If you are an agent, start here.

End-to-end quickstart

The shortest path from nothing to a verified fix: discover, onboard, register, self-test, improve, then verify. Every step after discovery is a plain HTTP call authenticated with the key returned by onboarding — no browser session required.

# 1. Discover
curl -sS https://www.agentleak.org/llms.txt

# 2. Onboard (creates project + scoped key in one call)
curl -sS -X POST https://www.agentleak.org/api/agent/onboard \
  -H 'content-type: application/json' \
  -d '{"email":"[email protected]","agent_name":"SupportBot"}'

# 3. Register identity, capabilities and (optionally) source
curl -sS -X POST https://www.agentleak.org/api/agent/register -H "X-AgentLeak-Key: $AGENTLEAK_KEY" -d '{"agent_card":{"name":"support-bot"}}'

# 4. Self-test a trace
curl -sS -X POST https://www.agentleak.org/api/selftest -H "X-AgentLeak-Key: $AGENTLEAK_KEY" -d '{"trace":{...}}'

# 5. Apply the highest-priority next_step, then verify
curl -sS -X POST https://www.agentleak.org/api/agent/improve -H "X-AgentLeak-Key: $AGENTLEAK_KEY" -d '{"trace":{...}}'

Static source review and adversarial batch generation are available the same way: see static code scan and adversarial red-team for the request shapes.

Operating rules

1. MUSTHave owner authorization before sending source code or traces.
2. SHOULDUse synthetic, masked or canary values.
3. MUST NOTSend production credentials or real personal data without explicit authorization.
4. MUSTKeep the project key out of prompts, logs, URLs, source control and trace content.
5. MUSTFollow highest-priority next_steps first, unless they require human approval.
6. MUST NOTTreat a passing trace as universal safety or legal certification.

Read normative agent instructions

Improvement loop

curl -sS -X POST https://www.agentleak.org/api/agent/onboard \
  -H 'content-type: application/json' \
  -d '{"email":"[email protected]","agent_name":"SupportBot"}'

Store the returned api_key securely. Send it as X-AgentLeak-Key on every later agent request.

Register identity and source

Register an agent card before scanning or improving. Include the agent name, capabilities, declared data types and optional source location. AgentLeak accepts simple cards and well-known Agent Card shapes used by A2A-style ecosystems.

curl -sS -X POST https://www.agentleak.org/api/agent/register \
  -H "X-AgentLeak-Key: $AGENTLEAK_KEY" \
  -H 'content-type: application/json' \
  -d '{
    "agent_card": {
      "name": "support-bot",
      "capabilities": ["ticket_triage", "crm_lookup"],
      "privacy": {"declared_data_types": ["email", "phone_number"]},
      "source": {"type": "github", "repo": "acme/support-bot"}
    }
  }'

Failure handling

AgentLeak REST binding

The well-known Agent Card declares a custom HTTP+JSON binding identified by this section. AgentLeak does not expose the standard A2A message/task transport. Use OpenAPI for request and response schemas, and use this page for the intended operating flow.

Completion report

Return the project ID, run ID, privacy score, Risk Index, pass/fail status, delta, remaining findings by severity, code-scan status and actions that still require human approval. Never include raw secrets.