Discoverable by machines
A machine-readable llms.txt and an A2A agent card let an agent find AgentLeak and learn how to use it without a human.
- /llms.txt discovery
- /.well-known/agent-card.json
- OpenAPI at /openapi.json
- One-call onboarding
Built for autonomous agents
Agents can discover, test and fix themselves.
llms.txt discovery, one-call onboarding, scoped project keys and machine-readable remediation hints. An agent can find AgentLeak, audit itself and fix its own leaks in a bounded loop, with no browser and no human in the middle.
Self-test in one call
An agent submits its own trace and gets back a full report: passed, compliant, failed frameworks and the exact remediation hints.
- POST /api/selftest
- Scoped project API keys
- Compliance verdict per framework
- Structured, actionable hints
A bounded improvement loop
The improve endpoint returns a delta versus the previous run and priority-sorted next steps, so an agent can converge on a clean score safely.
- POST /api/agent/improve
- Delta versus the previous run
- Priority-sorted next steps
- Generous free quota for agents
Inside the capability
Three views of how it works.
Agents find the contract themselves
Expose llms.txt, the agent card and OpenAPI as stable entry points with no dashboard interpretation required.
Limit every autonomous action
Issue project-bound credentials with explicit test, scan and improve scopes rather than broad account access.
One fix, one re-test, one delta
Return one structured action, verify the same scenario and stop when policy passes or the iteration budget ends.
The mental model
Privacy testing can be part of an agent's own control loop.
AgentLeak exposes discovery, onboarding, testing and remediation as machine-readable contracts. A capable agent does not need to interpret a dashboard: it submits a trace, receives bounded actions, applies one change and verifies the same scenario again.
Before
A human notices a leak, translates the report and asks for a fix.
With AgentLeak
The agent consumes structured evidence and proves the fix itself.
- Scoped credentials limit what an autonomous client can access
- Remediation hints name one channel and one concrete action
- Each iteration reports a score delta so improvement is measurable
How it works
From raw trace to a fix, in four steps.
1
Discover
An agent reads /llms.txt or /.well-known/agent-card.json to learn the API surface with no human in the loop.
2
Onboard
One call to /api/agent/onboard creates a scoped project key with a free monthly quota, ready to use immediately.
3
Self-test
POST /api/selftest with its own trace and get back findings, a compliance verdict and structured remediation hints.
4
Improve and loop
POST /api/agent/improve to get a delta versus the previous run and priority-sorted next steps, then repeat until clean.
Onboard an agent in one call
curl -sX POST https://www.agentleak.org/api/agent/onboard \
-H 'content-type: application/json' \
-d '{"email":"agent@example.com","agent_name":"SupportBot"}'FAQ
Questions, answered.
Ready when you are
Test the path, not only the answer.
Create a local workspace, run a bundled scenario, then wire AgentLeak into CI or let your agent onboard itself.