> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pipefort.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Agent discovery

> Machine-readable documents that let AI agents and crawlers find, understand, and call Pipefort without a human in the loop.

Pipefort publishes a set of standard discovery documents so an autonomous agent
landing on `pipefort.com` can work out what the service does and how to call it,
without scraping the marketing site.

Everything on this page is served from the marketing origin, needs no
authentication, and is CORS-readable (`Access-Control-Allow-Origin: *`).

## Where to start

Fetch `https://pipefort.com/` and read the `Link` response header
([RFC 8288](https://www.rfc-editor.org/rfc/rfc8288)). It points at everything
else:

```
Link: </.well-known/api-catalog>; rel="api-catalog"; type="application/linkset+json",
      </openapi.json>; rel="service-desc"; type="application/openapi+json",
      <https://docs.pipefort.com>; rel="service-doc"; type="text/html",
      </.well-known/ai-catalog.json>; rel="service-meta"; type="application/json"
```

## The documents

| URL                                                                                                | Format                     | What it is                                                                                                                                                                          |
| -------------------------------------------------------------------------------------------------- | -------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| [`/openapi.json`](https://pipefort.com/openapi.json)                                               | OpenAPI 3.1                | Full description of the **public API** — every unauthenticated endpoint, with request and response schemas.                                                                         |
| [`/.well-known/api-catalog`](https://pipefort.com/.well-known/api-catalog)                         | `application/linkset+json` | [RFC 9727](https://www.rfc-editor.org/rfc/rfc9727) catalog linking the OpenAPI spec, these docs, and the health endpoint.                                                           |
| [`/.well-known/ai-catalog.json`](https://pipefort.com/.well-known/ai-catalog.json)                 | ARD manifest               | [Agentic Resource Discovery](https://agenticresourcediscovery.org/) manifest describing each capability with representative queries, so registries can index Pipefort semantically. |
| [`/.well-known/agent-skills/index.json`](https://pipefort.com/.well-known/agent-skills/index.json) | Agent Skills index         | Installable skills (below), each with a `sha256` of its `SKILL.md`.                                                                                                                 |
| [`/robots.txt`](https://pipefort.com/robots.txt)                                                   | RFC 9309                   | Crawl rules, with explicit groups for AI crawlers and [Content Signals](https://contentsignals.org/).                                                                               |
| [`/sitemap.xml`](https://pipefort.com/sitemap.xml)                                                 | Sitemaps 0.9               | Canonical marketing pages.                                                                                                                                                          |

## Agent skills

Three skills teach an agent how to use the public API correctly — including the
limits worth stating out loud rather than papering over.

| Skill                                                                                       | Use it when                                                                                                    |
| ------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------- |
| [`scan-repo`](https://pipefort.com/.well-known/agent-skills/scan-repo/SKILL.md)             | Auditing a public repository's CI/CD workflows against the OWASP CI/CD Top 10.                                 |
| [`vet-action`](https://pipefort.com/.well-known/agent-skills/vet-action/SKILL.md)           | Checking a third-party GitHub Action's score and getting the SHA to pin it to, before adding it to a workflow. |
| [`harden-workflow`](https://pipefort.com/.well-known/agent-skills/harden-workflow/SKILL.md) | Rewriting a workflow file with hardening fixes applied.                                                        |

Each is a plain Markdown file. Verify the `sha256` from `index.json` before
executing one.

## Crawling and AI use policy

`robots.txt` names GPTBot, OAI-SearchBot, ChatGPT-User, ClaudeBot, Claude-Web,
Claude-User, Claude-SearchBot, Google-Extended, PerplexityBot,
Applebot-Extended, `meta-externalagent`, CCBot, Amazonbot, and `cohere-ai`
explicitly, and carries the same Content Signals for each group:

```
Content-Signal: search=yes, ai-input=yes, ai-train=yes
```

Public Pipefort content may be indexed, used to ground AI answers, and used for
model training. The signals are repeated per group on purpose — under
[RFC 9309 §2.2.1](https://www.rfc-editor.org/rfc/rfc9309#section-2.2.1) a
crawler obeys exactly one group and inherits nothing from `User-agent: *`.

The authenticated console routes on `app.pipefort.com` (`/dashboard`,
`/repositories`, `/settings`, and the rest) are disallowed everywhere — they are
behind login and client-rendered, so there is nothing there to index.

## Coverage

The OpenAPI spec describes the **public API only**. The authenticated
multi-tenant API — organizations, scan history, trends, remediation campaigns —
is documented in the [API reference](/webapp/api-reference) and requires a
bearer token.

<Note>
  Not yet published: DNS-AID records (they live in DNS, not this repo), a hosted
  remote MCP server, and `Accept: text/markdown` content negotiation. The MCP
  server Pipefort ships today is the [local stdio server](/cli/mcp) in the CLI.
</Note>