The honest answers.
Real questions from real buyers — scoring methodology, agent interfaces, security, governance, implementation, pricing, and what happens if you cancel.
If you don't see yours here, email [email protected].
Does publishing a Shadow API expose my site to more agent risk? +
Agents and scrapers can already read public pages. Arachne turns that invisible traffic into a governed, logged interface.
Publishing a Shadow API does not grant blanket write access. Reads are structured, writes default to draft_only, high-risk actions require approval, and page content is treated as data rather than instructions.
Every action is gated by a policy you define. Writes default to draft_only and require explicit per-call approval via the capability-token wallet. Page content returned to agents is flagged untrusted_page_content_is_data: true, so the MCP server tells agents verbatim to treat your content as data, never as instructions. Every call lands in a hash-chained DeltaStore ledger you can re-walk for compliance or forensics.
The trade is unmanaged scraping versus accountable access.
How is the Agent Readiness Score calculated? +
Arachne combines structural readiness with live agent validation. Structural readiness measures capabilities across discovery, interfaces, governance, machine understanding, and evidence quality. Signals such as ARD, MCP, A2A, OpenAPI, WebMCP, structured data, sitemaps, and other applicable protocols contribute evidence, but no single file or protocol defines readiness.
When live validation is available, Arachne also tests whether a bounded agent can understand the business, find the intended path, identify trust signals, and choose a safe next step. Structural and live results remain visible separately so disagreement can be inspected rather than hidden. The current combined score weights structural evidence at 45% and live validation at 55%.
What it doesn't claim: a score is not a security certification or proof that every endpoint works. Arachne reports observed evidence, bounded behavior, and the interfaces that are appropriate to the business.
How is this different from publishing an OpenAPI spec or an llms.txt?
+
OpenAPI, ARD, llms.txt, JSON-LD, and similar surfaces describe different parts of a business's machine-readable front door. Arachne observes those surfaces, extracts a normalized capability model, validates agent behavior where possible, and recommends the interface stack that fits the use case.
Hosted MCP and OpenAPI outputs remain available where appropriate. Browser-local, agent-to-agent, commerce, and discovery surfaces are not assumed or generated merely because a standard exists.
What if I want to add, remove, or change a tool in my Shadow API? +
Your manifest is yours. You can email us to remove tools you don't want exposed, force-recompile after a site change, or upgrade tools from draft_only to wallet-gated write access once you've verified domain ownership.
Recompiles are part of your monthly. The endpoint URL stays the same so your customers don't need to reconfigure.
Will agents hammer my server with calls? +
Less than scrapers do today. The gateway rate-limits per agent, and unlike anonymous scrapers, every call is identified and logged — you can see which MCP client is calling, how often, and what they touched. If a specific caller is abusive, you revoke their token; you can't revoke a scraper.
Do you need access to my codebase or backend? +
A public scan is egress-side and observes publicly accessible surfaces. Managed implementation may require additional customer-authorized integration or domain verification, depending on the interface and workflow. Arachne does not bypass access controls or silently modify customer systems.
Which agent interfaces can Arachne support? +
The scan produces an evidence-backed interface plan. Depending on the business, that may include ARD discovery, hosted MCP, WebMCP/browser-agent surfaces, A2A, OpenAPI, machine-readable content, or applicable commerce bindings. MCP clients can use a hosted MCP endpoint when that is the appropriate supported output, but MCP is not required for every site.
What happens if I cancel? +
Your hosted endpoint goes dark. Your manifest.json is yours forever — open format, no vendor lock-in. You can self-host it from the stdio config we ship in the bundle, or hand it to another MCP runtime. No data hostage situations.
Can I see implementation guidance before creating a workspace? +
Yes. The free scan explains the score, technical signals, agent-task result, top issues, and interface opportunities. After lightweight contact capture, the same scan can reveal its implementation schemas, evidence, policy boundaries, and examples without requiring an account.