The 22 agent-readiness checks
The scanner runs 22 checks across five categories. Each one has a pass criterion, an evidence trail, and a prompt to hand to a coding agent whenever it fails.
Discoverability
Can an agent find out what your site is and which URLs matter, without crawling your HTML looking for clues?
robots.txt
Returns HTTP 200 with plain text containing at least one User-agent directive.
robots.txt for AI crawlers
Sitemap
A valid XML sitemap is served at /sitemap.xml, or declared with a Sitemap: directive in robots.txt.
sitemap for AI agents
Link headers
The homepage response carries Link headers with at least one agent-useful relation.
HTTP Link header agent discovery RFC 8288
DNS for AI Discovery
ServiceMode SVCB/HTTPS records or a TXT index exist under the _agents namespace, ideally DNSSEC-signed.
DNS-AID agent discovery SVCB
Content
When an agent asks for markdown, do you hand back clean markdown instead of a wall of markup to parse?
Bot Access Control
What policy have you stated for AI crawlers, and can you prove which requests are yours?
AI bot rules
robots.txt names known AI crawlers, or carries a wildcard group that covers them.
robots.txt AI bot user agent rules GPTBot ClaudeBot
Content Signals
robots.txt declares Content-Signal preferences covering ai-train, search and ai-input.
content signals robots.txt ai-train search ai-input
Web Bot Auth
A JWKS is published at /.well-known/http-message-signatures-directory.
web bot auth JWKS http message signatures
API, Auth, MCP & Skill Discovery
If you expose an API, an MCP server or an agent, is it discoverable at the well-known location an agent would guess?
API Catalog
/.well-known/api-catalog returns application/linkset+json with at least one entry.
API catalog RFC 9727 linkset well-known
OAuth discovery
/.well-known/oauth-authorization-server or /.well-known/openid-configuration exposes usable metadata.
OAuth OIDC discovery metadata well-known
OAuth Protected Resource
/.well-known/oauth-protected-resource declares resource and authorization_servers.
OAuth protected resource metadata RFC 9728
Auth.md
/auth.md exists with a markdown H1 mentioning auth.md.
auth.md agent registration metadata
MCP Server Card
/.well-known/mcp/server-card.json describes the server with a serverInfo.name.
MCP server card well-known discovery
A2A Agent Cardoptional
/.well-known/agent-card.json declares name, version and supported interfaces.
A2A agent card agent-to-agent discovery
Agent Skills
/.well-known/agent-skills/index.json lists at least one skill.
agent skills discovery index SKILL.md
WebMCP
Page code registers browser-side tools through navigator.modelContext.
WebMCP navigator modelContext browser tools
ARD manifest
/.well-known/ai-catalog.json declares specVersion, host and at least one entry.
ARD agentic resource discovery ai-catalog
Commerce
Scored only when the site looks like a store: can an agent pay, order and settle without a human filling in a form?
x402
Payable routes answer HTTP 402 with x402 requirements, or a discovery document is published.
x402 agent payments HTTP 402
MPP
An OpenAPI document annotates payable operations with x-payment-info.
MPP machine payment protocol OpenAPI x-payment-info
UCP
/.well-known/ucp declares protocol_version and at least one service.
UCP universal commerce protocol well-known
ACP
/.well-known/acp.json declares protocol.name, api_base_url, transports and capabilities.services.
ACP agent commerce protocol discovery
AP2optional
The A2A Agent Card advertises an AP2 extension with role information.
AP2 agent payments protocol A2A extension
Ready to see where you stand?
Run the scanner against your own domain and get the fix list.