---
title: "The 22 agent-readiness checks | Agent-Ready Check"
description: "Every check the scanner runs, grouped by category, with the pass criteria and the fix for each one."
locale: en
canonical: https://agent-ready.t0ols.com/checks/
---

# The 22 agent-readiness checks

The scanner runs 22 checks across five categories. Each one has a pass criterion, an evidence trail, and a prompt to hand to a coding agent whenever it fails.

## Discoverability

Can an agent find out what your site is and which URLs matter, without crawling your HTML looking for clues?

- **robots.txt**: Returns HTTP 200 with plain text containing at least one User-agent directive.
- **Sitemap**: A valid XML sitemap is served at /sitemap.xml, or declared with a Sitemap: directive in robots.txt.
- **Link headers**: The homepage response carries Link headers with at least one agent-useful relation.
- **DNS for AI Discovery**: ServiceMode SVCB/HTTPS records or a TXT index exist under the _agents namespace, ideally DNSSEC-signed.

## Content

When an agent asks for markdown, do you hand back clean markdown instead of a wall of markup to parse?

- **Markdown negotiation**: A request with Accept: text/markdown returns Content-Type: text/markdown, and HTML stays the default.

## Bot Access Control

What policy have you stated for AI crawlers, and can you prove which requests are yours?

- **AI bot rules**: robots.txt names known AI crawlers, or carries a wildcard group that covers them.
- **Content Signals**: robots.txt declares Content-Signal preferences covering ai-train, search and ai-input.
- **Web Bot Auth**: A JWKS is published at /.well-known/http-message-signatures-directory.

## API, Auth, MCP & Skill Discovery

If you expose an API, an MCP server or an agent, is it discoverable at the well-known location an agent would guess?

- **API Catalog**: /.well-known/api-catalog returns application/linkset+json with at least one entry.
- **OAuth discovery**: /.well-known/oauth-authorization-server or /.well-known/openid-configuration exposes usable metadata.
- **OAuth Protected Resource**: /.well-known/oauth-protected-resource declares resource and authorization_servers.
- **Auth.md**: /auth.md exists with a markdown H1 mentioning auth.md.
- **MCP Server Card**: /.well-known/mcp/server-card.json describes the server with a serverInfo.name.
- **A2A Agent Card**: /.well-known/agent-card.json declares name, version and supported interfaces.
- **Agent Skills**: /.well-known/agent-skills/index.json lists at least one skill.
- **WebMCP**: Page code registers browser-side tools through navigator.modelContext.
- **ARD manifest**: /.well-known/ai-catalog.json declares specVersion, host and at least one entry.

## Commerce

Scored only when the site looks like a store: can an agent pay, order and settle without a human filling in a form?

- **x402**: Payable routes answer HTTP 402 with x402 requirements, or a discovery document is published.
- **MPP**: An OpenAPI document annotates payable operations with x-payment-info.
- **UCP**: /.well-known/ucp declares protocol_version and at least one service.
- **ACP**: /.well-known/acp.json declares protocol.name, api_base_url, transports and capabilities.services.
- **AP2**: The A2A Agent Card advertises an AP2 extension with role information.