Rate limits and quotas

Rate: 120 requests per minute per key

Every response says so in its headers: X-RateLimit-Limit (the ceiling), X-RateLimit-Remaining (what is left this minute) and X-RateLimit-Reset (when the window restarts, in Unix seconds). Past that, the API answers 429 rate_limited with Retry-After: wait that long and carry on. The MCP server follows the same limit.

To follow a scan, one request every 3 to 5 seconds is plenty.

Your plan’s quotas

Your plan gives you quick scans, full audits and fixes per project, over a 30-day period; each extra project adds its share. Once the period’s quota is used up, Rustine takes from your pack credits if you have any. Otherwise the action answers 402 (scan_quota_exceeded, audit_quota_exceeded or fix_quota_exceeded) with upgrade_url. Your plan and quotas tells you where you stand.

What costs nothing:

• reading your projects, scans and issues;
• reading a fix you already unlocked;
• scanning the same site with the same kind again within the hour: Rustine returns the recent result (reused: true) without charging anything;
• analysing a GitHub repository;
• rechecking an issue, up to 60 rechecks per project and per day.

Rustine’s ceilings

A few ceilings protect the platform and the scanned sites. You should not meet them, but your code should know what to do:

• Too many scans at once on Rustine, or the platform’s daily ceiling reached: a new scan gets 503 platform_busy. Retry in a few minutes; nothing was charged.
• Rechecks: 60 per project and per day, then 429 recheck_limit_reached.
• Repository analyses: a limited number per workspace over 24 hours, pushes included, then 429 repository_analyses_limit_reached. A recheck on a repository starts at most one analysis per quarter of an hour.

These ceilings may be tightened in case of abuse, without notice: always treat 429 and 503 as “retry later”.