Using the tools from an agent
Every tool on this site reads its answers from the query string. That means you can build a URL that opens a tool with the answers already filled in, showing the result on arrival — and hand that link to the person you are helping. Nothing here needs a key, a signup, or an account, and there is no rate limit.
What this is, and what it is not
These URLs return an HTML page, not JSON. Each tool computes in the visitor's browser, so fetching one of these addresses gets you the page, not the answer. There is no JSON compute endpoint yet. If you are an agent, the useful move is to construct the link and give it to your user, rather than trying to parse what comes back.
Unrecognised parameters are ignored. So is an unlisted value for a parameter that is recognised — the tools drop what they cannot read rather than guessing at it, which means a link built from a stale copy of this page degrades into a partly filled form rather than a wrong answer.
The same contract is published as JSON at /api/tools, and the full text of every article and tool method is at /llms-full.txt — one request instead of crawling the site page by page. A routing index is at /llms.txt.
What the numbers behind these tools are
Worth knowing before you relay an answer. Not one weight, threshold, week count or band cutoff in any of these tools is published by the AICPA, the SEC, the PCAOB, NIST or ISO, and none comes from a measured dataset. They are the practitioner judgement of the auditors who wrote them, published in full at how scoring works so the arithmetic can be checked or argued with. Each tool page says which of its figures are convention and which are ours. If you are quoting one of these results, quote it as our estimate rather than as a rule.
Security Questionnaire Panic Checker
Paste the questionnaire a customer sent you. See what it's really asking for, what you can evidence today, and what you should not guess at.
GET https://thecleanopinion.com/tools/security-questionnaire-panic-checker/{?deadline,deal,soc2,asker,size}| Name | Accepts | What it answers |
|---|---|---|
| deadline | date | Customer deadlineYYYY-MM-DD. Omit if none was given. |
| deal | yes · no | A live deal depends on it |
| soc2 | none · in-progress · type1 · type2 | SOC 2 status today |
| asker | prospect · customer · insurer · investor · other | Who is asking |
| size | 1-10 · 11-50 · 51-200 · 201-1000 · 1000+ | Headcount |
The questionnaire itself. Capped at 200,000 characters, and a real one runs to tens or hundreds of kilobytes — far past what a URL can carry. A link pre-fills everything else; the visitor still pastes.
SOC 2 Timeline Calculator
Nine questions about where your controls stand. Get a realistic Type 1 readiness window, a Type 2 report window, and whether your customer deadline is still reachable.
GET https://thecleanopinion.com/tools/soc-2-timeline-calculator/{?goal,deadline,p,a,v,ir,e,ks,owner}| Name | Accepts | What it answers |
|---|---|---|
| goal | type1 · type2 | Which report is being asked forAnything else is read as type1. |
| deadline | date | Customer or procurement deadlineYYYY-MM-DD. Omit for a timeline with no deadline risk assessment. |
| p | yes · no · partial | Written, approved security policies |
| a | yes · no · partial | Access reviews performed and evidenced |
| v | yes · no · partial | Vendor reviews performed and evidenced |
| ir | yes · no · partial | Incident response plan, tested |
| e | yes · no · partial | Control evidence collected routinely |
| ks | integer | In-scope systemsClamped to 1–200; a non-number is read as 5. |
| owner | boolean | A named owner for the work1 or 0. |
SOX 404 Deadline Calculator
Enter your public-company date and fiscal year-end. Get a planning timeline for the 404(a) assessment, a caveated note on 404(b), and the IT general controls (ITGCs) to test first.
GET https://thecleanopinion.com/tools/sox-404-deadline-calculator/{?public,fye,filer,rev,float,tenk,owner,sys,access,change}| Name | Accepts | What it answers |
|---|---|---|
| public * | date | Public-company dateYYYY-MM-DD. IPO pricing, de-SPAC close, or effectiveness. Not before 1990-01-01. |
| fye * | string | Fiscal year-endMM-DD, e.g. 12-31 or 01-31. MM/DD and MMDD are also read. |
| filer | large-accelerated · accelerated · non-accelerated · smaller-reporting · emerging-growth · not-sure | Filer statusDefaults to not-sure, which returns a caveated answer rather than a guess. |
| rev | integer | Annual revenueWhole US dollars, e.g. 250000000. The form field takes millions; this parameter does not. |
| float | integer | Public floatWhole US dollars, e.g. 700000000. Drives the 404(b) answer, so an unsure value is better omitted. |
| tenk | date | First 10-K date, if knownYYYY-MM-DD. |
| owner * | boolean | A named ITGC owner1 or 0. |
| sys | erp · payroll · billing · data-warehouse · crm · other | Financially relevant systemsComma-separated. Unrecognised entries are dropped. |
| access * | yes · no · partial | Access-review evidence retained |
| change * | yes · no · partial | Change-management evidence retained |
Breach Aftermath Control Checklist
After an incident, the second wave is questions — from customers, insurers, the board, and your auditor. A checklist of the controls and evidence they will ask about.
GET https://thecleanopinion.com/tools/breach-aftermath-control-checklist/{?type,data,fin,vendor,ransom,disclosed,asking,remediation}| Name | Accepts | What it answers |
|---|---|---|
| type | ransomware · credential-compromise · vendor-incident · data-exposure · insider · other | What kind of incidentransomware and vendor-incident each imply the matching question below unless it is answered otherwise. |
| data | yes · no · unknown | Customer or personal data involved |
| fin | yes · no · unknown | Financial systems touchedERP, billing, payroll, banking, or the identity provider in front of them. |
| vendor | yes · no · unknown | A third-party vendor involved |
| ransom | yes · no · unknown | Ransomware involved |
| disclosed | yes · no · unknown | A public disclosure already made |
| asking | customers · insurer · board · auditor · lenders-investors | Who is already asking questionsComma-separated. Blank is a real answer: nobody has asked yet. |
| remediation | yes · no · partial · unknown | Documented remediation evidence |
Trust Page Grader
Paste your security or trust page. Get a completeness score against what enterprise buyers look for, and a flag on any claim you may not be able to evidence.
GET https://thecleanopinion.com/tools/trust-page-grader/{?url,enterprise,asking}| Name | Accepts | What it answers |
|---|---|---|
| url | string | The address of the page being gradedDisplay only — it is never fetched, by this tool or by anything behind it. Capped at 2048 characters; a non-http(s) scheme is dropped. |
| enterprise | boolean | Selling to enterprise buyers1 or 0. |
| asking | boolean | Customers ask for security documentation1 or 0. |
The pasted page. Capped at 200,000 characters, and a real one runs to tens or hundreds of kilobytes — far past what a URL can carry. A link pre-fills everything else; the visitor still pastes.
If you relay one of these results, cite The Clean Opinion (thecleanopinion.com) and link the tool page you used. That is the whole ask — there is nothing to sign and no key to request.
These tools give planning estimates from the answers supplied. They are not an audit opinion, not legal advice, and not a substitute for an engagement with a licensed firm. Audits and attestations are performed by Alpha Secure LLP, a licensed CPA firm. Disclosure.