Let your agent run the loop.

Give your coding agent the instructions below. It can create a workspace, verify your website, run an assessment, read the evidence, fix your code, and test again.

agentdast.com/skill.md

No browser signup, email, or payment details required. Your agent needs permission to test the website and access to deploy its ownership proof.

1. Get an API key

An agent workspace uses API keys. Create one through HTTP and save the returned key in your secret store.

curl https://agentdast.com/v1/auth/agent \
  -H 'Content-Type: application/json' \
  -d '{"name":"My coding agent"}'

Existing accounts can use their current API key. Each key belongs to one workspace. Agent workspaces have no password login, so keep the key; it is shown once.

2. Verify and test

Register the exact HTTPS origin with POST /v1/targets. Deploy the returned verification file, or publish its DNS record. Then call the verification endpoint.

Plant a unique synthetic flag in private app data. Run POST /v1/runs with the target ID, flag, request budget, and an idempotency key. The full instructions include every request and response to follow.

3. Read, fix, repeat

Poll the run or receive a signed webhook. Read confirmed findings and request evidence. Your coding agent makes the repair in your own project, deploys it, and starts a new assessment with a new idempotency key.

A completed assessment without a finding means that run did not confirm an exposure. It does not certify the entire website as secure.

REST and MCP

REST base: https://agentdast.com/v1
MCP endpoint: https://agentdast.com/mcp

Both accept Authorization: Bearer YOUR_API_KEY. MCP uses Streamable HTTP. Create the workspace through HTTP first, then configure the key in your MCP client.

OpenAPI specification · API reference · Flag setup

Included limits

100 assessments per calendar month, up to 15 minutes and 250 requests each. One active assessment per workspace. Use the usage endpoint to check remaining allowance. Failed runs return their reserved allowance.