# Let Agents In

> Measures whether an AI coding agent can find, register with and integrate a product.
> Every check is an HTTP request with a published rule, so the score reproduces.

## What it does

- Free scan: 16 deterministic checks across five funnel stages (discovery, agent entry,
  registration, provisioning, integration). No language model is involved and no account is needed.
- Monitoring beta: free weekly HTTP checks and confirmed-change alerts; no audit purchase required.
  Agent mention checks are experimental, manual and have no fixed schedule.
- One agent report: recorded answers to one buying question, chosen providers and full transcripts.
- Integration pilot: two agreed tasks, an initial test, one small documentation or example fix
  and a retest. See [Pricing](/pricing) for the introductory offer and scope.

## For agents

- [/agent-signup.md](/agent-signup.md): why there is no signup and what to do instead
- [/.well-known/agent-access.json](/.well-known/agent-access.json): endpoints, limits and refusals, machine readable
- [/mcp](/mcp): MCP server, Streamable HTTP, no authentication, two tools. `scan_domain` scores one
  domain; `find_providers` takes the problem in your own words and returns the vendors we measured
  in that category, split by where an unattended run stops. Routing a sentence to a category is the
  weakest part and the tool description carries its measured accuracy
- `POST /api/scan` and the MCP tool both take `format`, with `sarif` for SARIF 2.1.0 that a
  code-scanning pipeline can ingest and `agent` for markdown tasks you can act on directly. The
  readable default is called `json` on the REST endpoint and `summary` on the MCP tool; they are the
  same thing and neither surface accepts the other's name for it
- [/.well-known/mcp.json](/.well-known/mcp.json): the card describing it
- [/openapi.json](/openapi.json): OpenAPI 3.1 spec, generated from the same check definitions the scanner runs
- [/corpus.json](/corpus.json) and [/corpus.csv](/corpus.csv): every published scan as data, one entry
  per domain and check, scored under a single formula version. Free to use with attribution
- [Versioned corpus snapshots](https://github.com/krystiangw/stackpick/releases): dated JSON and CSV
  releases with SHA-256 checksums for reproducible analysis and citation
- `/c/{category}/corpus.json`: a citable slice for one buying category, including the job to be
  done, providers grouped by whether an unattended agent clears or hits a measured barrier, dated
  evidence, and the underlying check rows. Example: [/c/file-storage/corpus.json](/c/file-storage/corpus.json)
- [/docs](/docs): how to scan from code

## Pages

- [Methodology](/methodology): every check, its rule, its point value and why it costs a vendor money
- [Findings](/findings): six studies, including which of our own checks has any relationship with
  being named by an agent, with the limits stated as plainly as the results
- [Categories](/c): one buying question per category put to an agent five times, who it named and
  who it never mentioned. Each category page links the full answers, marked where a vendor is named
- [Scan a domain](/): enter a domain, get a scorecard under a permanent link

## Notes for agents

- To scan a domain programmatically: POST /api/scan with {"domain": "example.com"}.
  Two limits, both hourly: 30 scans per source address, and 5 per domain scanned whoever asks. The
  second is the one you meet first when you rescan one domain, and a scan inside 15 minutes of the
  last one is served from that scan rather than charged. The response carries a report id; the
  human-readable scorecard is at /r/{id}.
- Private and loopback addresses are refused on purpose.
- Contact: hello@letagentsin.com