method

How a guide gets made, and why you can check it.

Registering an OAuth app is rarely the hard part. The surprises are the gates: Google's CASA assessment for reading Gmail, Slack's 10-install prerequisite and up to 10-week review, LinkedIn's business vetting where a rejection burns the app. So every guide leads with the verdict and a timeline that separates your work from waiting, then shows the paths that avoid or shorten the wait.

Plan→Read→Follow→Probe→Write→Check
live agent pipeline

Six steps, two of them checked by code

  1. 01
    Plan
    The LLM (reasoning off, for speed) identifies the app and proposes 5–8 official doc URLs: developer portal, OAuth guide, review/partner program, scopes, rate limits.
  2. 02
    Read
    Each URL is actually fetched, plus the docs host's llms.txt index when published. Dead links, 404s, login pages, JS-only shells and duplicates are dropped and shown in the transcript.
  3. 03
    Follow
    Links from llms.txt and the pages read are ranked by OAuth/review vocabulary, and the model picks up to 5–7 more to read.
  4. 04
    Probecode-checked
    Real GETs to /.well-known/openid-configuration and the authorize endpoint with a fake client_id. This shows the endpoints exist and how they fail.
  5. 05
    Write
    DeepSeek V4.1 Flash (reasoning on, streamed live) writes the guide from numbered sources only, constrained by a JSON schema. Every claim is tagged tested / sourced / inferred with source ids.
  6. 06
    Checkcode-checked
    Code, not the model, enforces the evidence rules. Citations to unread pages are stripped. For every sourced claim the model must quote the supporting sentence verbatim, and code confirms that sentence exists in the page. If it doesn't, the claim is downgraded to inferred. Links are re-checked.
evidence levels

Every claim wears a label

tested
Observed directly: an HTTP probe, or a manual attempt.
sourced
Stated in a cited page that was actually fetched, with the sentence quoted and checked.
inferred
Judgement, estimates, or third-party claims. A lead, not a fact.
who does what

Where the agent stops and you take over

agent can
  • ■Research the provider's docs
  • ■Choose minimal scopes
  • ■Draft scope justifications and partner emails
  • ■Pre-fill app registrations (GitHub URL params, Slack manifests)
you do
  • ■Sign in to the provider console
  • ■Your legal identity and payment
  • ■Record the demo video reviewers ask for
  • ■Wait on the provider's decision

The agent deliberately never signs in or creates accounts.

scaling to 100 apps

Same agent, a human on the inferred claims

Run the agent over Composio's OAuth toolkit list (managed and bring-your-own). A human reviews the inferred claims and timeline numbers before a guide is marked verified. Guides carry an "accessed" date per source, so a scheduled re-run can diff them when providers change.