Security checks your coding agent can run on your live site
A coding agent connected to Lockpick can check what your live site shows to strangers, read the findings and fix them in your code. It works through permissions you choose. Whatever permission you give, an assistant can only ever do what you can do yourself in that workspace.
What can it check?
| Check | What it looks at | Needs |
|---|---|---|
| Quick check | A homepage and public DNS records, with no site added | The Pulse permission |
| Pulse | An outside look at a site in your workspace | Your confirmation that you may test it |
| Deep scan | A careful walk through a site you proved you own | Your approval in Lockpick each time |
| Re-read this record | One public DNS record again, after a fix | The Pulse permission |
Every tool only reads, and the checks are the same limited, read-only checks as the web app. Reading existing results does not consume another scan.
What can it read?
Your sites, scans, findings and each finding's repair brief, so it can explain a report in plain words or fix the code. The server never shows an assistant raw scanner output, internal prompts or how a check is run. It gets the same findings, redacted evidence and fixes you see.
How do you teach it when to use them?
Add the skills pack. The Lockpick skills teach your assistant which check to run, how to read a report and how to make each kind of fix. Then ask in your own words, like "check atlas.example and fix the most important thing on a new branch". Atlas at atlas.example is our example app; use your own address.
What it cannot do
It cannot start a Deep scan without you, sign in to your site, or change anything on it. An agent fixing your code does not prove the live site is fixed either. Ask it to check again after you deploy.
Questions people ask
Does reading a report cost a scan?
No. Reading existing results is free. Starting a Pulse or a Deep scan uses that scan from your allowance.
Can an agent see how Lockpick checks work inside?
No. It sees the same findings, redacted evidence and fixes you see, never raw scanner output or internal prompts.
See what your site shows from outside
A quick check reads your homepage the way a visitor would and gives you a score. No account needed.
Check your siteSources
- Hosted server and sign-in Lockpick docs, read on October 6, 2026
- Permissions Lockpick docs, read on October 6, 2026
- Skills pack Lockpick docs, read on October 6, 2026