Access and machine contract
Free invited beta. Request a private key from xeolite.app@gmail.com. Each microsite has a separate key and quota. Keep keys server-side and out of logs, browser code, URLs and source control.
Call the API
POST https://reaperharness.com/api/v1/assess
X-Agent-API-Key: YOUR_PRIVATE_KEY
Content-Type: application/json
{
"summary": "Review the public documentation without changing any files.",
"scope": "single",
"writeSurface": "none",
"risk": "low",
"authority": "advisory",
"externalSystems": false,
"verification": "basic"
}Input and interpretation
A 20–800 character proposal with explicit scope, write surface, risk, authority, external-system and verification selections.
Does not inspect repositories, execute work or grant authority.
Usage limits
65,536-byte request body; 262,144-byte result. Each site shares 30 admitted requests per minute and 500 per UTC day among its invited callers. Two analyses per server isolate. Invalid input can consume quota after authentication. Quota service failure blocks analysis.
Send the body within five seconds. Results that complete after the three-second analysis budget are rejected; platform CPU limits also apply. No real-time latency or availability guarantee is provided.
Errors and retries
401: missing or invalid key. 422: input violates the schema or domain rules. 429: busy or quota exhausted. 503: disabled or unavailable. Respect Retry-After on 429/503; daily exhaustion lasts until the next UTC day. Do not retry invalid inputs unchanged.
Use the exact HTTPS route without query parameters. Browser-origin requests and compressed bodies are rejected. Direct calls recompute; Idempotency-Key is unsupported.
Data and trust boundary
The API transmits input for transient server processing; the browser tool still runs locally. Use public or synthetic inputs only. The application stores no inputs or outputs and logs no payloads or keys. One aggregate quota row is retained without IPs or user identifiers. Hosting providers may process operational metadata.
Does not inspect repositories, execute work or grant authority.
These outputs do not establish Nexus admission, verification, payment, procurement or authority. Validate the JSON schema and retain exact response bytes if your integration needs transport evidence.
Browser tool remains available
The existing assess_agent_change WebMCP tool remains browser-local where supported. It updates the visible interface, and does not require this API key or call the server.