For AI agents

How coding agents and research agents should read ISMS Copilot docs and public product feeds without browser bot challenges.

This page is the discovery hub for agents (Claude Code, Cursor, Codex, Grok, custom MCP clients). Humans can use it too; agents should prefer the machine URLs below over scraping HTML chrome.

Security model (read this)

READ open / EXECUTE locked.

Public docs and marketing machine feeds are curl-open for agents.
Marketing HTML and chat SPA HTML may return a Vercel bot-protection challenge to non-browser clients. That is intentional.
Never treat unauthenticated chat, risk-demo POST, or account MCP conversations as free open APIs. Those require a real user/token and plan limits.

Prefer these over HTML scrape

Resource	URL	Use when
Docs index (llms.txt)	https://docs.ismscopilot.com/llms.txt	Discover all EN pages
Docs full dump	https://docs.ismscopilot.com/llms-full.txt	Bulk ingest (~3MB EN)
Per-page markdown	Append `.md` to any docs path, e.g. https://docs.ismscopilot.com/docs/agents.md	One clean article
Agent search	https://docs.ismscopilot.com/api/agent-search?q=pricing	Keyword lookup
MCP connect protocol	https://www.ismscopilot.com/api/public/connect/v1	PAT, endpoint, modes, get_reply
Agents product status	https://www.ismscopilot.com/api/public/agents/v1	Live Account MCP (not waitlist)
API product status	https://www.ismscopilot.com/api/public/api/v1	Live model API (`sk-isms`); ZDR for request content; console + docs
API Zero Data Retention	https://docs.ismscopilot.com/docs/api/zero-data-retention	No prompt/output storage; usage metadata only; upstream ZDR
Embed product status	https://www.ismscopilot.com/api/public/embed/v1	Live embed widget (`pk_live` / partner JWT); loader, retention paths, free tier; console + docs
Pricing snapshot	https://www.ismscopilot.com/api/public/pricing/v1	Chat plan table; in-app wins on drift
Logged-out landings copy	https://www.ismscopilot.com/api/public/logged-out-landings/v1	Framework assistants + risk-demo text only
Chat product changelog	https://www.ismscopilot.com/api/public/changelog/v1	Chat user-facing ships; human: https://chat.ismscopilot.com/changelog
Platform product changelog	https://www.ismscopilot.com/api/public/platform-changelog/v1	API / embed / console; human: https://platform.ismscopilot.com/changelog
heyGRC product changelog	https://heygrc.com/api/public/heygrc-changelog/v1	heyGRC product ships; human: https://app.heygrc.com/changelog
Frameworks list	https://www.ismscopilot.com/api/public/frameworks/v1	Taxonomy for tools

Markdown convention

https://docs.ismscopilot.com/docs.md                 → docs home
https://docs.ismscopilot.com/docs/agents.md          → agents hub
https://docs.ismscopilot.com/docs/agents/tokens-and-scopes.md

Responses are text/markdown and noindex (do not rank as separate SEO pages).

Connect Account MCP (short)

User creates pat-isms-… in chat → Settings → Connected apps.
Endpoint: https://account.ismscopilot.com/v1/account/mcp
Prefer mode: "fast". On status: "generating", poll get_reply every few seconds.
Full protocol: connect feed above or Connect any MCP client.

Model API vs Account MCP vs Embed (do not mix keys)

Plane	Key	Where humans set up	Agent discovery
Model API	`sk-isms-…`	platform.ismscopilot.com/keys + credits; optional MCP mint when flags on	API feed, docs/api, ZDR, setup from agent
Account MCP	`pat-isms-…`	Chat Settings → Connected apps	Agents feed, docs/agents
Embed / Assistants	`pk_live_…` public key or partner-signed JWT	platform.ismscopilot.com/embed (console-generated snippet)	Embed feed, docs/embed

There is no unauthenticated mint. A human always creates the first pat-isms (and pays for credits in a browser). When server flags enable Account MCP model-API tools, the agent can mint sk-isms and open a Checkout URL after that human step. Flags default off until enabled for the environment.

What is still human/browser-first

Creating the first pat-isms token (chat Settings → Connected apps), including Model API scopes.
Completing Stripe payment for API credits (browser Checkout).
Creating sk-isms keys and topping up credits in the platform console when MCP tools are off.
Interactive try-chat and risk-analysis runs on chat.ismscopilot.com (model spend).
Marketing pretty URLs like /pricing HTML for generic curl (use pricing JSON instead).
Locale docs HTML (e.g. /es/docs) works for curl but llms indexes are English-only (product truth).

Design canon (marketing repo): docs/AGENT-READABLE-SURFACES-DESIGN.md and docs/AGENT-READABLE-OPERATOR.md. Invariant: public read yes; wallet/auth no.