Free scan

Agent developers

Help users take
the next step.

Use the public API or connect to https://struckoff.hatz.xyz/mcp. Pricing and handoff links are public. Private removal status requires a read-only bearer token.

Capabilities and limits

Start with the OpenAPI 3.1 spec. These endpoints do not send sign-in email, purchase a plan, capture consent or file broker requests.

start_scan
POST /api/agent/scan with {}. Handoff stub returning /app/scan. The human signs in and supplies their profile. Likely-listed results are simulated.
get_pricing
GET /api/agent/pricing. USD prices, placeholder flag and current Stripe mode.
create_checkout_link
POST /api/agent/checkout with {"product":"one_time"} or {"product":"annual"}. Returns the billing page with product preference. Human chooses that product and confirms checkout. This is a handoff, not a Stripe session. When Stripe is unconfigured, checkout is explicitly simulated and charges nothing.
get_removal_status
GET /api/agent/status with Authorization: Bearer TOKEN. Returns only that user's recorded per-site statuses. Empty items means no recorded work, not that the user is absent from brokers.

Authentication

The human signs in through the portal, then opens Account and selects Create status token. The token is shown once, expires in one hour and replaces the previous token. Account also offers Revoke token. This token grants status access only; it cannot access the portal, checkout, consent or admin APIs.

Send the token in the Authorization header. Never put it in URLs, MCP arguments, public prompts or logs. This integration uses manually issued tokens, not OAuth discovery or automatic login. Clients requiring OAuth must support manual bearer configuration to connect.

Remote MCP

The Streamable HTTP transport is stateless. POST one JSON-RPC message per request to /mcp with Content-Type: application/json and Accept: application/json, text/event-stream. Responses use application/json. No MCP session ID is required. GET returns 405 because server-initiated SSE is not offered.

Initialize with:

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "initialize",
  "params": {
    "protocolVersion": "2025-06-18",
    "capabilities": {},
    "clientInfo": {
      "name": "your-agent",
      "version": "1.0"
    }
  }
}

Then POST a notifications/initialized message without an id; it returns 202. Send MCP-Protocol-Version: 2025-06-18 on subsequent requests. Versions 2025-03-26 and 2025-06-18 are supported. A supplied Origin must match the server origin; non-browser clients may omit it.

{"jsonrpc":"2.0","id":2,"method":"tools/list"}
{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"get_pricing","arguments":{}}}
{"jsonrpc":"2.0","id":4,"method":"tools/call","params":{"name":"create_checkout_link","arguments":{"product":"one_time"}}}
{"jsonrpc":"2.0","id":5,"method":"tools/call","params":{"name":"get_removal_status","arguments":{}}}

Add Authorization: Bearer TOKEN to the status call. Tool failures return isError: true with an error in text content; malformed requests use JSON-RPC errors. REST status returns 401 for missing, expired or revoked tokens. Invalid REST parameters return 400.

Payment and authorization

Always open the returned link for the human. Never treat a link as payment confirmation. The human reviews pricing and confirms checkout. Before removal work, the human must enter a search profile and sign authorization at Consent. An AI instruction does not replace that signature. Do not report a pending or submitted request as completed removal.

Product references

Concise reference · Full reference and broker guides · Pricing · Privacy policy