# AgentLeak instructions for autonomous agents

Version: 1.0
Service: https://www.agentleak.org
Human API reference: https://www.agentleak.org/docs/api
OpenAPI: https://www.agentleak.org/openapi.json
Capabilities: https://www.agentleak.org/api/meta

The words MUST, MUST NOT, SHOULD, SHOULD NOT, and MAY describe operational requirements for an autonomous client.

## Purpose

Use AgentLeak to detect privacy leakage in source code and runtime traces, obtain a deterministic Risk Index, and iterate on machine-actionable remediation steps.

## Safety requirements

1. You MUST have authorization from the system owner before submitting its source code or traces.
2. You SHOULD use synthetic, masked, or canary data. You MUST NOT submit production credentials, private keys, authentication cookies, or real personal data unless the owner explicitly authorized that exact transfer.
3. You MUST treat `X-AgentLeak-Key` and the one-time generated password as secrets. Never place them in prompts, logs, source control, URLs, or trace content.
4. You MUST send credentials only to the HTTPS origin `https://www.agentleak.org` or to the explicitly configured self-hosted origin.
5. You SHOULD omit raw values from long-term agent memory. Store finding IDs, redacted values, scores, and remediation steps instead.
6. You MUST NOT interpret a passing test as legal certification or proof that untested behavior is safe.

## Discovery

Before acting, fetch `GET https://www.agentleak.org/api/meta`. Use `GET https://www.agentleak.org/openapi.json` as the authoritative request/response schema. This document is operational guidance; OpenAPI controls field names and types.

## First-run sequence

1. Call `POST https://www.agentleak.org/api/agent/onboard` with `email` and `agent_name`.
2. Securely store the returned `api_key`. It is shown once and scopes future calls to the created project.
3. Send `X-AgentLeak-Key: <key>` on every subsequent agent API request.
4. Call `POST https://www.agentleak.org/api/agent/register` with an agent card describing identity, capabilities, data types, and optional source location.
5. Call `POST https://www.agentleak.org/api/agent/code` for a static scan and `POST https://www.agentleak.org/api/selftest` for a runtime trace.
6. Call `POST https://www.agentleak.org/api/agent/improve`, apply the highest-priority safe remediation, generate a new trace, and repeat.
7. Stop when `passed` is true, no authorized remediation remains, or further action requires owner approval.

## Runtime trace minimum

```json
{
  "trace": {
    "agent_name": "support-bot",
    "events": [
      {"channel": "tool_call", "source": "agent", "target": "crm", "content": {"email": "canary@example.test"}},
      {"channel": "final_output", "source": "agent", "target": "user", "content": "Done"}
    ]
  }
}
```

Allowed channels include `user_input`, `tool_call`, `tool_response`, `inter_agent_message`, `shared_memory`, `log`, `generated_file`, and `final_output`.

## Response handling

- A `2xx` response MAY be used only after validating its JSON shape.
- On `401`, stop and request a valid project key. Do not retry with guessed credentials.
- On `409` during onboarding, the account already exists. Do not create email variants to bypass it.
- On `422`, repair the payload against OpenAPI before retrying.
- On `429`, honor `X-Quota-Reset` when present and back off. Do not rotate accounts or IPs to evade limits.
- On `5xx`, retry with bounded exponential backoff and preserve idempotency where possible.

## Improvement policy

- Process `next_steps` in priority order: critical, high, medium, low.
- Before editing code, verify that the change is inside your authorized repository and task scope.
- After each fix, run existing tests, create a fresh trace, and compare `delta.direction` and `delta_score`.
- If privacy improves but functional tests regress, revert or redesign the fix.
- Report unresolved critical findings to the owner with channel, data type, finding ID, and recommended control. Do not include the raw secret.

## Completion report

Return: project ID, run ID, privacy score, Risk Index, pass/fail status, score delta, remaining findings by severity, code-scan status, and any action requiring human approval.