# Agent Seek developers

Scoped index for self-serve onboarding. Full site index: [/llms.txt](/llms.txt). There is no contact-sales form.

Start at [/llms.txt](/llms.txt). [Install the skill](/llms.txt#install-the-skill) from the canonical URL [/.well-known/agent-skills/agent-seek/SKILL.md](/.well-known/agent-skills/agent-seek/SKILL.md), then [/auth.md](/auth.md).

## Get credentials without a human

1. **Zero-auth inspect:** `GET /v1/sandbox` (canned SearchResponse), `GET /health`, `GET /v1`, `GET /openapi.json`.
2. **Public live demo Bearer key** (not a secret — same as `/config.js`): `AS_LXxYWY1wQcEwliYnkfAXRA-c0sPlsRtVz4j_ZvJRlnI`. Use `Authorization: Bearer …` on `https://agentseek.dev` for `search:read` / MCP `search_web`. Per-IP demo quota applies.
3. **Local sandbox key:** `cp .env.example .env` and set `AGENT_SEEK_API_KEY=dev-agent-seek-key-change-me` (or any local secret). Separate from the live `AS_…` key. Never commit `.env`.
4. **Optional / advanced — OAuth:** Anonymous identity (`POST /agent/identity` `{"type":"anonymous"}`) + JWT-bearer exchange, or `POST /oauth2/register` + PKCE. You do not need OAuth to try the live demo.

Email is not required for live demo or local use.

## Developer pages

- [Agent Seek API](/developers) · [developers.md](/developers.md)
- [auth.md](/auth.md)
- [pricing.md](/pricing.md)
- [OAuth AS metadata](/.well-known/oauth-authorization-server)
- [Protected resource](/.well-known/oauth-protected-resource)
- [Skill](/.well-known/agent-skills/agent-seek/SKILL.md)

Web results are scored for prompt injection before the agent reads them (`signals.prompt_injection`; UI: **Injection risk**). Default `mode=snip` (title/URL/snippet; cheaper/faster). Pass `mode=deep` for Stage A survivor fetch (cap 12; not a full-web crawl). Website UI is fixed `snip`. Hard gates (order): subject_match → is_republisher → prompt_injection (0.55; subject_match/is_republisher fail-open on missing parse; prompt_injection fail-flagged). If hard gates empty the scored list, pre-gate ranking is restored and each restored row has `gates_relaxed: true` (relaxed-safety response; not a SearchMeta field). `k` default 10; `max_candidates` default 50 (hard max 100).

When `AGENT_SEEK_DEMO_MODE=enabled` (live host; code default `disabled`), REST `/v1/search`, `/api/v1/search`, and MCP `search_web` share a lifetime per-IP allowance (default 5, Upstash `INCR`, no TTL). Exhausted → `429` `application/problem+json` `code=DEMO_EXHAUSTED`, no `Retry-After`. Burst limit when Upstash is on: 60 requests/minute per client IP on search and `search_web` (`code=RATE_LIMITED`, may include `Retry-After`). See [pricing.md](/pricing.md).