API Reference

Security Desk

Passive security intelligence for authorized targets — unified website breakdown, agent-readiness dimensions, HTTP header review, and recommendations. No active exploitation.

Pricing

Endpoint	Price	Purpose
`POST /api/concierge-security-scope`	Free	Validate target + allowlist (no fetch)
`POST /api/concierge-security-scan`	$0.10	Unified breakdown — grade, readiness, headers, Concierge Surface Review, recommendations
`POST /api/concierge-security-scan` + `selfAudit: true`	Free	Canonical `conc-exe.xyz` self-audit only
`POST /api/concierge-security-readiness`	$0.02	Passive agent-readiness subset
`POST /api/concierge-security-headers`	$0.02	Security header checklist

SOON Deluxe+ (post-launch): 3 free scout audits/day on readiness/headers with X-Soon-Holder-Wallet.

Lounge UI

Executive Lounge → Security Scan — end-user surface only. Enter an authorized external URL or use Scan Concierge (free) for the public site posture report.

Integrators and agents do not use the Lounge for production calls. Use POST /api/concierge-security-scan (x402), MCP tool security_scan, or the concierge-security skill — see Website scan and MCP below.

Concierge self-audit (free)

Passive audit of https://conc-exe.xyz with selfAudit: true — no x402 payment.

curl -s -X POST https://conc-exe.xyz/api/concierge-security-scan \
  -H "Content-Type: application/json" \
  -d '{"target":"https://conc-exe.xyz","allowlist":["*.conc-exe.xyz"],"authorized":true,"selfAudit":true}'

Repo CLI: npx tsx scripts/run-self-security-scan.mjs

Scope validation

curl -s -X POST https://conc-exe.xyz/api/concierge-security-scope \
  -H "Content-Type: application/json" \
  -d '{"target":"https://api.example.com","allowlist":["*.example.com"]}'

Windows PowerShell:

Invoke-RestMethod -Method POST -Uri "https://conc-exe.xyz/api/concierge-security-scope" -ContentType "application/json" -Body '{"target":"https://api.example.com","allowlist":["*.example.com"]}'

Website scan — `POST /api/concierge-security-scan`

Returns summary.overallGrade, readiness, headers, Surface Review, deskModules[] / deskPhases[], and access.* (tier, live ceiling, TCX launched). Pre-launch: Guest depth only — deeper TCX tiers marked Soon until mint / SECURITY_DESK_LIVE_MAX_TIER.

pay curl https://conc-exe.xyz/api/concierge-security-scan \
  -d '{"target":"https://api.example.com","allowlist":["*.example.com"],"authorized":true}'

Body: target (https), allowlist, authorized: true. Optional selfAudit: true for free conc-exe.xyz only.

Concierge Surface Review

Passive exposure breakdown (no exploit payloads): transport, cookies, CORS, disclosure headers, common sensitive paths.

Field	Meaning
`summary.surfaceGrade`	`minimal` · `clear` · `moderate` · `watch` · `elevated`
`summary.surfaceFindings`	Total passive findings
`breakdown.surface.findings[]`	`severity`, `title`, `detail`, `remediation`

Probes (Hobby-safe, parallel): /.env, /.git/HEAD, security.txt, robots.txt, swagger/docs paths, homepage headers.

Desk tiers & modules

Full module map in response as deskModules[] and deskPhases[] (Concierge-branded only).

Pre-launch (TCX not live)

Live now	Waitlisted as Soon
Guest breakdown (grade + surface severity counts)	Deluxe / Executive / President depth
Scope + attestation	Extended recon, client-side, playbooks, PDF/report export

Post-launch ceilings

Tier	Breakdown depth	Status
Guest	Grade + surface severity counts	Live
Deluxe	+ readiness scores, header checklist, finding titles	After TCX launch
Executive	+ full evidence, path probes, remediation	Hobby ceiling after launch
President	Executive + extended desk modules	Extended remain Soon until worker

Unlock richer depth: set SOON_TOKEN_MINT or SECURITY_DESK_LIVE_MAX_TIER=executive. Response: access.tier, access.liveCeiling, access.tcxLaunched, access.legalNotice.

Legal: Passive recon only — caller attests authorization (authorized: true).

Scout routes ($0.02)

POST /api/concierge-security-readiness — OpenAPI, discovery files, MCP surface scores.

POST /api/concierge-security-headers — per-header checklist and summary.grade.

{
  "target": "https://api.example.com",
  "allowlist": ["*.example.com"],
  "authorized": true
}

Platform guard

403 platform_scope_forbidden for Vercel preview hosts, private networks, IP literals, and punycode targets. conc-exe.xyz is permitted only via selfAudit: true on security-scan.

Paid external routes require allowlist + authorized: true. Rate limits: 20/min (scope), 8/min (audits) per IP.

MCP

POST /api/mcp — tools security_scan, security_readiness, security_headers (plus free concierge_catalog / concierge_prepare_payment). Unpaid calls return a live PAYMENT-REQUIRED challenge; retry with paymentSignature, creditsWallet, or pay curl.

Skill: /skills/concierge-security/SKILL.md · OpenAPI: openapi.json · SDK: @conc-exe/agent