Agent audit developer docs
Read a stored report with GET /api/v1/agentic/report?url=example.com. Accept: text/markdown returns Markdown. POST /api/agentic/scan with {"url":"example.com"} starts or reuses an Ora audit; force:true requests a fresh scan. Scans share Ora quotas. A 404 means no stored report; 429 means honor Retry-After; 503 means temporarily unavailable. Open /agentic to scan. MCP is read-only and never starts scans or journeys.
Scoring
Lightmark agent audits use Ora Essentials: essential checks share 80 points, applicable recommended checks share 20, and optional bonus signals add at most 5. Not-applicable checks are excluded. The score is separate from the Lightmark website diagnosis. Journeys are supporting evidence, never numeric score inputs. Partial analysis is provisional. Cached reports retain their original scan timestamp.
Verbose scans
The scan UI displays real Ora progress events by default. POST /api/agentic/scan with Accept: text/event-stream receives SSE messages: progress (event), result (report), or error (detail and optional retryAfter). A cached scan skips individual checks. Interrupted streams do not automatically start another scan; read the stored report to recover. CLI scans support --verbose with progress on stderr.
Read a report
curl "https://www.lightmark.app/api/v1/agentic/report?url=example.com" curl -H "Accept: text/markdown" "https://www.lightmark.app/api/v1/agentic/report?url=example.com"
CLI
From the Lightmark checkout:
npm run audit:agentic -- example.com --json npm run audit:agentic -- example.com --scan npm run audit:agentic -- example.com --force
MCP
Connect a Streamable HTTP client to https://www.lightmark.app/mcp. Supports protocol revisions 2025-03-26, 2025-06-18 and 2025-11-25. Three read-only tools expose the report, methodology, and docs. No session or API key is required. Tools return text and structuredContent. MCP Apps hosts can load the interactive scorecard via resources/read. Stateless GET event streams are not offered.
Provider configuration
Audits work with Ora’s shared keyless quota. Operators can set a server-only ORA_SCAN_API_KEY issued by Ora. Observed journeys use public curated tasks for understanding the product, finding API docs, or finding pricing. No partner key is needed. Custom free-text tasks are not exposed. Keys are never sent to the browser. Journeys are started only by the journey button.
Latest reports are stored by Ora. Completed scans started through Lightmark are also saved in the configured DATABASE_URL database. Read the latest 20 saved snapshots at /api/v1/agentic/history?url=example.com. History failures are shown without discarding provider evidence. Shared report URLs also accept text/markdown. Share links read the latest available report; they do not initiate scans. A partial or stuck report is labeled explicitly.