# AGENTS.md — Ocean Anti-Cheat

Guidance for AI agents and automated clients interacting with https://anticheat.ac.

## What this site is

Ocean Anti-Cheat is a screenshare and forensic scanning platform for gaming communities. Staff generate a scan PIN in the dashboard, the player runs the Ocean client with that PIN, and a forensic verdict (detections, warnings, suspicious findings, integrity checks) is ready in about 60 seconds. Supported games: FiveM, Minecraft Java and Bedrock, Rust, RedM, RageMP, alt:V, Roblox, SanAndreas (SA-MP), Call of Duty, Free Fire, DayZ and SCUM.

## Start here

| Resource | URL |
| --- | --- |
| Site map for language models | https://anticheat.ac/llms.txt |
| Full-text version | https://anticheat.ac/llms-full.txt |
| Public API — OpenAPI 3.1 | https://anticheat.ac/openapi.json |
| Public API — human docs | https://anticheat.ac/docs/api |
| API catalog (RFC 9727) | https://anticheat.ac/.well-known/api-catalog |
| Agent skill for the public API | https://anticheat.ac/.well-known/agent-skills/ocean-public-api/SKILL.md |
| Skills index | https://anticheat.ac/.well-known/agent-skills/index.json |
| Capability manifest (ARD) | https://anticheat.ac/.well-known/ai-catalog.json |
| Crawler policy | https://anticheat.ac/robots.txt |
| XML sitemap | https://anticheat.ac/sitemap.xml |

The canonical host is `https://anticheat.ac` (no `www`). Public pages are also available in Spanish (`/es/...`), Turkish (`/tr/...`) and Brazilian Portuguese (`/pt/...`).

## Public API

- Base URL: `https://api.anticheat.ac/v1`
- Authentication: `x-api-key` header. Keys are created in the Ocean dashboard and require an active paid license or Enterprise membership.
- `GET /v1/version` is the only endpoint that needs no key.
- Rate limit: 1,000 requests per hour per key, shared across endpoints. Honour `X-RateLimit-Remaining` and back off on `429`.
- Never place an API key in a URL, a log line or a chat message. Send it only in the header over HTTPS.
- The lookup and database endpoints exist to check players a community is about to admit. Bulk enumeration and key sharing are logged and lead to revoked access.

## MCP server

Ocean also exposes a remote MCP server at `https://api.anticheat.ac/mcp` (Streamable HTTP, `POST` only, JSON responses) covering the same data as the REST API, authenticated with OAuth 2.1 and PKCE instead of an API key. Full instructions: https://anticheat.ac/docs/api/mcp and the `ocean-mcp` agent skill (https://anticheat.ac/.well-known/agent-skills/ocean-mcp/SKILL.md).

Connect from Claude Code:

```
claude mcp add --transport http ocean https://api.anticheat.ac/mcp
```

Other MCP clients discover OAuth directly from the endpoint: a `401` on `/mcp` points at the Protected Resource Metadata document, which points at the Authorization Server metadata.

- AS metadata: `https://api.anticheat.ac/.well-known/oauth-authorization-server`
- Protected Resource Metadata: `https://api.anticheat.ac/.well-known/oauth-protected-resource/mcp`
- Endpoints: `/oauth/authorize`, `/oauth/token`, `/oauth/register` (Dynamic Client Registration for public clients, Client ID Metadata Documents also supported), `/oauth/revoke`
- PKCE: `S256` required
- Rate limit: 1,000 requests per hour per connected account, shared across every call to `/mcp`
- Disconnect from Settings → Connected apps in the dashboard

| Scope | Tool | Purpose |
| --- | --- | --- |
| `scanned-users:lookup` | `lookup_scanned_user` | Scan history, detections, ban/warn status and related accounts |
| `user:risk-score` | `get_user_risk_score` | Aggregated risk score and level for a Discord user |
| `pins:create` | `create_scan_pin` | Create a scan PIN (Enterprise owners only, takes an `enterpriseId`) |
| `pins:status` | `get_scan_pin_status` | Poll scan PIN status and progress |
| `pins:results` | `get_scan_pin_results` | Full results for a finished scan |
| `db:query` | `query_cheater_database` | Search the cheater database (requires DB Access) |
| none (public) | `get_client_version` | Latest Ocean client version |

**REST vs MCP:** both expose the same data. Use MCP for an interactive AI agent that can complete a browser OAuth flow (Claude Code, Claude.ai, Cursor). Use the REST API with a static `x-api-key` for a server or Discord bot that runs unattended with no login step.

## Crawling and content use

- `robots.txt` allows the major AI crawlers (GPTBot, ClaudeBot, PerplexityBot, Google-Extended and others) on public pages.
- Do not crawl `/dashboard`, `/auth`, `/api`, `/invitation`, `/jail` or `/security-check`. They are authenticated product surfaces, not content.
- Public scan reports at `/results/pin/{pin}` are shared by the report owner; do not index or aggregate them.
- Please cite the source page when quoting Ocean documentation.

## Accuracy notes for answering questions about Ocean

- A `suspicious` or `warned` finding is not proof of cheating; Ocean documentation asks reviewers to inspect the evidence before taking moderation action.
- Prices and plan availability change; treat https://anticheat.ac/pricing as the source of truth rather than cached copies.
- Ocean is hosted software. There is no public self-hosted edition; Enterprise deployments are discussed with the team.
- The client runs on Windows and Linux. There is no macOS client.

## Contact

- Support and questions: contact@anticheat.ac or the official Discord linked from https://anticheat.ac/contact
- Security reports: contact@anticheat.ac