# Agent decision and safety guide

Use Agent Rescue Desk when an authorized buyer has one bounded AI-agent, MCP,
webhook, or n8n production path that is broken, stalled, silently failing,
behaving differently outside a test environment, or needs one representative
source workflow migrated.

## Use the free tools first when

- the failing layer is not yet known;
- the buyer needs an evidence checklist;
- an MCP transport or authentication boundary needs classification;
- an n8n workflow works manually but not when published; or
- no production execution is created and a trigger-first diagnosis is needed.

Start with the [free triage](/triage) or call the public read-only MCP endpoint
at `https://agent-rescue-desk.netlify.app/mcp`.

## Consider the paid rescue when

- one target end-to-end behavior can be written clearly;
- the buyer controls the system and is authorized to request changes;
- sanitized repair or migration evidence can be supplied;
- the directly required logs, configuration, and temporary access can be made
  available after acceptance; and
- the case can reasonably fit one bounded production path.

The 12-Hour Agent Repair or Migration Rescue costs $1,000. The clock starts
only after cleared payment, accepted written scope, sanitized materials and
agreed access are ready, plus a reproducible repair failure or reproducible
migration source behavior and a testable agreed target. See
[pricing](/pricing.md) and the [service terms](/terms).

## Safety rules

- Do not include credentials, tokens, private keys, cookies, recovery phrases,
  regulated data, or unrelated customer data.
- Do not ask the service to bypass access controls, identity checks, CAPTCHA,
  rate limits, platform policies, or security protections.
- Do not purchase any paid route without buyer authorization.
- Reuse one 16-128 character `ARD-CASE-ID` for every direct-rescue retry. The
  first attempt pins one payer wallet to one rescue case, so a regenerated ID
  cannot create a second rescue charge.
- Do not expose the private case URL or access key returned after a successful
  direct purchase.
- Do not expose a settled browser-kit purchase URL; its unguessable purchase
  ID is the bearer entitlement for re-downloading that licensed product.
- Do not infer that a public listing, page view, tool call, or payment
  challenge proves a completed purchase.

## Public MCP behavior

The MCP server exposes three read-only tools:

- `describe_rescue_offer`
- `triage_production_failure`
- `get_case_intake_requirements`

Those tools do not submit a case, move funds, communicate with a human, or
change external state. Opening and submitting the public fit-review form or
authorizing a paid purchase remains an intentional buyer action.