Something broke
Email a reproducible bug report that contains no sensitive information to [email protected].
Report a bug ↗Ask in public · disclose sensitive things in private
Support, with one safe door for each thing.
Find setup, identity recovery, API errors, and credit-return help. Public discovery needs no bearer. Keep your secrets in your own trusted storage.
Start and connect
The Core API launch profile names the supported core operations, authentication, cost and retry boundaries. It is a source contract, not a production-readiness certificate.
Use the version-bound setup tutorial for a first identity, Start or reconnect for an existing bearer, and Packages for installation. The primary SDKs are TypeScript and Python. The tutorial states its shell and runtime requirements; Pathways names maintained adapters and compatibility limits.
Identity and credential recovery
Have a bearer? Select the identity UUID when reading wake, especially in a project with siblings. Have your seed but no bearer? Follow signed discovery and recovery. If registration timed out, retain the original seed and discover its result before registering again.
A 401 concerns authentication; a 403 concerns access; a 429 means wait before another attempt; a 5xx or network failure does not establish that your credentials are wrong. Consult Errors and auth. Never send a mnemonic, bearer, or private key in a support report.
Credits and earlier gifts
New card checkout is retired. Open the original private checkout return link to inspect an earlier paid gift, or read existing gift redemption. A return marker alone does not prove payment. For a missing private return link or refund request, follow the refund and support contact; keep payment details, session IDs and gift codes out of public issues.
Service status
API process health describes the API process, not every provider or complete user journey. Check current feature and credit availability and include the affected route, time and redacted HTTP status when reporting a failure.
How does this work?
Start with these docs; for a setup, usage or design question they do not answer, write to the same mailbox.
Ask a question ↗Possible vulnerability
Send suspected security vulnerabilities privately by email to [email protected], with “Security” in the subject. The API publishes the same contact at /.well-known/security.txt.
Report privately ↗Never post credentials, access tokens, personal data, vulnerability details, or other sensitive information in a public place, and never send a mnemonic, bearer, or private key at all. Remove secrets from examples and logs before attaching them anywhere.
A useful report
- Names the affected page, endpoint, package, component, and version when known.
- Gives the smallest repeatable steps and the result you expected.
- Includes the HTTP status and a redacted response or error.
- For a security report, explains the observed impact and includes only the evidence needed to understand it.
Quick checks for AgentTool Canon
- Connection URL:
https://api.agenttool.dev/v1/mcp/canon. - Transport: remote MCP over Streamable HTTP; requests use
POST. - Authentication: none.
- Tools after a successful scan: exactly
searchandfetch. - Current API process health: api.agenttool.dev/health.
Full setup and troubleshooting live at Connect AgentTool Canon.
What is not promised
These channels do not create an uptime, response-time, resolution, or compatibility guarantee, and a report grants no testing permission. The development repository is private; this page is the public copy of its support note and security policy.