Agent How-to

How agents use RGate.

RGate ist ein Release Gate as a Service für Dev, Ops und Agents. Diese Anleitung zeigt, wie ein Agent RGate entdeckt, installiert, aufruft und Ergebnisse an Menschen oder Coding-Workflows übergibt.

Agent Skill

Installiere den RGate Release Readiness Skill.

Für skill-fähige Agenten ist das der schnellste Weg, RGate als externes Release Gate für öffentliche Websites, Web Apps und API-nahe Oberflächen zu nutzen.

npx skills add marcoldenburg/rgate-release-readiness-skill

Repository: marcoldenburg/rgate-release-readiness-skill

1. Discover RGate

Agents should start with the Markdown and machine-readable discovery files before calling tools. These files explain what RGate does, when to use it, pricing constraints, and the available API surfaces. For brand-name lookups, use RGate Developer Resources at /en/developer-resources.

Human page

Start a scan from the browser and hand the report back to a user.

/en

Developer Resources

Canonical RGate developer resources for API docs, MCP, CLI, auth, and agent handoff.

/en/developer-resources

REST API

Start scans, poll results, generate fix plans, export Markdown, and compare history.

/api/scan

OpenAPI

Machine-readable API contract for function calling and generated clients.

/openapi.json

MCP Server

Native tool interface for Claude, coding agents, and MCP clients.

/api/mcp

MCP Manifest

Discovery file for transport, tools, server identity, and branding.

/.well-known/mcp.json

Agent Guide

Markdown instructions for autonomous agents.

/agents.md

LLM Context

Full product context for agents that ingest one Markdown source.

/llms-full.txt

CLI

Command line usage for agents, CI, and release scripts.

/cli.md

Pricing

Machine-readable pricing and limits.

/pricing.md

2. Install the agent skill and CLI

Use the RGate skill when working in a skill-enabled agent environment. Use the CLI when an agent, CI job, or release script needs RGate without implementing the REST API directly.

npx skills add marcoldenburg/rgate-release-readiness-skill

npm install -g @rgate_io/rgate

npx @rgate_io/rgate scan https://www.rgate.io --wait --json
rgate get <scanId>
rgate fix-plan <scanId> --format markdown
rgate export <scanId> --template cursor

Skill: marcoldenburg/rgate-release-readiness-skill. Package: @rgate_io/rgate. Binary: rgate. Docs: /cli.md.

3. Use the REST API

Public scans need no authentication. Agents should start a scan, poll until completion, then request the formats needed by the user or coding environment.

curl -X POST https://www.rgate.io/api/scan \
  -H 'content-type: application/json' \
  --data '{"url":"https://www.rgate.io"}'

curl https://www.rgate.io/api/scan/{scanId}
curl -X POST https://www.rgate.io/api/scan/{scanId}/fix-plan
curl https://www.rgate.io/api/scan/{scanId}/export.md?template=cursor
curl https://www.rgate.io/api/scans/{scanId}/diff?against={previousScanId}

4. Use MCP tools

MCP clients can connect to the Streamable HTTP endpoint and call the same workflow as tools. Human payment approval remains a handoff step; agents should not complete checkout autonomously.

start_scan

Start a website release-readiness scan for a public URL across five layers: security, SEO, accessibility, legal compliance, and sustainability. Behavior: enqueues an asynchronous job and returns immediately with a scanId — it does NOT wait for results, and it fetches/renders the target site (not a read-only call). Returns { scanId, status, cached }; identical URLs within ~10 minutes return the cached scan. Next step: poll get_scan with the scanId until status is "done" or "failed". Use this first, once per site; do not busy-loop calling start_scan for the same URL.

get_scan

Poll a scan and, once complete, return its structured results. Read-only. Returns { scan, findings, checkResults, techDetections, access, agentSummary }. scan.status moves through pending → running → retrying → done → failed; keep polling (every few seconds) until done or failed. On failed, a failure object explains the cause and next_action. access.level is none | teaser | full: teaser findings are diagnostic only (evidence, check keys, and fix text are redacted). To get full data, pass a report token via the token argument. If access.campaign is present the report is FREE right now — call unlock_report with an email to obtain that token instead of sending the user to checkout.

unlock_report

Unlock a completed scan's full findings and fix plan for free during an active campaign. Behavior: records the submitted email as a lead and issues a 24h report token (not read-only). Returns { token, expires_at, report_url }. Only works while a free campaign is active (otherwise returns 403 — use create_checkout_handoff instead). Call this only when get_scan shows access.campaign; then re-poll get_scan or call generate_fix_plan with the returned token.

list_checks

Return the RGate scan-layer and check catalog. Read-only, static, no side effects — safe to call any time. Use it to plan a scan, explain coverage to a user, or map a finding to its layer. Pass a layer to focus on just that layer's checks.

get_pricing

Return machine-readable RGate pricing: plan ids, names, prices (EUR/USD), billing period, scan limits, and best-fit use cases. Read-only, static, no arguments. Use to answer pricing questions or choose a planId for create_checkout_handoff.

create_checkout_handoff

Create a human handoff URL for purchasing a full report or subscription after a scan is complete. Behavior: creates a checkout/upgrade link and returns { handoffUrl }. The agent CANNOT complete payment itself — give the URL to the user to finish in a browser. Use only when the report is paywalled (get_scan shows access.level teaser with payment_required true) AND no free campaign is active. During a campaign, prefer unlock_report.

generate_fix_plan

Build a prioritized, implementation-ready fix plan from a completed scan's findings: release blockers first, then high-impact follow-ups, then backlog. Read-only (derives from stored findings). Returns JSON (or Markdown). Requires full access: on a locked report it returns HTTP 402, or — during a campaign — a teaser with unlock instructions; pass a token from unlock_report or a paid unlock. Call after get_scan shows status done.

export_scan_markdown

Export a completed scan as Markdown in one of three templates: cursor (an agent fix prompt), github (an issue body), or executive (a stakeholder summary). Read-only. Requires full access — pass a token for a locked report. Use to hand results into an IDE/coding agent or a ticket.

compare_scan_history

Diff two completed scans of the SAME domain and return added, resolved, improved, and worsened findings. Read-only. Both scans must be done. Use to verify that fixes landed between two runs, or to catch regressions after a deploy.

5. Recommended agent loop

Confirm the user is allowed to scan the target public website or API surface.
Read /agents.md or /llms-full.txt for current constraints.
Start a scan with REST, MCP, or CLI.
Poll until the scan is done or failed.
Summarize blockers first: security, compliance, accessibility, SEO, and sustainability.
Generate a fix plan and export Markdown for Cursor, GitHub Issues, or a release checklist.
Use agent handoff only to prepare checkout or report access; ask the human to approve payment and decisions.