Terms of Service

1. What the service is

Pentest Agent performs automated, public, non-invasive security assessments of websites. An assessment requests the homepage, a limited number of scripts the homepage already loads for every visitor, a few well-known paths such as /.well-known/security.txt, public DNS records, and public registries such as Sourcify. It does not attempt exploitation, authentication, credential guessing, fuzzing, crawling, or anything that bypasses access controls. The full scope is described in our methodology.

Paying for an assessment buys depth and freshness. It never expands what we test beyond public, non-invasive checks.

2. Reports are automated and public

• Every assessment, free or paid, produces a public report page. Reports appear in Explore and in the domain's public history, and can be shared by anyone.
• Findings come from deterministic checks of what we observed at the time of the scan. Findings marked potential are heuristic signals that need review by the site owner and may not be exploitable.
• The agent summary is generated by an AI model from those findings only. It may contain mistakes, and it never changes findings or grades.
• A report reflects externally visible configuration at one point in time. A good grade does not mean a website or application is secure, and a poor grade does not mean it has been compromised.

3. Not professional advice

Reports are informational. They are not a penetration test, an audit, a certification, legal advice, or investment advice, and must not be presented as such. Do not make financial decisions, including about tokens or projects, based on a grade.

4. Acceptable use

You agree not to:

• circumvent rate limits, request budgets, opt-outs or other safeguards, including by rotating IP addresses or accounts;
• use the service, or its reports, to plan or carry out attacks against any system;
• submit targets you know to be internal, private or operated for the purpose of abusing our scanner;
• misrepresent reports, including by altering them or presenting them as an endorsement or a certification by Pentest Agent;
• use reports to harass, defame or extort anyone; or
• interfere with the operation of the service.

We may refuse, rate limit or block any request, and remove any report, at our discretion.

5. Paid assessments and x402 payments

• Premium and bulk assessments are priced per request as shown on our pricing page and in each HTTP 402 response. Prices are quoted in USD stablecoins (USDC on Base and Solana, USDG on Robinhood Chain).
• Payments use the x402 protocol. You sign a payment authorization; a third-party facilitator verifies it and settles the transfer on-chain directly to our wallet. We never hold your funds or keys.
• Payment is settled only after we accept the request. Requests for invalid, private, opted-out or rate-limited targets are rejected without charge. For bulk requests, nothing is charged unless every target is accepted.
• On-chain payments are irreversible. Once settled, payments are final and non-refundable. If a paid assessment fails to complete because of a fault on our side, contact us with the report ID and we will re-run it.
• You are responsible for your wallet, the network you choose, and any fees charged by your wallet or network.

6. Domain owners

If you own or operate a domain, you may ask us to stop assessing it and hide its public reports, including all subdomains, or dispute a finding you believe is wrong. Email security@pentestagent.dev from an address at the domain, or tell us how you can demonstrate control of it. We aim to respond within two business days.

7. Content and attribution

The service, including its software, design and branding, belongs to Pentest Agent. You may share report links and quote reports with attribution to Pentest Agent, provided you do not alter them. Do not copy the report database in bulk or use automated scraping beyond the documented API.

8. Disclaimer of warranties

The service and all reports are provided "as is" and "as available", without warranties of any kind, express or implied, including accuracy, completeness, fitness for a particular purpose and non-infringement. We do not warrant that the service will be uninterrupted or error-free, or that any vulnerability will be detected.

9. Limitation of liability

To the fullest extent permitted by law, Pentest Agent will not be liable for any indirect, incidental, special, consequential or punitive damages, or for lost profits, revenue, data, funds or goodwill, arising from your use of the service or reliance on any report. Our total liability for any claim relating to the service is limited to the amount you paid us for the assessment giving rise to the claim in the 30 days before it, or USD 10 if you paid nothing.

10. Indemnity

You agree to indemnify Pentest Agent against claims arising from your misuse of the service or breach of these terms.

11. Changes

We may change the service or these terms. Material changes will be reflected by a new effective date on this page. Continued use after a change means you accept the updated terms.

12. Contact

Questions about these terms: security@pentestagent.dev.