Skip to content
AdminKit

Acceptable Use Policy

AdminKit exists to help people secure their own networks, devices and AI agents. This policy sets the limits that keep its tools, API and MCP server from being used against anyone else, explains how we enforce them, and is part of the Terms of Service.

Effective and last updated · Version 1.1

What changed in v1.1

  • Section 3 now lists API abuse and key sharing as their own item, instead of only as an example under "circumvent rate limits".
  • Section 3 now spells out that using results obtained through AdminKit to attack anyone is prohibited, not just building target lists.

1. Purpose

Security tools can be misused for reconnaissance. We design AdminKit so that active checks run only against targets the user controls, and we expect every user to respect that.

2. What you may do

  • Look up public DNS, mail-authentication and registry information for any domain.
  • Run active checks on your own IP address (after confirming you manage that network), on assets you have verified in AdminKit, or on assets whose owner has authorised you in writing.
  • Share results with the people who need them to fix a problem.
  • Use the API and MCP server within your quota for your own tools and agents.

3. What you must not do

  • Scan, probe, fingerprint or test systems, networks or devices you do not own or are not authorised to test, or use AdminKit, or results obtained through it, to build target lists, plan, or carry out an attack on anyone.
  • Attempt to log in to, exploit, disrupt or gain unauthorised access to any system, including by password guessing or credential stuffing.
  • Launch or facilitate denial-of-service attacks, or send traffic intended to overload AdminKit or anyone else.
  • Misuse the API or an API key issued to you: share, sell, publish or embed it in public code, let anyone outside your organisation use it, or let it be used to impersonate you (API abuse and key sharing).
  • Circumvent rate limits, quotas, verification or abuse controls, for example by rotating IP addresses or creating multiple accounts.
  • Scrape the website or resell, sublicense or redistribute results or data at scale, except as allowed by your plan.
  • Use AdminKit to monitor or track individuals (for example family members or employees) without a lawful basis and their knowledge where the law requires it.
  • Upload or transmit malware, or content that is unlawful, infringing or harmful.
  • Publish vulnerabilities of third-party systems discovered through AdminKit before their owner has had a reasonable chance to fix them.
  • Use AdminKit in violation of sanctions, export-control or any other applicable law.

4. Security research on AdminKit itself

Good-faith research on AdminKit's own services is welcome under our security policy: avoid privacy violations and service disruption, do not access other users' data, and report findings to [email protected]. Research sensors (honeypots) operated by AdminKit are out of scope.

5. Enforcement

We may monitor use for abuse, and we may warn, rate-limit, block IP ranges, revoke keys, suspend or terminate access, remove content, and report unlawful activity to authorities or affected parties, with or without notice. We decide in our discretion what counts as a violation.

6. Reporting abuse

If you believe AdminKit is being used against your systems, email [email protected] with the source IP addresses, times (with time zone) and a description. We aim to respond within 2 business days.