Inside the Full-Site AI Agent: How Decloak Investigates an Entire Site (And Shows Its Work)
A single-page scan is fast and useful, paste one URL, get a complete 8-layer security snapshot in under 15 seconds, no account needed. But most real sites aren't one page. They're a homepage, a login flow, a checkout, a handful of API-backed dashboard views, and a dozen forgotten marketing pages nobody's touched since launch. Checking one URL tells you about that one URL.
The full-site AI agent, available on Starter and above, is what checks the rest.
It decides what's worth investigating, not just what's linked
Rather than blindly crawling every URL it can find, the agent investigates your entire site, or a scope you define, and runs the full 8-layer analysis on every page it decides is actually worth the depth. That distinction matters: a flat crawler treats a contact page and a login form identically. An agent that's reasoning about what it's finding treats them differently, because they carry different risk, and a scan that spends equal time on both is wasting the time it should be spending on the one that matters more.
You can watch it think
This is the part that sets it apart from a scanner running silently in the background: the live reasoning trace shows the agent's decisions in real time as it works. Every step is logged alongside the finding that triggered it, so instead of a black box that eventually returns a report, you get a visible chain of reasoning, this page had an interesting third-party script, so it looked closer; that CMS fingerprint matched a known CVE pattern, so it checked the version.
Beyond being genuinely interesting to watch, this doubles as an audit trail. If you need to explain to an auditor, a client, or your own team why a particular finding was flagged, the reasoning that led there is already recorded, not something you have to reconstruct after the fact.
What the agent actually does once it decides to dig in
A few of its deeper investigation capabilities go beyond what a single-page scan covers on its own:
Source map analysis. When the agent finds an exposed .map file, it doesn't just flag that one exists, it fetches it and reconstructs the original source to check for hardcoded secrets and internal architecture leaks. We covered why exposed source maps matter in more depth previously, this is the mechanism that actually checks for it rather than just detecting the file's presence.
GTM container deep-dive. Rather than stopping at "a Google Tag Manager container exists," the agent fetches and parses the full tag configuration, nested tags, custom HTML tags, variable definitions included, so a tag quietly firing data somewhere it shouldn't gets caught rather than waved through because it's sitting inside a trusted-looking container.
Domain threat intelligence. Every third-party domain the site contacts gets checked against a live malware and phishing database, and flagged for suspicious registration patterns, unusual TLDs, numeric-heavy names, the kind of signal that's tedious to check by hand across dozens of third-party scripts but trivial for an agent to check on every single one.
Per-finding remediation. Every finding gets AI-written remediation advice specific to that exact finding, not generic guidance. This is also what feeds the Priority Remediation Plan, so the ranked top-25 fix list isn't just prioritized, every item already has an answer for "how do I actually fix this" attached.
Why this matters more as sites get bigger
A single forgotten page with a missing header is a minor finding. The same missing header repeated across forty pages because it's set at a template level is a pattern worth understanding structurally, and that's a different kind of insight than a page-by-page checklist gives you. The agent is built to surface exactly that: not just what's wrong on each page, but what's wrong at the level of the site as a whole.
Availability
The full-site AI agent, live reasoning trace, source map analysis, GTM deep-dive, domain threat intelligence, and per-finding remediation are all available on Decloak Starter and above. Free accounts get the single-page instant scan, still a full 8-layer check, just scoped to one URL at a time.
The full-site AI agent is available on Decloak Starter and above. See plans →