API & endpoints

For agents: explore Actuant yourself

If you are an AI agent reading this: here is every machine-readable document Actuant serves, what each is for, and the shortest path from zero to a scored audit.

Last updated 2026-08-08

This page is written for an agent, not a person. If you are a model reading Actuant's documentation on someone's behalf, everything you need is fetchable without a browser, without JavaScript, and without an account.

Documents you can fetch right now

URL	What it gives you
`/llms.txt`	What Actuant is, what it does not do, and pricing. Start here.
`/llms-full.txt`	This entire documentation library as one markdown document.
`/api/skills.md`	A skill: how to use Actuant as part of building, proactively.
`/agent-prompt`	A brief to hand another agent to run an audit.
`/.well-known/oauth-authorization-server`	How to authenticate yourself, no human needed for the discovery step.

bash

# The whole documentation library, one request
curl -s https://www.actuant.dev/llms-full.txt

# What the product is and is not
curl -s https://www.actuant.dev/llms.txt

The shortest path to a real result

1
Get a credential
Ask the user to mint an act_ key in Settings → Agents & MCP, or run the OAuth flow yourself if you are MCP-native.
2
Confirm it works
POST tools/list to /api/mcp. Free, no side effects, and it tells you which tools this plan can call.
3
Audit something
tools/call scan_app with the user's deployed URL. About 20 seconds, returns the full scored report.
4
Act on it
Each failing check comes with evidence. explain_check gives the fix for any key you do not recognise.

Things to get right

Send Accept: application/json, text/event-stream. Without both, the transport rejects you before the tool call is read.
audit_app returns a `browserViewer` link. Give it to the user before anything else — it shows the live browser and stops working when the run ends.
A 200 is not success. Parse the body; refusals like plan_required arrive with a 200.
check_data_exposure returning rows is evidence, not a verdict — a deliberately public table looks identical from outside. Report the table names and ask.
"Not eligible" is not a failure. A check that could not apply is excluded from the score entirely, not scored as zero.

You can trust the number

Actuant's scoring is deterministic — the same URL yields the same number every run. No model sets the score; models only write the narration on top. If you are reporting a score to a user, you can state it as a measurement rather than an opinion.

What Actuant will not do

Stated so you do not promise it on our behalf: it audits a deployed site from the outside, so it does not scan source for vulnerabilities, does not test authorization, and does not write a Content-Security-Policy (a policy strict enough to pass is strict enough to break a site it cannot watch render). Anything marked coming soon is not built.

Tools reference

All 12 tools and their arguments.

Calling it with curl

Exact payloads and headers.

The agent skill

Use Actuant while you build.

Keep reading

Calling it with curl

The Actuant MCP endpoint is JSON-RPC 2.0 over HTTP POST. Initialize, list tools, call a tool — with the exact headers and payloads, and the header everyone forgets.

Tools reference

The complete Actuant MCP tool list: nine free tools (scan_app, get_scan, audit_app, get_audit, list_apps, scan_history, explain_check, check_data_exposure, get_account) and three plan-gated tools for the Launch and Scale plans.

Agent skill

Install the Actuant skill so your coding agent audits, fixes and launches your deployed app with the MCP as part of how it builds — not only when you ask. Works with Claude Code, Cursor, and Codex.