Security audit
Security checks for vulnerabilities and agentic risk
The skill’s searches, business submissions, and owner-authorized promotions fit its stated purpose, with ordinary privacy and credential precautions.
Choose which contact details and owner email BETAP may receive. Provide a business key only for promotions you authorize, protect stored keys, and revoke access when finished. Publisher identity and live API behavior could not be independently verified.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
2. **Propose:** suggest a real business that should be on BETAP. You need your own agent key, which is free and self-service.
3. **Publish promotions:** for a business whose owner gave you their business key.
Base URL: `https://api.betap.world/api`
## Rules (read first)
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## 1. Read (no key)
MCP server, Streamable HTTP, JSON responses: `POST https://api.betap.world/api/mcp`
| Tool | What it does |
|---|---|
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
| obtener_lugar | Gets one cultural place with its sources. |
curl -s https://api.betap.world/api/mcp -H 'content-type: application/json' \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"buscar_negocios","arguments":{"q":"tacos","ciudad":"San Miguel el Alto","limite":5}}}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Check status:
curl -s https://api.betap.world/api/agentes/negocios -H "Authorization: Bearer $BETAP_AGENT_KEY"
# estado: nuevo | contactado | afiliado | descartado
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
| obtener_lugar | Gets one cultural place with its sources. |
curl -s https://api.betap.world/api/mcp -H 'content-type: application/json' \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"buscar_negocios","arguments":{"q":"tacos","ciudad":"San Miguel el Alto","limite":5}}}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Get your key once. It is shown only once, so store it securely:
curl -s -X POST https://api.betap.world/api/agentes/registro -H 'content-type: application/json' \
-d '{"nombre":"My Agent","descripcion":"What you do, who runs you","contacto":"how a human can reach your operator"}'
# -> {"clave":"btp_ag_...","docs":"..."}
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Propose a business:
curl -s -X POST https://api.betap.world/api/agentes/negocios \
-H "Authorization: Bearer $BETAP_AGENT_KEY" -H 'content-type: application/json' \
-d '{
"nombre": "Panadería La Espiga",
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -s https://api.betap.world/api/agente-negocio/promos -H "Authorization: Bearer $BETAP_BUSINESS_KEY"
# Publish (Pro/Premium plans; ends within 90 days)
curl -s -X POST https://api.betap.world/api/agente-negocio/promos \
-H "Authorization: Bearer $BETAP_BUSINESS_KEY" -H 'content-type: application/json' \
-d '{"titulo":"2x1 en cafés hoy","descripcion":"De 5 a 7 pm","vigencia_fin":"2026-10-30"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
-d '{"titulo":"2x1 en cafés hoy","descripcion":"De 5 a 7 pm","vigencia_fin":"2026-10-30"}'
curl -s -X PATCH https://api.betap.world/api/agente-negocio/promos/123
-H "Authorization: Bearer $BETAP_BUSINESS_KEY" -H 'content-type: application/json' -d '{"activa":false}'
The workflow instructs the agent to include the user's email whenever the user owns the business, without separately establishing permission to disclose that address. Requesting a business listing does not necessarily authorize sharing a private email for onboarding or outreach, so an agent could transmit an address obtained from other context without informed consent.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# See the business and its promotions
curl -s https://api.betap.world/api/agente-negocio/promos -H "Authorization: Bearer $BETAP_BUSINESS_KEY"
# Publish (Pro/Premium plans; ends within 90 days)
curl -s -X POST https://api.betap.world/api/agente-negocio/promos \
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# See the business and its promotions
curl -s https://api.betap.world/api/agente-negocio/promos -H "Authorization: Bearer $BETAP_BUSINESS_KEY"
# Publish (Pro/Premium plans; ends within 90 days)
curl -s -X POST https://api.betap.world/api/agente-negocio/promos \
No suspicious patterns detected.