Agent discovery

Pipefort publishes a set of standard discovery documents so an autonomous agent landing on pipefort.com can work out what the service does and how to call it, without scraping the marketing site. Everything on this page is served from the marketing origin, needs no authentication, and is CORS-readable (Access-Control-Allow-Origin: *).

Where to start

Fetch https://pipefort.com/ and read the Link response header (RFC 8288). It points at everything else:

Link: </.well-known/api-catalog>; rel="api-catalog"; type="application/linkset+json",
      </openapi.json>; rel="service-desc"; type="application/openapi+json",
      <https://docs.pipefort.com>; rel="service-doc"; type="text/html",
      </.well-known/ai-catalog.json>; rel="service-meta"; type="application/json"

The documents

URL	Format	What it is
`/openapi.json`	OpenAPI 3.1	Full description of the public API — every unauthenticated endpoint, with request and response schemas.
`/.well-known/api-catalog`	`application/linkset+json`	RFC 9727 catalog linking the OpenAPI spec, these docs, and the health endpoint.
`/.well-known/ai-catalog.json`	ARD manifest	Agentic Resource Discovery manifest describing each capability with representative queries, so registries can index Pipefort semantically.
`/.well-known/agent-skills/index.json`	Agent Skills index	Installable skills (below), each with a `sha256` of its `SKILL.md`.
`/robots.txt`	RFC 9309	Crawl rules, with explicit groups for AI crawlers and Content Signals.
`/sitemap.xml`	Sitemaps 0.9	Canonical marketing pages.

Agent skills

Three skills teach an agent how to use the public API correctly — including the limits worth stating out loud rather than papering over.

Skill	Use it when
`scan-repo`	Auditing a public repository’s CI/CD workflows against the OWASP CI/CD Top 10.
`vet-action`	Checking a third-party GitHub Action’s score and getting the SHA to pin it to, before adding it to a workflow.
`harden-workflow`	Rewriting a workflow file with hardening fixes applied.

Each is a plain Markdown file. Verify the sha256 from index.json before executing one.

Crawling and AI use policy

robots.txt names GPTBot, OAI-SearchBot, ChatGPT-User, ClaudeBot, Claude-Web, Claude-User, Claude-SearchBot, Google-Extended, PerplexityBot, Applebot-Extended, meta-externalagent, CCBot, Amazonbot, and cohere-ai explicitly, and carries the same Content Signals for each group:

Content-Signal: search=yes, ai-input=yes, ai-train=yes

Public Pipefort content may be indexed, used to ground AI answers, and used for model training. The signals are repeated per group on purpose — under RFC 9309 §2.2.1 a crawler obeys exactly one group and inherits nothing from User-agent: *. The authenticated console routes on app.pipefort.com (/dashboard, /repositories, /settings, and the rest) are disallowed everywhere — they are behind login and client-rendered, so there is nothing there to index.

Coverage

The OpenAPI spec describes the public API only. The authenticated multi-tenant API — organizations, scan history, trends, remediation campaigns — is documented in the API reference and requires a bearer token.

Not yet published: DNS-AID records (they live in DNS, not this repo), a hosted remote MCP server, and Accept: text/markdown content negotiation. The MCP server Pipefort ships today is the local stdio server in the CLI.

Get started

CLI

Editor

Web app

Concepts

Rules reference

Where to start

The documents

Agent skills

Crawling and AI use policy

Coverage

​Where to start

​The documents

​Agent skills

​Crawling and AI use policy

​Coverage

Where to start

The documents

Agent skills

Crawling and AI use policy

Coverage