Can an AI assistant use your product, and is it safe if it does?
People now ask an assistant which tool to use, then ask it to do the set-up. If it can't read your docs or open an account, it recommends the competitor it can get into. If it can, and holds a key that does everything, that is a different problem. Twelve checks, the reason behind each, and the order to work in.
Your answers are saved in this browser only. Nothing is sent to us.
Agent-ready check · biz59.net/tools/agent-ready
The door: can an assistant get in?
Someone asks an assistant to find a tool and set it up. These five decide whether yours is one it can use.
An assistant decides whether to recommend you by reading. Docs that render only in a browser app, or sit behind a login, are invisible to it. Test it: fetch a docs page with curl and see whether the words are there.
A pricing page built for the eye, with a slider and a "contact us" tier, is a wall to a program. It needs three facts in text: what is counted, what one costs, where the free allowance ends.
"Quota reached, resets at 00:00 UTC, upgrade at this address" lets an agent tell its user something true. A bare 400 produces a guess, and usually a retry loop.
A CAPTCHA stops the assistant doing a real job for a real customer, and the scripts it was meant to stop often get through anyway. An emailed code works for a program that has been given a mailbox; OAuth in the user's browser works when a person must approve.
An assistant picks among your functions by reading their descriptions. Eight clear ones named for what the user wants done beat sixty that mirror every endpoint. Search, list, fetch and report are useful on day one and can do little damage.
The guards: is it safe once it is in?
A key that nobody is watching, held by a program that retries. These seven decide what the worst day looks like.
Once the puzzle is gone, the limits are the guard. Without them one script opens a thousand trial accounts and spends your free allowance, or your email reputation, overnight.
A key nobody is watching should not be able to do everything its owner can. If your only key type is "full access", every connected assistant is an admin.
The biggest fear about handing an assistant a wallet is a loop that spends all night. A ceiling the user sets makes your product the safe choice, so say so in the docs where the agent will read it.
Not applicable if nothing in the product costs the user money per use.
Agents retry when a reply is slow. Without a key that says "this is the same request again", a retry means two invoices, two emails or two charges.
Deleting a project, sending to a whole list, issuing a refund. One misread instruction should produce a preview, not the act. The second step can be another call or a click in your own interface.
The MCP specification says servers "MUST validate that access tokens were issued specifically for them". A server that takes whatever token arrives can be steered into acting somewhere the user never approved.
Not applicable if you have no MCP server yet. Come back to it the day you add one.
When a charge or a deletion is disputed, the question will be who agreed to it. Your own log is the proof you control, and the first thing you will want when a customer says "I never asked for that".
Where this list comes from
The twelve checks are the practical end of our article agents with wallets: what MCP and agent payments mean for a small SaaS vendor, which goes through what Stripe, Visa and the MCP specification have actually shipped and what a team of five should do about it. How to charge a customer that is a program is in per seat, per use or per result.
If the product itself was built quickly with AI tools, run the launch checklist first: access rules and leaked keys matter before any agent arrives.
A checklist, not a security audit. More free tools: biz59.net/tools.