# Infervo

Infervo is a deterministic martech stack detector. Given a company website URL,
it renders the site in a headless browser and reports marketing, analytics,
CRM/ESP, ads, ecommerce, payments, consent, server-side tagging, and DNS email
infrastructure signals with evidence.

## Agent entry points

- Agent onboarding: https://staging.infervo.app/agents
- Live sample report (no auth): https://staging.infervo.app/sample/shopify-com
- OpenAPI 3.1: https://staging.infervo.app/api/cli/openapi.json
- MCP endpoint: https://staging.infervo.app/api/mcp
- OAuth protected-resource metadata: https://staging.infervo.app/.well-known/oauth-protected-resource
- OAuth authorization-server metadata: https://staging.infervo.app/.well-known/oauth-authorization-server
- Agent card: https://staging.infervo.app/.well-known/agent-card.json
- CLI docs: https://github.com/bassalat/infervo/blob/staging/docs/cli/README.md
- MCP docs: https://github.com/bassalat/infervo/blob/staging/docs/cli/mcp.md
- AI-agent guide: https://github.com/bassalat/infervo/blob/staging/docs/cli/ai-agents.md

## Auth

Use Authorization: Bearer inv_pat_... for CLI API and MCP calls, or complete the
OAuth 2.1 / PKCE connector flow for MCP clients that support remote authorization.
Tokens are scoped to read or write. Never put a token in a URL or prompt transcript.

## Scanner policy

Only scan websites you are authorized to assess. Infervo fetches and renders the
public target website server-side, performs public DNS lookups, refuses private,
loopback, link-local, reserved, and cloud-metadata targets, and runs with bounded
timeouts and concurrency.