Auth.md
auth.md is a short markdown document describing how an agent registers and authenticates. It is prose, which is exactly why it works: both humans and models read it directly.
Why it matters
It can also state the opposite: that your API is public and needs no credentials, which saves an agent a pointless registration flow.
Pass criteria
/auth.md exists with a markdown H1 mentioning auth.md.
Every request the check makes is recorded (URL, method, response status, relevant headers and a body preview) and shown under the check in your results.
How to implement it
Publish Auth.md metadata for agent registration
/auth.md exists with a markdown H1 mentioning auth.md.
The step-by-step implementation prompt is part of the Pro plan.
See plansScan your site
See whether this check passes on your domain, along with the other 21.
Related checks
API Catalog
/.well-known/api-catalog returns application/linkset+json with at least one entry.
OAuth discovery
/.well-known/oauth-authorization-server or /.well-known/openid-configuration exposes usable metadata.
OAuth Protected Resource
/.well-known/oauth-protected-resource declares resource and authorization_servers.
MCP Server Card
/.well-known/mcp/server-card.json describes the server with a serverInfo.name.
A2A Agent Card
/.well-known/agent-card.json declares name, version and supported interfaces.
Agent Skills
/.well-known/agent-skills/index.json lists at least one skill.
WebMCP
Page code registers browser-side tools through navigator.modelContext.
ARD manifest
/.well-known/ai-catalog.json declares specVersion, host and at least one entry.