The privacy monitor your AI agents run

RegSentry watches the sites you ship for trackers, session replay, ad pixels, AI chat widgets and browser-side AI API calls that fire before a visitor consents or after they reject. Your coding agent, your CI and your scripts drive it through one API key: an MCP server and a REST API.

Six public tools work with no key. Send Authorization: Bearer rs_live_... and the same endpoint adds 12 tools that operate your RegSentry account.

Quickstarts

Create a key first (see Get a key). The same key works for MCP and the REST API.

export REGSENTRY_API_KEY=rs_live_...
claude mcp add --transport http regsentry https://regsentry.com/mcp --header "Authorization: Bearer $REGSENTRY_API_KEY"

{
  "mcpServers": {
    "regsentry": {
      "url": "https://regsentry.com/mcp",
      "headers": { "Authorization": "Bearer rs_live_..." }
    }
  }
}

{
  "mcpServers": {
    "regsentry": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://regsentry.com/mcp", "--header", "Authorization:${REGSENTRY_AUTH}"],
      "env": { "REGSENTRY_AUTH": "Bearer rs_live_..." }
    }
  }
}

curl -s https://regsentry.com/api/v1/checks \
  -H "Authorization: Bearer $REGSENTRY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://preview-123.vercel.app","policy":"standard","authorizationAcknowledged":true}'

# => { "check": { "status": "complete", "policy": { "result": "fail", "reasons": [...] }, ... }, "exitCode": 1 }

Tools your agent gets

Public tools (no key)

Inspect the public homepage you name after confirming you own it or are authorized to inspect it. Runtime inspection also requests public resources loaded by that page; GET requests can have remote effects. No account or stored scan is required.

Account tools (with Authorization: Bearer rs_live_...)

They operate your own RegSentry account through the same service layer as the REST API. What a key can do depends on its scope and your plan.

Get a key

1. Sign in and open the owner dashboard. Find the API & agents card.
2. Name the key (one per agent, repo or machine is easiest to revoke) and pick a scope: read; read + scan to add sites and run scans and checks; or read + scan + manage to also remove sites and manage webhooks.
3. Copy the rs_live_... token. It is shown once. Store it as REGSENTRY_API_KEY or a CI secret.

Up to 10 active keys per account. Revoke a key from the same card at any time. Keys are rate limited to 300 requests per minute each.

What each plan unlocks

The public MCP tools and the free homepage scan need no plan. Account access follows the plan on the key's account. API runs count scans and deploy checks started through the API, MCP or CI.

Consent phases means every run stores a before consent, after reject and after accept observation. Details and checkout on pricing.

Example prompts

Add shop.example.com to RegSentry with the standard policy and turn on monitoring.

Run a deploy check on https://preview-123.vercel.app. If it fails, show me what fired
after reject and apply the RegSentry playbook for each tool.

What changed on my sites this week? List new findings with their observation dates.

Export the evidence report for shop.example.com and summarize the limitations section.

Create a webhook to https://hooks.example.com/regsentry for consent.regression and check.failed.

Boundaries