{"name":"CertScore AI and API discovery","version":"2026-09-03","type":"certscore_ai_discovery","description":"Vendor-neutral discovery document for CertScore public API, SDK, MCP, OpenAPI, and agent-readable documentation.","corePositioning":"Scan cookies, trackers, session-replay signals, CMPs, consent, privacy policy, GDPR, CCPA, and TLS with CertScore.ai.","homepage":"https://certscore.ai/","organization":{"name":"CertScore.ai","url":"https://certscore.ai","supportEmail":"support@certscore.ai","supportUrl":"https://certscore.ai/contact","trustUrl":"https://certscore.ai/trust","termsUrl":"https://certscore.ai/terms","privacyUrl":"https://certscore.ai/privacy"},"posture":{"summary":"CertScore outputs are automated public-web observations for human and agentic review. They are not legal advice, certification, or a compliance determination.","allowedUse":"Use public API and documentation outputs as evidence-backed review signals with human and agentic review. Do not represent CertScore output as a legal conclusion.","canonicalFlow":"WS01 observed evidence -> WC01 normalized concern -> WC01 concern policy -> WC01 unified finding/checklist projection -> executive/regulatory display."},"capabilities":{"choicePathResults":["postAcceptObservation","postRefusalObservation","gpcResponse"],"interpretation":"Accept is a score-neutral comparison baseline. Accept and Reject afterAction summaries retain observed click and capture facts independently of consent registration. Reject findings require canonical qualifying evidence: confirmed refusal with eligible activity, or a completed Reject click with independently verified tracking evidence under the Reject-click review policy. GPC v3 observation completion is separate from the paired comparison and does not mean GPC was honored. Scoring and legal interpretation remain downstream in concern policy."},"aiDiscovery":{"conciseGuide":"https://certscore.ai/llms.txt","fullGuide":"https://certscore.ai/llms-full.txt","developerHub":"https://certscore.ai/developers","scannerSolutions":"https://certscore.ai/solutions","sitemap":"https://certscore.ai/sitemap.xml","trustCenter":"https://certscore.ai/trust","robots":"https://certscore.ai/robots.txt"},"scannerSolutions":{"hub":"https://certscore.ai/solutions","gdprWebsiteComplianceScanner":"https://certscore.ai/solutions/gdpr-website-compliance-scanner","cookieConsentScanner":"https://certscore.ai/solutions/cookie-consent-scanner","privacyPolicyRiskScanner":"https://certscore.ai/solutions/privacy-policy-risk-scanner","posture":"Scanner solution pages describe public website review workflows and automated risk signals. CertScore outputs are automated public-web observations for human and agentic review. They are not legal advice, certification, or a compliance determination."},"developerDocs":{"hub":"https://certscore.ai/developers","quickstart":"https://certscore.ai/developers/quickstart","reference":"https://certscore.ai/developers/reference","sdk":"https://certscore.ai/developers/sdk","mcp":"https://certscore.ai/developers/mcp","examples":"https://certscore.ai/developers/examples","agentQuickstart":"https://certscore.ai/developers#agent-quickstart","completeCurlWorkflow":"https://certscore.ai/developers/quickstart#complete-curl-workflow","genericAgentInstructions":"https://certscore.ai/developers/examples#generic-agent-instructions","mcpAgentWorkflow":"https://certscore.ai/developers/examples#mcp-agent-workflow","evidenceBoundaries":"https://certscore.ai/developers/examples#evidence-boundaries","preConsentCookiesTrackersExample":"https://certscore.ai/developers/examples#pre-consent-cookies-trackers-json"},"api":{"v2Health":"https://certscore.ai/api/v2/health","v2Openapi":"https://certscore.ai/api/v2/openapi.json","v2AuthCheck":"https://certscore.ai/api/v2/auth/check","v2RequestReadOnlyKey":"https://certscore.ai/api/v2/keys/request","v2CreateScan":"https://certscore.ai/api/v2/scans","anonymousAgentScan":{"method":"POST","route":"https://certscore.ai/api/v2/scans","authentication":"none","dailyNewScanLimit":20,"limitKey":"requester_ip_utc_day","recentReuseDoesNotConsumeQuota":true,"statusRoute":"https://certscore.ai/api/v2/scans/{scanId}/status","findingsRoute":"https://certscore.ai/api/v2/scans/{scanId}/findings","intendedUse":"Low-volume agent discovery, evaluation, and public-web review workflows."},"v2Scan":"https://certscore.ai/api/v2/scans/{scanId}","v2ScanStatus":"https://certscore.ai/api/v2/scans/{scanId}/status","v2ScanFindings":"https://certscore.ai/api/v2/scans/{scanId}/findings","v2ScanFinding":"https://certscore.ai/api/v2/scans/{scanId}/findings/{findingId}","v2ScanPreConsentCookiesTrackers":"https://certscore.ai/api/v2/scans/{scanId}/pre-consent-cookies-trackers","v2DomainLatest":"https://certscore.ai/api/v2/domains/{domain}/latest","v2DomainLatestPreConsentCookiesTrackers":"https://certscore.ai/api/v2/domains/{domain}/latest/pre-consent-cookies-trackers","docs":"https://certscore.ai/developers/reference"},"sdk":{"docs":"https://certscore.ai/developers/sdk","repositoryPath":"packages/certscore-sdk","distribution":"npm","status":"published","package":"@certscore/sdk","currentVersion":"0.2.14","install":"npm install @certscore/sdk@0.2.14"},"mcp":{"distribution":"homebrew","binary":"certscore-mcp","packageStatus":"homebrew_developer_preview","currentVersion":"0.2.23","docs":"https://certscore.ai/developers/mcp","repositoryPath":"packages/certscore-mcp","install":"brew tap ergoveritas1-alt/certscore https://github.com/ergoveritas1-alt/certscore.ai && brew install --cask certscore-mcp","verify":["certscore-mcp --version","certscore-mcp --help","CERTSCORE_API_KEY=<token> certscore-mcp doctor","CERTSCORE_API_KEY=<token> certscore-mcp doctor --check-auth"],"transport":"stdio","hosted":{"transport":"streamable_http","endpoint":"https://mcp.certscore.ai/mcp","protectedResourceMetadata":"https://mcp.certscore.ai/.well-known/oauth-protected-resource","authorizationServerMetadata":"https://certscore.ai/.well-known/oauth-authorization-server","authentication":"OAuth 2.0 authorization code with PKCE","currentVersion":"0.2.26","claudeTrialScanCreation":{"automatic":true,"eligiblePlan":"free","eligiblePlanStatus":"active","hourlyNewScanLimit":20,"dailyNewScanLimit":100,"recentReuseDoesNotConsumeQuota":true}},"light":{"name":"CertScore.ai MCP Light","registryName":"ai.certscore/mcp-light","shortDescription":"Free website privacy scanner to detect pre-consent cookies and trackers, CMP and consent controls, privacy policy, GDPR/ePrivacy and CCPA, and HTTPS/TLS signals.","longDescription":"Free website privacy scanner and cookie checker for public websites. Detect pre-consent cookies and trackers, third-party tracking technologies, cookie banners, CMP and consent-management signals, eligible Accept and Reject Path observations with their coverage state, privacy-policy and transparency findings, GDPR/ePrivacy and CCPA/CPRA review signals, and HTTPS/TLS transport observations. Accept is a score-neutral comparison baseline; Reject can support a finding after confirmed refusal with qualifying retained evidence, or a completed Reject click with independently verified tracking evidence. After-click observations remain useful when consent registration is unconfirmed. Give CertScore.ai a public website to collect structured, evidence-backed privacy findings for launch review, vendor review, audit triage, or human compliance review. Results include a CertScore score and supporting evidence for human and agentic review; they are not legal advice, certification, or a compliance determination.","landingPage":"https://certscore.ai/mcp/light","registryListing":"https://registry.modelcontextprotocol.io/?q=ai.certscore%2Fmcp-light","registryApiLookup":"https://registry.modelcontextprotocol.io/v0.1/servers?search=ai.certscore%2Fmcp-light","registryStatus":"active","registryLatest":true,"directoryListing":"https://smithery.ai/server/ben-qe1c/certscore-ai","transport":"streamable_http","endpoint":"https://mcp.certscore.ai/mcp/light","authentication":"none","dailyNewScanLimit":200,"limitKey":"public_light_surface_utc_day_with_session_and_ip_limits","rollingNewScanLimit":60,"rollingWindowSeconds":600,"newScanPolicy":{"burstWindowSeconds":600,"concurrencyRetryAfterSeconds":15,"concurrencyLeaseSeconds":900,"session":{"burstLimit":20,"dailyLimit":60},"ip":{"burstLimit":30,"dailyLimit":100},"surface":{"burstLimit":60,"dailyLimit":200},"concurrency":{"session":4,"ip":8,"surface":20}},"quotaDocumentation":"https://certscore.ai/developers/mcp#light-usage-limits","recentReuseDoesNotConsumeQuota":true,"privacyUrl":"https://certscore.ai/privacy","termsUrl":"https://certscore.ai/terms","supportUrl":"https://certscore.ai/contact","iconUrl":"https://certscore.ai/certscore-mark-dark.png","darkBackgroundIconUrl":"https://certscore.ai/certscore-mark-light.png","clineMarketplaceIconUrl":"https://certscore.ai/images/mcp-directory/certscore-mcp-light-cline-400.png","version":"0.2.26","tools":["certscore_scan_site","certscore_get_scan_status","certscore_get_scan_bundle","certscore_get_report_evidence_page"],"prompts":["certscore_launch_review","certscore_compare_scans","certscore_remediation_checklist"],"resources":["certscore://project-instructions","certscore://example-report"],"reportEvidenceSections":["consent","gpc","policy","tracking","transport","forms"],"intendedUse":"Frictionless no-account public website scans for new and low-volume agents."},"anonymous":{"transport":"streamable_http","endpoint":"https://mcp.certscore.ai/mcp/anonymous","authentication":"none","dailyNewScanLimit":20,"limitKey":"requester_ip_utc_day","recentReuseDoesNotConsumeQuota":true,"intendedUse":"Low-volume agent discovery, evaluation, and public-web review workflows without account or OAuth setup."},"currentTools":["certscore_get_connection_status","certscore_get_report_evidence_page","certscore_scan_site","certscore_get_scan","certscore_get_scan_status","certscore_get_report","certscore_get_evidence","certscore_get_scan_bundle","certscore_export_findings","certscore_list_findings","certscore_get_pre_consent_cookies_trackers","certscore_explain_finding","certscore_get_latest_domain_scan","certscore_get_latest_domain_pre_consent_cookies_trackers"]},"recommendedAgentWorkflow":[{"step":"health_check","request":"GET https://certscore.ai/api/v2/health"},{"step":"api_v2_contract_check","request":"GET https://certscore.ai/api/v2/openapi.json"},{"step":"scan_or_reuse_latest","request":"POST https://certscore.ai/api/v2/scans"},{"step":"poll_if_pending","request":"GET https://certscore.ai/api/v2/scans/{scanId}/status"},{"step":"retrieve_public_safe_findings","request":"GET https://certscore.ai/api/v2/scans/{scanId}/findings"},{"step":"retrieve_pre_consent_cookies_trackers_table","request":"GET https://certscore.ai/api/v2/scans/{scanId}/pre-consent-cookies-trackers"}],"searchableTopics":["CertScore API","GDPR website compliance scanner","cookie consent scanner","CMP and consent scanner","CCPA website privacy scanner","website TLS scanner","privacy policy risk scanner","website risk API","privacy scan API","cookie compliance scan API","Cookies & Trackers (Pre-consent) JSON","MCP server for website compliance review","automated public-web risk signals","evidence-backed website scan API"],"responseFormats":["application/json","text/markdown"],"authentication":{"summary":"Low-volume agents can create scans without an account or credential at 20 new scans per requester IP per UTC day. Bearer API keys are supported for scoped API, SDK, and MCP integrations. Read-only + MCP keys are self-serve for signed-in verified users. Active Trial workspaces connecting through Claude receive bounded hosted OAuth scan:create automatically; other integrations remain grant-gated.","accessStatus":"read_only_self_serve_scan_create_request","selfServeReadOnly":{"route":"https://certscore.ai/api/v2/keys/request","method":"POST","requirements":["signed_in_dashboard_session","verified_email","non_disposable_email"],"issuedScopes":["scan:read","mcp"],"tokenPrefix":"cs_ro_","expiresInDays":90,"rateLimits":{"requestsPerMinute":60,"scanReadsPerDay":500}},"requestEmail":"support@certscore.ai","requestInstructions":"Use /api/v2/keys/request for read-only + MCP access. Active Trial workspaces connecting through Claude receive hosted OAuth scan:create automatically at 20 new scans per hour and 100 per day per workspace. Other integrations can email support@certscore.ai with organization, integration type, expected request volume, contact email, and requested scopes for scan:create.","header":"Authorization: Bearer <token>","docs":"https://certscore.ai/developers/quickstart","currentScopes":["scan:read","scan:create","mcp"],"recommendedScopes":{"restReadOnly":["scan:read"],"restScanCreation":["scan:read","scan:create"],"typescriptSdk":["scan:read","scan:create"],"mcp":["scan:read","scan:create","mcp"]}},"rateLimits":{"docs":"https://certscore.ai/developers/reference","readPolicy":{"policyVersion":"2026-09-12","windowSemantics":"rolling","unitWeights":{"ordinary":1,"report_page":1,"evidence":4,"full":4,"diagnostics":4,"export":4,"bundle":4},"profiles":{"terminal":{"windows":[{"id":"burst","windowSeconds":600,"limits":{"callerTarget":120,"target":4000,"caller":480},"mcpProviderLimit":8000},{"id":"daily","windowSeconds":86400,"limits":{"callerTarget":1200},"mcpProviderLimit":40000}]},"status":{"windows":[{"id":"burst","windowSeconds":600,"limits":{"callerTarget":120,"target":10000,"caller":600},"mcpProviderLimit":20000}]}},"scopeDefinitions":{"callerTarget":"One authenticated caller or anonymous requester identity retrieving one scan or domain resource.","target":"One scan or domain resource across all callers.","caller":"One authenticated caller or anonymous requester identity across resources."},"throttledResponse":{"status":429,"retryHeader":"Retry-After","instruction":"Wait for Retry-After before retrying. Do not poll terminal scan resources."}},"retryAfter":"HTTP 202 pending responses and HTTP 429 throttled responses may include Retry-After. Agents and SDKs should honor Retry-After rather than tight polling."},"support":{"email":"support@certscore.ai","url":"https://certscore.ai/contact","terms":"https://certscore.ai/terms","privacy":"https://certscore.ai/privacy"},"caveats":["Results may be incomplete or contain errors.","Absence of findings must not be treated as proof of compliance.","Full raw scanner artifacts are not exposed by public API or MCP surfaces.","Some agent fetch tools may fail before receiving HTTP status or CertScore diagnostic headers; use API v2 health, llms.txt, and this manifest for fallback discovery."]}