The audit, from your code or your agent

Authentication

Every call carries your key as a bearer token. Keys start with ca_live_, are shown once when created, and can be revoked on your account page. They are for servers and tools, not for browsers: there is no CORS on the API.

Authorization: Bearer ca_live_…

Endpoints

Example

curl -X POST https://audit.crocky.host/api/v1/scan \
  -H "Authorization: Bearer ca_live_…" -H "Content-Type: application/json" \
  -d '{"url":"https://example.com"}'
# {"id":"3cfd…","status":"pending","cached":false,"result_url":"…/api/v1/scan/3cfd…","report_url":"…/report/3cfd…"}

curl -H "Authorization: Bearer ca_live_…" https://audit.crocky.host/api/v1/scan/3cfd…
# {"id":"3cfd…","status":"done","scores":{"performance":62,"seo":88,"security":74,"hosting":91,"accessibility":95,"overall":79},
#  "provenance":{"band":"LIKELY","probability":81,"tools":[],"tells":["E36","E03","E17"],"anti_tells":[],
#                "axes":{"discipline":54,"provenance":71},"lineage":{"tier_a":[],"tier_b":["…"]},
#                "legal":"Automated estimate from public signals - not a statement of fact about a site or its authors."},
#  "findings":[{"category":"security","severity":"high","title":"No Content-Security-Policy header", …}],
#  "checks":{"total":{"ran":310,"hit":29,"pass":281,"review":0,"na":75,"skip":0},"by_category":{"security":{…}, …},
#            "rows":[{"id":"chk:hdr_hsts","category":"security","name":"Strict-Transport-Security (HSTS) header","state":"found","severity":"high"},
#                    {"id":"path:/.env","category":"security","name":"/.env","state":"passed"}, …]}, …}

Verdict bands

CONFIRMED (a build artefact names the tool), LIKELY (with a confidence number), POSSIBLE (capped, no number: designers use the same kits), NONE (no evidence found; wrong about one time in twelve), UNMEASURED (could not fetch or render). The API never says a site is human-made. Error rates and what each band means are on the AI slop page.

How the check works

Every check, not only the findings

Each result also carries checks: every test the audit ran, with its state (passed, found, needs_review, not_applicable, not_run), a severity where it found something, and the reason where it did not apply or did not run. Findings list only what a check found; checks also list what came back clean, so you can tell "checked and fine" from "never checked". Counts per category come with every result, the rows with the full one.

MCP server

The same key works on an MCP server at /api/mcp (Streamable HTTP, stateless JSON, no SSE). Two tools: check_site with a URL returns the verdict with evidence when a result younger than 7 days exists, otherwise it queues a scan and tells the model to call get_result with the id after 20 seconds.

claude mcp add --transport http crocky-audit https://audit.crocky.host/api/mcp \
  --header "Authorization: Bearer ca_live_…"

{ "mcpServers": { "crocky-audit": {
    "url": "https://audit.crocky.host/api/mcp",
    "headers": { "Authorization": "Bearer ca_live_…" } } } }

Webhooks

Pass webhook_url on a scan and we POST the evidence JSON once when it finishes, with X-Crocky-Event: scan.completed and X-Crocky-Signature: sha256=… (HMAC-SHA256 of the body with the signing secret shown on your account page). Three-second budget, no retries.

Plans

Every key is limited to 60 requests a minute. To move to a paid plan, write to audit@crocky.host; self-service billing comes later.

Errors

Automated estimate from public signals, not a statement of fact about a site or its authors.