> ## Documentation Index
> Fetch the complete documentation index at: https://docs.noscope.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Target and scope

> Before the agent starts probing, it needs to know what's fair game and what to stay away from. That's what this step captures. Getting scope right is the sin...

Before the agent starts probing, it needs to know what's fair game and what to stay away from. That's what this step captures. Getting scope right is the single biggest thing you can do to keep a pentest useful and safe.

## What you'll configure

<Steps>
  <Step title="In-scope domains">
    The domains, subdomains, and URLs the agent is allowed to actively test. Add as many as you need. Anything you put here is fair game for the agent to probe.
  </Step>

  <Step title="Out-of-scope domains">
    The things the agent has to leave alone. Payment processors, third-party SaaS integrations, internal admin panels owned by another team, anything with a separate ownership boundary or anything fragile. The agent treats this list as a hard wall. Even if a redirect tries to push it toward one of these hosts, it won't follow.
  </Step>

  <Step title="Scope notes">
    Free-form text where you give the agent more context on what's in scope and how things relate. Things like 'the /api path is GraphQL, not REST', 'admin routes live on a separate subdomain and need their own test account', or 'only the customer-facing checkout matters, the internal dashboard is out of scope' all belong here. The agent reads this before every scan and uses it to decide what it's looking at and how to prioritize. More specific notes translate directly into more useful scans.
  </Step>

  <Step title="Rate limit (coming soon)">
    A cap on how many requests per second the agent sends to your target. Useful for older systems or production environments where you want to guarantee the agent stays polite. This is on the roadmap. For now the agent moves at its natural pace.
  </Step>
</Steps>

## What we recommend before your first scan

* Turn off your WAF or CDN protection for the agent, or allowlist the agent IP shown in the application setup. Otherwise your scan ends up measuring your WAF, not your app.
* Make sure test accounts are provisioned and the credentials are current.
* Pause any alerts that would page your on-call, or route them somewhere quiet. A pentest looks a lot like a real attack to a SIEM.
* If you have rate limiters or account lockouts on the login flow, coordinate with your team so the test user doesn't get locked out mid-scan.

If something on this list isn't possible in your environment, mention it in the scope notes. The agent can adapt, but only if it knows what it's dealing with.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.