llms.txt
# LaunchSafe
> LaunchSafe builds AI agents that pentest your software. Connect a repository, and each finding comes back with a proof you can replay and a fix you can merge.
## Pages
- [Home](https://launchsafe.com/): Agentic pentesting for web apps, iOS and Android apps, APIs, and LLM apps and agents.
- [About](https://launchsafe.com/about): Who builds LaunchSafe and what the company believes.
- [Security](https://launchsafe.com/security): How LaunchSafe protects customer data.
- [Blog](https://launchsafe.com/blog): Research and product posts.
- [Free security tools](https://launchsafe.com/tools): Passive checks anyone can run, without an account.
## Free security tools
Each tool is passive: it reads public DNS, public logs or public databases, or makes one normal request to the URL entered. None scans ports, enumerates subdomains or probes for vulnerabilities. The JWT decoder and the secret checker run entirely in the browser.
- [DNS lookup](https://launchsafe.com/tools/dns-lookup): Look up a domain's A, AAAA, CNAME, MX, TXT, NS, CAA and SOA records through Cloudflare's public resolver.
- [Email security check](https://launchsafe.com/tools/email-security): Check a domain's SPF, DMARC, MTA-STS, TLS-RPT, BIMI and DKIM records, with a plain-English verdict and the records to add.
- [Security headers check](https://launchsafe.com/tools/security-headers): Request a page once and grade its security headers, with fixes to copy for Next.js, Vercel and Cloudflare.
- [SSL certificate check](https://launchsafe.com/tools/ssl-certificate): See a domain's current TLS certificate, its issuer, names and expiry, from Certificate Transparency logs, and whether it is HSTS preloaded.
- [security.txt checker](https://launchsafe.com/tools/security-txt): Check a site's /.well-known/security.txt against RFC 9116, or generate a valid one.
- [Package vulnerability lookup](https://launchsafe.com/tools/package-vulnerabilities): Look up known vulnerabilities for an npm or PyPI package version in the OSV.dev database, with severity and the versions that fix them.
- [JWT decoder](https://launchsafe.com/tools/jwt-decoder): Decode a JSON Web Token's header and payload, and flag risky algorithms and claims. The token never leaves your browser.
- [Secret checker](https://launchsafe.com/tools/secret-scanner): Paste code or a config file to find strings that look like API keys and credentials. Everything runs in your browser.
- [Agent config check](https://launchsafe.com/tools/agent-safety): Check the files that program coding agents in a public GitHub repository: CLAUDE.md, AGENTS.md, Cursor rules, MCP servers, hooks and settings. The check runs in your browser.
## Product
- [Free repository grade](https://app.launchsafe.com/grade): Grade a public repository, free.
- [Sign up](https://app.launchsafe.com/signup)
- [Documentation](https://docs.launchsafe.com/)
