Rent an Agent · live beta
Security Audit Agent
A passive security check of your website (and optionally a public repo), with a prioritized report and copy-paste fixes.
Site-ownership check: before any scan
- Only audit a site or repo you own or are authorized to test. Every request has to confirm ownership (
confirm_owner: true). - To mark the report verified, publish
/.well-known/teachmyagent-verify.txtcontainingtma-verify-…. The token is unique to your domain, and the audit tells you the exact value. Without that file, the report says self-attested. - The scan is passive and low-volume: a fixed list of read-only GET/HEAD requests, no exploits or logins, and private or internal addresses are blocked. A check that fails shows as incomplete / couldn't check, never clean.
What it does
- Checks HTTPS, the TLS certificate and protocol, and the HTTP→HTTPS redirect
- Reviews security headers: HSTS, CSP, nosniff, clickjacking, Referrer- and Permissions-Policy, version leaks
- Checks cookies for Secure, HttpOnly and SameSite
- Finds mixed content and forms that submit over HTTP
- Looks for exposed sensitive files (.env, .git, backups, phpinfo, server-status) using content signatures
- Public repo: looks up npm dependency advisories (OSV) and checks for a committed .env
Access it needs (least privilege)
| What | How | Never |
|---|---|---|
| Your site URL | Public URL only. You confirm you own it, or optionally prove it with a token file at /.well-known/teachmyagent-verify.txt. | No logins, passwords or admin access. |
| Public repo (optional) | owner/name of a PUBLIC GitHub repo | No GitHub token. Private repos are not supported yet. |
Schedule & deliverable
Schedule: On demand, or weekly on the monthly plan
You get: An HTML and Markdown report: score, severity-ranked findings, evidence and fix steps, plus a change diff vs last week (monthly plan)
Sample report
View a real sample report (a passive scan of example.com) →
Plan
- One-off audit: $0 for the beta (keyed) (early pricing: placeholder, may change)
- Monthly watch: $29/mo (early pricing: placeholder, may change)
Limits & safety
- Passive only: no exploitation, fuzzing, brute force or form submission
- About 30 requests per audit, 8s timeout each, ~150ms between requests
- 3 audits per requester and 2 per site per 10 minutes
- Private or internal IP addresses are never scanned
Upgrade: own it instead
Install the Security Audit track (/skills/security-audit). Your own agent then runs the same checks plus a deeper code audit inside your repo. Skill track →
Agents & API: run_security_audit(url, repo?, confirm_owner) over MCP or POST /api/v1/rent/security-audit (API key).