# CloneSentry — guidance for AI agents

## What this product does

CloneSentry is a brand-protection service. Given a brand domain, it:

1. Generates high-signal lookalike variants and resolves active domains, hosts, registrars, age, and DNS.
2. Collects evidence per finding: screenshots, copied-text signals, branded search (Search Console) diversion data, SERP positions, and Meta Ad Library matches.
3. Computes a Clone Score and recommends an enforcement route: DMCA, trademark, phishing abuse, de-indexing, ad complaint, registrar report, UDRP packet, or monitor-only.
4. Drafts enforcement documents, but never sends them automatically. Every outbound notice requires explicit human approval and sender attestation.

CloneSentry provides evidence preparation and triage, not legal advice.

## Key routes

| Route | Purpose | Auth |
| --- | --- | --- |
| `/` | Landing page: hero scan form, how it works, pricing, FAQ | Public |
| `/scan` | Free scan flow (primary no-signup action) | Public |
| `/blog` | Guides on brand protection | Public |
| `/contact` | Contact page | Public |
| `/privacy`, `/terms` | Legal documents | Public |
| `/dashboard` | Account overview after sign-in | Authenticated |
| `/findings`, `/cases`, `/evidence`, `/action` | Scan results and enforcement workflows | Authenticated |
| `/settings` | Brand management and billing | Authenticated |
| `/admin` | Internal admin | Restricted |

## How agents should interact

- The primary public action is the free scan form on `/` (a GET form to `/scan` with the `primaryDomain` field). It is tagged with `data-agent-form="free-scan"` and its submit button with `data-agent-action="run-free-scan"`.
- Primary CTAs carry `data-agent-action` and `data-testid` attributes; the primary navigation is tagged `data-agent-nav="primary"`.
- Destructive actions (for example deleting a monitored brand in `/settings`) are tagged `data-agent-danger` and `data-agent-confirm`; do not trigger them without explicit human instruction.
- Machine-readable manifests: `/.well-known/agent-card.json` and `/.well-known/ai-agent.json` (guardrails included).

## Guardrails

Allowed without special permission:
- Reading public pages (/, /scan, /blog, /contact, /privacy, /terms).
- Submitting the free scan form with a domain the user has provided.

Disallowed:
- Signing up, signing in, or managing authentication on behalf of a user.
- Purchasing, upgrading, downgrading, or canceling any plan, or interacting with Stripe checkout.
- Deleting brands or any other destructive action (`data-agent-danger`) without explicit human confirmation.
- Sending, approving, or submitting enforcement notices or legal complaints.
- Accessing authenticated areas without the user's own session and instruction.

## Contact

- Support: support@clonesentry.com