> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.pensar.dev/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.pensar.dev/_mcp/server.

# Rate Limiting

> Configure request rate limits for penetration testing

## Overview

Rate limiting allows you to control the maximum number of requests per second that Pensar's security agent makes during penetration testing. This is useful when testing against environments with strict rate limits or limited resources.

> **Warning**
>
> Enabling rate limiting will significantly increase scan duration. If your environment can handle unrestricted testing, disabling rate limits is recommended for faster results.

## When to Use Rate Limiting

#### Shared Environments

When testing against staging or QA environments shared with other teams, rate limiting prevents resource contention.

#### Rate-Limited APIs

If your API has built-in rate limiting that blocks requests, configure the agent to stay under those thresholds.

#### Resource Constraints

For environments with limited compute or bandwidth, throttling requests prevents overload.

#### Production-Like Testing

When testing against production or production-like environments where stability is critical.

## Configuring Rate Limits

#### Navigate to Environment Settings

In your workspace, go to **Settings** → **Agent Configuration** → **Environment**, then expand the **Advanced** section.

#### Enable Rate Limiting

Toggle the **Enable Rate Limiting** switch to on.

#### Set Requests Per Second

Use the slider to configure the maximum requests per second (1-200 req/s):

* **1 req/s**: Very slow, use for extremely sensitive environments
* **10-50 req/s**: Moderate, good balance for shared environments
* **100-200 req/s**: Fast, suitable for dedicated test environments

## Performance Impact

The rate limit directly affects scan duration:

| Rate Limit  | Relative Speed | Best For                                 |
| ----------- | -------------- | ---------------------------------------- |
| Disabled    | Fastest        | Dedicated test environments              |
| 100+ req/s  | Fast           | Most testing scenarios                   |
| 20-50 req/s | Moderate       | Shared staging environments              |
| 1-10 req/s  | Slow           | Production-adjacent or rate-limited APIs |

> **Info**
>
> Rate limiting applies to both HTTP requests and command executions during testing. The agent will wait to acquire a slot before making each request.

## Recommendations

For optimal testing performance:

1. **Disable rate limits when possible** - If your test environment can handle unrestricted traffic, leave rate limiting disabled for faster scans.

2. **Match your API's limits** - If your API enforces rate limits (e.g., 100 requests/minute), set the agent slightly below that threshold.

3. **Test during off-peak hours** - Running scans during low-traffic periods allows for higher rate limits without impacting other users.

4. **Use dedicated test environments** - Whenever possible, test against isolated environments where rate limiting isn't necessary.