Updated September 17, 2026
Inspect with context.
Keep control of your data.
The Web scanner processes the public URL or JSON you submit to produce an inspection report. This page describes this scanner, which has different data flows from the main AgentCollusion website.
What is processed
For a public URL, we retrieve the card and supported same-origin public key documents. For pasted or uploaded JSON, the card text and any public JWKS you provide are sent to the inspection service. JSON key discovery is off by default. Do not submit private signing keys or credentials.
What we retain
The application does not save cards, keys, target URLs, or inspection reports. Results remain in the current browser tab until you leave or reload; you can choose to download a report. There are no analytics scripts, advertising cookies, accounts, or browser-storage history in this release.
To control traffic, Cloudflare temporarily stores request counters and salted, minute-specific hashes of client IP addresses. These counters expire after two idle minutes. They do not contain the submitted URL or card. Hosting providers can retain infrastructure and request metadata under their own retention policies; we do not claim that infrastructure leaves no logs.
Where processing happens
Cloudflare serves the site and controls admission. A Node.js function on Vercel runs the same inspection core as the CLI. Request bodies are sent through that service for processing. The application does not intentionally log those bodies or reports.
For data that must stay local
Use agent-card-scanner verify on your own device. It makes no network requests unless you explicitly add --network. Public keys supplied through --jwks are authoritative.
Sharing a report
Reports omit raw card documents and redact URL credentials and queries. They can still contain publisher text, endpoint paths and key identifiers. Review a report before sharing it with others.
Contact
For privacy questions, use contact@agentcollusion.ai.