Agent How-to

How agents use RGate.

RGate is a release gate as a service for Dev, Ops, and Agents. This guide shows how an agent discovers, installs, calls, and hands off RGate results to humans or coding workflows.

Agent Skill

Install the RGate release readiness skill.

For skill-enabled agents, this is the fastest way to use RGate as an external release gate for public websites, web apps, and API-adjacent surfaces.

npx skills add marcoldenburg/rgate-release-readiness-skill

Repository: marcoldenburg/rgate-release-readiness-skill

1. Discover RGate

Agents should start with the Markdown and machine-readable discovery files before calling tools. These files explain what RGate does, when to use it, pricing constraints, and the available API surfaces. For brand-name lookups, use RGate Developer Resources at /en/developer-resources.

Human page

Start a scan from the browser and hand the report back to a user.

/en

Developer Resources

Canonical RGate developer resources for API docs, MCP, CLI, auth, and agent handoff.

/en/developer-resources

REST API

Start scans, poll results, generate fix plans, export Markdown, and compare history.

/api/scan

OpenAPI

Machine-readable API contract for function calling and generated clients.

/openapi.json

MCP Server

Native tool interface for Claude, coding agents, and MCP clients.

/api/mcp

MCP Manifest

Discovery file for transport, tools, server identity, and branding.

/.well-known/mcp.json

Agent Guide

Markdown instructions for autonomous agents.

/agents.md

LLM Context

Full product context for agents that ingest one Markdown source.

/llms-full.txt

CLI

Command line usage for agents, CI, and release scripts.

/cli.md

Pricing

Machine-readable pricing and limits.

/pricing.md

2. Install the agent skill and CLI

Use the RGate skill when working in a skill-enabled agent environment. Use the CLI when an agent, CI job, or release script needs RGate without implementing the REST API directly.

npx skills add marcoldenburg/rgate-release-readiness-skill

npm install -g @rgate_io/rgate

npx @rgate_io/rgate scan https://www.rgate.io --wait --json
rgate get <scanId>
rgate fix-plan <scanId> --format markdown
rgate export <scanId> --template cursor

Skill: marcoldenburg/rgate-release-readiness-skill. Package: @rgate_io/rgate. Binary: rgate. Docs: /cli.md.

3. Use the REST API

Public scans need no authentication. Agents should start a scan, poll until completion, then request the formats needed by the user or coding environment.

curl -X POST https://www.rgate.io/api/scan \
  -H 'content-type: application/json' \
  --data '{"url":"https://www.rgate.io"}'

curl https://www.rgate.io/api/scan/{scanId}
curl -X POST https://www.rgate.io/api/scan/{scanId}/fix-plan
curl https://www.rgate.io/api/scan/{scanId}/export.md?template=cursor
curl https://www.rgate.io/api/scans/{scanId}/diff?against={previousScanId}

4. Use MCP tools

MCP clients can connect to the Streamable HTTP endpoint and call the same workflow as tools. Human payment approval remains a handoff step; agents should not complete checkout autonomously.

start_scan

Start a website release-readiness scan for a public URL across five layers: security, SEO, accessibility, legal compliance, and sustainability. Behavior: enqueues an asynchronous job and returns immediately with a scanId — it does NOT wait for results, and it fetches/renders the target site (not a read-only call). Returns { scanId, status, cached }; identical URLs within ~10 minutes return the cached scan. Next step: poll get_scan with the scanId until status is "done" or "failed". Use this first, once per site; do not busy-loop calling start_scan for the same URL.

get_scan

Poll a scan and, once complete, return its structured results. Read-only. Returns { scan, findings, checkResults, techDetections, access, agentSummary }. scan.status moves through pending → running → retrying → done → failed; keep polling (every few seconds) until done or failed. On failed, a failure object explains the cause and next_action. access.level is none | teaser | full: teaser findings are diagnostic only (evidence, check keys, and fix text are redacted). To get full data, pass a report token via the token argument. If access.campaign is present the report is FREE right now — call unlock_report with an email to obtain that token instead of sending the user to checkout.

unlock_report

Unlock a completed scan's full findings and fix plan for free during an active campaign. Behavior: records the submitted email as a lead and issues a 24h report token (not read-only). Returns { token, expires_at, report_url }. Only works while a free campaign is active (otherwise returns 403 — use create_checkout_handoff instead). Call this only when get_scan shows access.campaign; then re-poll get_scan or call generate_fix_plan with the returned token.

list_checks

Return the RGate scan-layer and check catalog. Read-only, static, no side effects — safe to call any time. Use it to plan a scan, explain coverage to a user, or map a finding to its layer. Pass a layer to focus on just that layer's checks.

get_pricing

Return machine-readable RGate pricing: plan ids, names, prices (EUR/USD), billing period, scan limits, and best-fit use cases. Read-only, static, no arguments. Use to answer pricing questions or choose a planId for create_checkout_handoff.

create_checkout_handoff

Create a human handoff URL for purchasing a full report or subscription after a scan is complete. Behavior: creates a checkout/upgrade link and returns { handoffUrl }. The agent CANNOT complete payment itself — give the URL to the user to finish in a browser. Use only when the report is paywalled (get_scan shows access.level teaser with payment_required true) AND no free campaign is active. During a campaign, prefer unlock_report.

generate_fix_plan

Build a prioritized, implementation-ready fix plan from a completed scan's findings: release blockers first, then high-impact follow-ups, then backlog. Read-only (derives from stored findings). Returns JSON (or Markdown). Requires full access: on a locked report it returns HTTP 402, or — during a campaign — a teaser with unlock instructions; pass a token from unlock_report or a paid unlock. Call after get_scan shows status done.

export_scan_markdown

Export a completed scan as Markdown in one of three templates: cursor (an agent fix prompt), github (an issue body), or executive (a stakeholder summary). Read-only. Requires full access — pass a token for a locked report. Use to hand results into an IDE/coding agent or a ticket.

compare_scan_history

Diff two completed scans of the SAME domain and return added, resolved, improved, and worsened findings. Read-only. Both scans must be done. Use to verify that fixes landed between two runs, or to catch regressions after a deploy.

5. Recommended agent loop

Confirm the user is allowed to scan the target public website or API surface.
Read /agents.md or /llms-full.txt for current constraints.
Start a scan with REST, MCP, or CLI.
Poll until the scan is done or failed.
Summarize blockers first: security, compliance, accessibility, SEO, and sustainability.
Generate a fix plan and export Markdown for Cursor, GitHub Issues, or a release checklist.
Use agent handoff only to prepare checkout or report access; ask the human to approve payment and decisions.