This Static reports doc explains how free scans finish 30 checks in under 10 seconds (ruleset v23).

Static reports

A report is a self-contained, static HTML page rendered from one scan (or two, side by side). Nothing below is generated — it is the exact output of the deterministic scanner, rendered client-side safe so the link can be pasted into Slack, docs, or a pull request without exposing your API key.

Create a report

MCP: export_report with { urls: ["https://example.com"], mode: "single" } — free callers get the aggregate report, Pro/Team callers get the detailed one.
HTTP: POST https://aeogeo.site/api/reports with { "urls": ["https://example.com/a", "https://example.com/b"], "mode": "compare" }. Keyed reports need Authorization: Bearer <key>.

What you get back

The response returns a private https://aeogeo.site/r/<id> link. The id is 128 bits of randomness — only people with the URL can open it. Reports expire after 90 days.

Formats

?format=html (default) — zero client JS, inline CSS, pinned ruleset version, methodology block
?format=md — Markdown export
?format=json — same JSON the API returns
&download=1 — adds Content-Disposition: attachment

Compare mode

Two URLs, side by side group grades — at most two.
Keyed compare reports add a per-rule delta.

Invariants

Reports store scan findings only — never page content; opt-in per report; TTL; deletable by the owning key.
Free reports are aggregate-only: no rule IDs, evidence, selectors, or severity.
No badge or embed widgets are shipped.