Agent-ready Exagard

Reliable tools for AI agents

WebMCP lets a compatible browser agent discover structured Exagard actions instead of guessing from buttons and page layouts. Public tools work throughout this site; organisation data is available only after a scoped key is validated.

Connect organisation tools

The key is validated by api.exagard.com and kept only in this page's memory. It is never included in tool arguments, URLs, analytics, or browser storage.

WebMCP unavailable in this browser

Quick start

1Open this page in a browser with document.modelContext support. The two public tools register automatically.
2To access organisation data, rotate a WebMCP key as an organisation administrator and connect it above.
3Inspect registered tools in Chrome DevTools under Application → WebMCP, then invoke them manually or through a compatible agent.

Available tools

get_exagard_info

Public · read-only

Returns concise Exagard capabilities and links for the website and safety trial.

Input: No arguments
Direct API: GET /api/webmcp/info
Returns: Product name, tagline, website URL, trial URL, and capability list.

start_exagard_signup

Public · creates signup

Starts the configured signup flow and emails a verification code to the contact.

Input: organisationName: string, contactEmail: email
Direct API: POST /api/webmcp/signup
Returns: Signup ID, payment requirement, verification-code expiry, and next step.

get_subscription

Organisation key · read-only

Returns bounded subscription module status without provider or billing identifiers.

Input: No arguments; key is supplied out of band
Direct API: GET /api/webmcp/subscription
Returns: Organisation name and up to ten subscription lifecycle summaries.

get_compliance_report

Organisation key · read-only

Returns the current compliance score, trend, policy counts, and area summaries.

Input: No arguments; key is supplied out of band
Direct API: GET /api/webmcp/compliance-report
Returns: Organisation totals and up to six compliance-area summaries.

HTTP API reference

The default base URL is https://api.exagard.com/api/webmcp. Browser tools call these same endpoints. Protected data requests send the organisation key in the X-API-KEY header, never in a URL or tool argument.

Method	Path	Authentication	Purpose
GET	`/tools`	Public	WebMCP tool descriptors and JSON input schemas
GET	`/info`	Public	Product information used by get_exagard_info
POST	`/signup`	Public	Start signup with organisationName and contactEmail
GET	`/subscription`	X-API-KEY	Subscription summary for the key's organisation
GET	`/compliance-report`	X-API-KEY	Compliance summary for the key's organisation
GET	`/credentials`	Exagard login	Current organisation credential status
POST	`/credentials/rotate`	Org administrator	Rotate and reveal a new key once
DELETE	`/credentials`	Org administrator	Revoke the current organisation key

Request examples

Discover the available tools

curl https://api.exagard.com/api/webmcp/tools

Start a public signup

curl -X POST \
  https://api.exagard.com/api/webmcp/signup \
  -H "Content-Type: application/json" \
  -d '{
    "organisationName": "Example Safety AB",
    "contactEmail": "safety@example.com"
  }'

Read subscription status

curl https://api.exagard.com/api/webmcp/subscription \
  -H "X-API-KEY: exa_wmcp_…"

Read the compliance summary

curl https://api.exagard.com/api/webmcp/compliance-report \
  -H "X-API-KEY: exa_wmcp_…"

Organisation credentials

An authenticated organisation administrator calls POST /api/webmcp/credentials/rotate using their normal Exagard login.
The secret is shown once. Exagard stores only its hash and key identifier.
Paste the key above for this tab. Refreshing or closing the page removes it.
Check status with GET /api/webmcp/credentials or revoke it with DELETE /api/webmcp/credentials.

Security boundaries

Keys resolve exactly one active organisation and are never tool parameters.
Read-only tools are annotated so agents can distinguish them from signup.
Responses are intentionally concise and omit payment-provider identifiers.
Tools are exposed to this origin and browser agents, not arbitrary embedded sites.

Response envelope

Signup and organisation-data endpoints return Exagard's standard result envelope. Read the payload only when success is true.

{
  "success": true,
  "result": { ... },
  "errorMessage": null
}

Errors and limits

400 — invalid signup input or signup is unavailable.
401 — organisation key is missing, invalid, or revoked.
403 — logged-in user is not an organisation administrator.
503 — subscription information is temporarily unavailable.
All WebMCP endpoints are rate limited; retry later after a throttled response.

Browser support and testing

WebMCP is an experimental web-platform feature. Production access depends on the Chrome origin trial or a browser implementation that supports document.modelContext. In supported Chrome builds, open DevTools, choose Application, then WebMCP to inspect and manually invoke the tools registered by this page. Direct HTTP API access does not require browser WebMCP support.

WebMCP API guide DevTools testing