Integrating your agents

Draft documentation for evaluations. Endpoints and fields follow the draft API contract (version 2.0.0-draft.1) and may change before general availability. Hosted access is over HTTPS (TLS); GovCloud is planned.

What you get

• Speed Answers come from our pre-built index with no live crawl at query time, as compact JSON your agent can use at once.
• Cloud or air-gapped on-prem Prototype Call our hosted API, or run our query service in your cloud or air-gapped on your own network; the offline bundle makes no call-home.
• Government sources Web results alongside NIST SP 800-171 and SP 800-53, the CISA Known Exploited Vulnerabilities catalog, FAR and DFARS, the CMMC rule (32 CFR 170), the CUI rule (32 CFR 2002), the Federal Register and DoD news releases, all cited.
• Freshness News is polled continuously and every result is dated, with the time we last checked its source in checked_at.
• Full-source citations Compact JSON with a citation and a date on every passage, not a generated answer, so it works with any model.
• Zero query retention Query text is never stored. We keep only usage counts for metering. Separately, we keep short-lived operational logs and account records, none of which contain query text.

• Runs on your own network Prototype

  Installs on your own machine, with no call-home. For air-gapped and CUI environments.

• Works with any model

  Raw, cited passages as compact JSON, not a generated answer. Not tied to one model vendor.

• A citation and a date on every result

  The passage, its pinpoint, a source link, published and checked dates, and a stale flag.

• See it on your network

  Book a demo and we'll run your kind of question live.

Offline packages are priced per site, per year. The hosted API uses simple usage-based pricing, agreed with you after a free evaluation. Compact responses keep each call small, so costs stay easy to forecast.

How it works and where it runs

Your agent sends a search inside your boundary or over TLS. SecureScout returns compact JSON from a versioned index of approved public sources: the passage, its pinpoint citation, a link to the source, and when we last checked it.

1. We collect and version.

   Approved public sources are collected, normalized and published as signed, versioned releases.

2. Your agent asks.

   It queries the index inside your boundary or over TLS. Nothing is fetched from the web at query time.

3. You get cited JSON.

   Passage, pinpoint, source link, freshness and release ID.

For teams whose agents can't send questions to the open web.

• Defense primes

  Engineering, proposal and compliance agents that need current DFARS, the CMMC rule and NIST SP 800-171 text, cited to the paragraph, inside CUI enclaves.

  Typical delivery Offline bundle in the enclave; hosted for non-CUI work

• Defense tech

  Product and security teams building agents for DoD programs, who need clause, control and vulnerability lookups without routing queries through public search.

  Typical delivery Hosted (non-CUI) to start; offline bundle for enclave work

• Health and regulated organizations

  Teams whose prompts may carry sensitive data and shouldn't leave their boundary, grounding agents in public regulations and reference sources.

  Typical delivery Offline bundle; hosted for non-sensitive work. Healthcare sources by arrangement

• Government, labs and innovation units

  Agencies, national labs, FFRDCs, UARCs and DoD innovation units running AI agents on restricted or disconnected networks.

  Typical delivery Offline bundle (prototype); GovCloud planned

  Book a government demo

For government and labs: we start with a no-cost evaluation on public or synthetic questions, and we're happy to talk through the acquisition path that suits your office.

Quickstart

1. Your organization's owner or admin creates an API key in the operator portal. Accounts are created by us after an agreement; there's no self sign-up.
2. Store the key in your secret manager. It's shown once.
3. Call search from your agent:

curl -sS https://api.securescout.si/v1/search \
  -H "Authorization: Bearer $SECURESCOUT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"q":"CVE-2021-44228","mode":"compact","limit":5}'

Exact identifiers (CVE, CWE, Federal Register numbers, arXiv IDs, NIST SP numbers) are faster through lookup:

curl -sS https://api.securescout.si/v1/lookup \
  -H "Authorization: Bearer $SECURESCOUT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"ids":["CVE-2021-44228","NIST SP 800-171 Rev. 3"]}'

Response shape

Every response is plain-text JSON (no HTML, no highlight markers unless you ask for highlight: true) and carries request_id, corpus.release_id, corpus.updated_at and took_ms.

• mode: "compact" (default): per item doc_id, title, a snippet of up to 300 characters, citation {url, label, page_label, section}, source_id, content_mode (full_text, excerpt, abstract, structured), source_published_at, checked_at, stale, status (current, superseded, withdrawn) and score.
• mode: "passages": adds passages[] with up to 1.2 KB of text each, page and section labels, and prev_id/next_id for context.
• Budgets: limit ≤ 20 and max_bytes (default 8 KB, max 64 KB). Passages are trimmed first, then trailing items; a citation is never split and truncated tells you if anything was cut.
• Freshness: GET /v1/sources lists coverage and freshness per source, so an agent can tell "no results" from "source stale".

Originals come through the API itself, over HTTPS (TLS). There are never presigned or public download links. GET /v1/documents/{doc_id} lists artifacts[] with size, SHA-256 and whether you can download each one.

Retrieved text is evidence, not instructions. Treat it as untrusted input in your agent.

Try it in the agent demo →

API reference

Agent endpoints:

MCP and tool schemas

Agent tool definitions for search, lookup, get_document and get_context in function-call format: tools.json (draft).

The MCP server will run inside your network over stdio, with your key, and calls the API over HTTPS (TLS). There's no hosted MCP endpoint, so nothing extra sits in the query path.

{
  "mcpServers": {
    "securescout": {
      "command": "<securescout-mcp-server>",
      "args": ["--stdio"],
      "env": { "SECURESCOUT_API_KEY": "ss_live_…", "SECURESCOUT_API_URL": "https://api.securescout.si" }
    }
  }
}

The Python client and MCP server are planned. Command and package names above are provisional.

Egress evidence

Demonstrated locally for the query service: sentinel queries were absent from its responses, logs and stores, and it had no route to the internet. The query service's no-egress setup is tested in our local builds. This covers the query service only; our website and console services are separate and do connect to the internet.

See Security and data handling for exactly what we keep.

Errors and limits

Errors are application/problem+json with a stable type: validation_error, invalid_api_key, forbidden (for example a key used outside its network binding), allowance_exhausted (hard stop reached; document, context and original fetches stay free and are never blocked), entitlement_inactive, rights_restricted (a recorded redistribution review isn't approved, or the file isn't servable), audience_restricted (the original isn't available on your agreement type, for example demo or evaluation access), withdrawn (410: the publisher withdrew the document; metadata only), rate_limited (with Retry-After), search_timeout, search_offline and upstream_unavailable. Quote the request_id when you contact us; we can't see your query text.