Fix: API responses advertise rate-limit headers

Web-audit fix skill for the rate-limit-headers check (API, SHOULD).

Goal

Advertise remaining quota on API responses so agents can back off instead of retrying blindly.

Fix

Send IETF RateLimit headers (RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset) or the common X-RateLimit-* aliases on API responses. A 429 should also carry Retry-After. Without them an agent has no budget and will retry until it is locked out.

Resources

• IETF RateLimit header draft

Copy-paste prompt

Paste this into your coding agent. Your audit adds what it observed for this check:

Verify

Re-run the audit at https://anc.dev/audit or call the audit_website MCP tool; the rate-limit-headers check should report pass.