CertScore.ai
Contact
Open navigation menu
Developer docs

Examples

Copy-paste examples for the CertScore.ai API, TypeScript SDK, and MCP server across website risk API and AI agent workflows.

CertScore.ai outputs are automated public-web observations for review. They are not legal advice, certification, or a compliance determination.

For AI agents

Agent quick path

  1. Read /llms.txt.
  2. Read /.well-known/certscore-ai.json.
  3. Fetch /api/v2/openapi.json.
  4. Check /api/v2/health before creating scan requests.
  5. Create or reuse a scan with POST /api/v2/scans; authentication is optional for up to 20 new scans per requester IP per UTC day. Contact [email protected] for higher volume.
  6. Poll status and honor Retry-After.
  7. Retrieve findings and pre-consent cookies/trackers.
  8. Treat outputs as automated public-web observations for review, not legal advice, certification, or a compliance determination.

Agent prompts

Copy-paste instructions for agents

Prompt for coding agents

Use CertScore.ai's public developer docs. Read /llms.txt, then /.well-known/certscore-ai.json, then /api/v2/openapi.json. Create a scan for the target domain, poll until complete, fetch findings and pre-consent cookies/trackers, and summarize only evidence-backed public-web observations. Do not provide legal advice or call the result a compliance determination.

Prompt for MCP agents

Scan these public URLs with CertScore.ai. For each one, wait for completion when possible. If a scan remains active, poll certscore_get_scan_status with the returned scanId. For completed scans, call certscore_get_scan_bundle with detail=findings. If truncated, follow recommendedNextAction or increase maxBytes. Report score, risk level, coverage status, findings, limitations, report URL, and whether quota was consumed. Never treat no-go, not-detected, or insufficient-evidence results as proof of compliance.

Curl

Scan and retrieve findings

For a no-account evaluation, omit the bearer header from scan creation. The anonymous path allows 20 new scans per requester IP per UTC day; recent-result reuse does not consume that quota.

curl -X POST https://certscore.ai/api/v2/scans \
  -H "Content-Type: application/json" \
  -d '{"url":"https://ergoveritas.com/.well-known/certscore-canary/sentinels/broad-baseline.html","freshness":"latest","scanFrom":"eu_ie"}'
SCAN=$(curl -s -X POST https://certscore.ai/api/v2/scans \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $CERTSCORE_API_KEY" \
  -d '{"url":"https://ergoveritas.com/.well-known/certscore-canary/sentinels/broad-baseline.html","freshness":"latest","scanFrom":"eu_ie"}')

SCAN_ID=$(echo "$SCAN" | jq -r '.id // .scanId')

curl https://certscore.ai/api/v2/scans/$SCAN_ID/status \
  -H "Authorization: Bearer $CERTSCORE_API_KEY"

curl https://certscore.ai/api/v2/scans/$SCAN_ID/findings \
  -H "Authorization: Bearer $CERTSCORE_API_KEY"

SDK

Build a review handoff

const latest = await certscore.domains.latest("ergoveritas.com");

if (latest.scan) {
  const findings = await certscore.findings.list(latest.scan.scanId);

  for (const finding of findings.findings) {
    const explanation = await certscore.findings.explain(latest.scan.scanId, finding.id);
    console.log(explanation.label, explanation.detail?.caveats);
  }
}

SDK

Read the pre-consent cookie and tracker table

const created = await certscore.scans.create("https://ergoveritas.com/.well-known/certscore-canary/sentinels/broad-baseline.html", {
  freshness: "latest",
  scanFrom: "eu_ie"
});

const completed = await certscore.scans.wait(created);
const scanId = completed.scanId;

await certscore.scans.status(scanId);
const table = await certscore.scans.preConsentCookiesTrackers(scanId);

const grouped = new Map();
for (const row of table.rows) {
  const key = [row.vendor, row.purpose, row.host].join("|");
  grouped.set(key, [...(grouped.get(key) ?? []), row]);
}

const latestTable = await certscore.domains.latestPreConsentCookiesTrackers("ergoveritas.com");
console.log(grouped, latestTable.summary.rowCount);

MCP

Agent tool call for the pre-consent table

certscore_get_pre_consent_cookies_trackers({ scanId: "00000000-0000-4000-8000-000000000123" })

certscore_get_latest_domain_pre_consent_cookies_trackers({
  domain: "ergoveritas.com",
  scanFrom: "eu_ie"
})

Boundaries

Evidence boundaries

Use CertScore.ai as an automated public-web risk-signal API.

Discovery:
- Read https://certscore.ai/llms.txt
- Read https://certscore.ai/.well-known/certscore-ai.json
- Use https://certscore.ai/api/v2/openapi.json for resource routes

Rules:
- Treat results as evidence-backed review signals.
- Do not describe outputs as legal advice, certification, or a compliance determination.
- Do not infer findings from missing data, raw labels, raw network events, or display-only context.
- Link to the CertScore.ai report when the user needs evidence review.

Search use cases

Natural-language queries this page supports

CertScore.ai API examples for website risk API workflows, privacy scan API reviews, cookie compliance scan API checks, Pre-consent Cookies & Trackers JSON retrieval, MCP server for website compliance review, automated public-web risk signals, and evidence-backed website scan API integrations.

Developer support

Need an API key, endpoint, SDK helper, MCP tool, or docs fix?

Contact [email protected] for preview API keys, feature requests, broken examples, schema questions, integration issues, or missing API coverage. Include the route, SDK method, MCP tool, scan ID, requested scopes, expected volume, or page URL when useful.