domain": "example.com",
  "scorecard": {
    "formulaVersion": "9.57",
    "total": 9,
    "measurable": 14,
    "max": 18,
    "stages": [{ "letter": "A", "title": "Discovery", "points": 4, "measurable": 4, "max": 5 }],
    "checks": [
      { "id": "llms_txt", "stage": "discovery", "label": "llms.txt published",
        "points": 1, "max": 1, "detail": "llms.txt present" },
      { "id": "signup_reachable", "stage": "signup", "label": "Signup page reachable",
        "points": 0, "max": 1,
        "detail": "No signup page linked from the site we could follow",
        "inconclusive": true,
        "unblock": "Link your signup page from your home page and this becomes measurable." }
    ]
  }
}

Progress events

POST /api/scan/stream for server-sent progress events. Scans usually take seconds and can run for a minute. Signup probes run up to three times. The final done event includes the result ID.

curl -N -X POST https://letagentsin.com/api/scan/stream \
  -H 'content-type: application/json' \
  -d '{"domain": "example.com"}'

event: step
data: {"label":"Checking robots.txt against 13 AI crawlers","done":2,"total":5}

event: done
data: {"id":"example-com-202608072143","total":9,"max":18}

Access, limits and formats

Scan endpoints require no credentials. Limits are 5 scans per domain and 30 per caller each hour. Repeat requests within 15 minutes return the stored result. A 429 response includes a retry-after header.

Connect to /mcp over Streamable HTTP. The scan_domain tool takes a domain and uses the REST scan limits. No authentication is required. Its descriptor is /.well-known/mcp.json.

The home page also registers scan_domain through WebMCP. Origin trial support: Chrome 149+ and Edge 150+, read on 30 August 2026. Registration requires document.modelContext. The HTTP endpoints work without JavaScript.

The scan API and MCP tool accept a format option.

Download published scans from /corpus.json or /corpus.csv. Each row contains the domain, check, verdict and observed evidence. Free to use and quote with attribution.

Machine-readable descriptions: /openapi.json, /.well-known/agent-access.json, /.well-known/mcp.json and /agent-signup.md.

Rejected hosts

Only public hosts are accepted. IP literals, private and loopback ranges, link-local addresses, cloud metadata endpoints and unresolved names are refused. Each redirect destination is resolved and checked again.