# Agent-Ready Check — full documentation > Scan any website against 22 AI agent readiness standards: robots.txt, sitemaps, Content Signals, markdown for agents, MCP server cards, Agent Skills, Web Bot Auth, OAuth discovery and agentic commerce. Free, no signup, and every failing check comes with a fix prompt for your coding agent. ## What the scanner does Given a public URL, the scanner makes a bounded set of HTTP, DNS-over-HTTPS and content-negotiation requests, records each one as evidence, and reports 22 checks across five categories. No account is required and no result is stored. ## Scan API POST https://agent-ready.t0ols.com/api/scan Content-Type: application/json { "url": "https://example.com" } { "url": "https://example.com", "profile": "content" } { "url": "https://example.com", "enabledChecks": ["robotsTxt", "sitemap"] } { "url": "https://example.com", "format": "agent" } Profiles: `all` (20 checks), `content` (7 checks), `apiApp` (21 checks). Response shape: `url`, `targetUrl`, `scannedAt`, `level`, `levelName`, `score`, `categories`, `checks.{category}.{check}`, `nextLevel`, `isCommerce`, `commerceSignals`, `scanSummary`. Check status is one of `pass`, `warn`, `fail` or `neutral`. `neutral` means the check was excluded by configuration or does not apply to this kind of site, and it is removed from the score. ## Levels ### Level 0 — Not Ready No crawl policy or discovery basics are in place yet. ### Level 1 — Basic Web Presence Pass two of three: robots.txt, a sitemap, or Link headers. ### Level 2 — Bot-Aware Level 1 plus explicit AI bot rules and Content Signals in robots.txt. ### Level 3 — Agent-Readable Level 2 plus markdown content negotiation, so agents read clean content. ### Level 4 — Agent-Integrated Level 3 plus at least one discoverable integration: an MCP Server Card, A2A Agent Card, Agent Skills index or API Catalog. ### Level 5 — Agent-Native Level 4 plus two of three: verifiable bot identity (Web Bot Auth), integrations in place, and auth metadata (OAuth or auth.md). Levels are cumulative and evaluated in order. A check that was not run never blocks a level: it is skipped, not failed. ## The 22 checks ### Discoverability #### robots.txt robots.txt is still the only machine-readable place a site can state its crawl policy, and it is the first thing an agent fetches. A missing or invalid file means every crawler is guessing. - Pass criteria: Returns HTTP 200 with plain text containing at least one User-agent directive. - Goal: Publish /robots.txt with clear crawl rules - Specs: https://www.rfc-editor.org/rfc/rfc9309 - Skill: https://agent-ready.t0ols.com/.well-known/agent-skills/robots-txt/SKILL.md - Implementation prompt: available per scan to entitled plans #### Sitemap A sitemap is how you tell a crawler which URLs are canonical and when they changed, without making it discover your site by following links. - Pass criteria: A valid XML sitemap is served at /sitemap.xml, or declared with a Sitemap: directive in robots.txt. - Goal: Publish a sitemap and reference it from robots.txt - Specs: https://www.sitemaps.org/protocol.html - Skill: https://agent-ready.t0ols.com/.well-known/agent-skills/sitemap/SKILL.md - Implementation prompt: available per scan to entitled plans #### Link headers RFC 8288 Link headers attach related resources to any HTTP response. Browsers ignore them; agents that read them skip a whole round of HTML parsing. - Pass criteria: The homepage response carries Link headers with at least one agent-useful relation. - Goal: Include Link response headers for agent discovery (RFC 8288) - Specs: https://www.rfc-editor.org/rfc/rfc8288, https://www.rfc-editor.org/rfc/rfc9727#section-3 - Skill: https://agent-ready.t0ols.com/.well-known/agent-skills/link-headers/SKILL.md - Implementation prompt: available per scan to entitled plans #### DNS for AI Discovery (DNS-AID) DNS-AID publishes agent entry points in DNS itself, so discovery works before a single HTTP request is made and cannot be broken by an HTML change. - Pass criteria: ServiceMode SVCB/HTTPS records or a TXT index exist under the _agents namespace, ideally DNSSEC-signed. - Goal: Publish DNS for AI Discovery (DNS-AID) records for DNS-based agent discovery - Specs: https://datatracker.ietf.org/doc/draft-mozleywilliams-dnsop-dnsaid/ - Skill: https://agent-ready.t0ols.com/.well-known/agent-skills/dns-aid/SKILL.md - Implementation prompt: available per scan to entitled plans ### Content #### Markdown negotiation Give an agent markdown when it asks for markdown. Tokens are the expensive part of an agent run, and raw HTML is mostly markup it will throw away. - Pass criteria: A request with Accept: text/markdown returns Content-Type: text/markdown, and HTML stays the default. - Goal: Return HTML responses as markdown when agents request it - Specs: https://developers.cloudflare.com/fundamentals/reference/markdown-for-agents/ - Skill: https://agent-ready.t0ols.com/.well-known/agent-skills/markdown-negotiation/SKILL.md - Implementation prompt: available per scan to entitled plans ### Bot Access Control #### AI bot rules Crawlers such as GPTBot, OAI-SearchBot, ClaudeBot, Claude-SearchBot and Google-Extended all read robots.txt, and each has its own published behaviour. - Pass criteria: robots.txt names known AI crawlers, or carries a wildcard group that covers them. - Goal: Add User-agent rules for AI crawlers like GPTBot, ClaudeBot, and Google-Extended - Specs: https://www.rfc-editor.org/rfc/rfc9309, https://developers.cloudflare.com/ai-crawl-control/ - Skill: https://agent-ready.t0ols.com/.well-known/agent-skills/ai-rules/SKILL.md - Implementation prompt: available per scan to entitled plans #### Content Signals Robots.txt answers "may you crawl". Content Signals answers the question it was never designed for: "may you use this for training, for live answers, for indexing". - Pass criteria: robots.txt declares Content-Signal preferences covering ai-train, search and ai-input. - Goal: Declare AI content usage preferences with Content Signals in robots.txt - Specs: https://contentsignals.org/, https://datatracker.ietf.org/doc/draft-romm-aipref-contentsignals/ - Skill: https://agent-ready.t0ols.com/.well-known/agent-skills/content-signals/SKILL.md - Implementation prompt: available per scan to entitled plans #### Web Bot Auth Web Bot Auth lets a bot cryptographically sign its requests, so a receiving site can tell a legitimate agent from a scraper pretending to be one. - Pass criteria: A JWKS is published at /.well-known/http-message-signatures-directory. - Goal: Let your site identify itself as a bot with Web Bot Auth - Specs: https://datatracker.ietf.org/wg/webbotauth/about/, https://developers.cloudflare.com/bots/reference/bot-verification/web-bot-auth/ - Skill: https://agent-ready.t0ols.com/.well-known/agent-skills/web-bot-auth/SKILL.md - Implementation prompt: available per scan to entitled plans ### API, Auth, MCP & Skill Discovery #### API Catalog An API catalog lists your APIs and points at each one's description, documentation and status endpoint, using the RFC 9727 linkset format. - Pass criteria: /.well-known/api-catalog returns application/linkset+json with at least one entry. - Goal: Publish an API catalog for automated API discovery (RFC 9727) - Specs: https://www.rfc-editor.org/rfc/rfc9727 - Skill: https://agent-ready.t0ols.com/.well-known/agent-skills/api-catalog/SKILL.md - Implementation prompt: available per scan to entitled plans #### OAuth discovery OAuth and OIDC discovery documents publish the issuer, authorization endpoint, token endpoint and keys an agent needs to authenticate. - Pass criteria: /.well-known/oauth-authorization-server or /.well-known/openid-configuration exposes usable metadata. - Goal: Publish OAuth/OIDC discovery metadata so agents can authenticate with your APIs - Specs: https://www.rfc-editor.org/rfc/rfc8414, https://openid.net/specs/openid-connect-discovery-1_0.html - Skill: https://agent-ready.t0ols.com/.well-known/agent-skills/oauth-discovery/SKILL.md - Implementation prompt: available per scan to entitled plans #### OAuth Protected Resource Protected Resource Metadata is the other half: it states which resource is protected and which authorization servers issue tokens for it. - Pass criteria: /.well-known/oauth-protected-resource declares resource and authorization_servers. - Goal: Publish OAuth Protected Resource Metadata so agents can discover how to authenticate - Specs: https://www.rfc-editor.org/rfc/rfc9728 - Skill: https://agent-ready.t0ols.com/.well-known/agent-skills/oauth-protected-resource/SKILL.md - Implementation prompt: available per scan to entitled plans #### Auth.md auth.md is a short markdown document describing how an agent registers and authenticates. It is prose, which is exactly why it works: both humans and models read it directly. - Pass criteria: /auth.md exists with a markdown H1 mentioning auth.md. - Goal: Publish Auth.md metadata for agent registration - Specs: https://workos.com/auth-md - Skill: https://agent-ready.t0ols.com/.well-known/agent-skills/auth-md/SKILL.md - Implementation prompt: available per scan to entitled plans #### MCP Server Card A Model Context Protocol Server Card tells an agent that you run an MCP server, where it lives and which transport it speaks. - Pass criteria: /.well-known/mcp/server-card.json describes the server with a serverInfo.name. - Goal: Publish an MCP Server Card for agent discovery - Specs: https://modelcontextprotocol.io/, https://github.com/modelcontextprotocol/modelcontextprotocol - Skill: https://agent-ready.t0ols.com/.well-known/agent-skills/mcp-server-card/SKILL.md - Implementation prompt: available per scan to entitled plans #### A2A Agent Card An Agent2Agent card publishes your agent's identity, skills and interfaces so other agents can discover and call it. - Pass criteria: /.well-known/agent-card.json declares name, version and supported interfaces. - Goal: Publish an A2A Agent Card so other agents can discover this site's agent - Specs: https://a2a-protocol.org/, https://google.github.io/A2A/ - Skill: https://agent-ready.t0ols.com/.well-known/agent-skills/a2a-agent-card/SKILL.md - Implementation prompt: available per scan to entitled plans #### Agent Skills An Agent Skills index points at SKILL.md documents that teach an agent what it can do with your site, with a digest so drift is detectable. - Pass criteria: /.well-known/agent-skills/index.json lists at least one skill. - Goal: Publish an agent skills discovery index - Specs: https://agentskills.io/home, https://schemas.agentskills.io/discovery/0.2.0/schema.json - Skill: https://agent-ready.t0ols.com/.well-known/agent-skills/agent-skills/SKILL.md - Implementation prompt: available per scan to entitled plans #### WebMCP WebMCP lets a page expose tools to an agent running in the browser, with the user present and in control. - Pass criteria: Page code registers browser-side tools through navigator.modelContext. - Goal: Support WebMCP to expose site tools to AI agents via the browser - Specs: https://webmcp.org/, https://github.com/webmachinelearning/webmcp - Skill: https://agent-ready.t0ols.com/.well-known/agent-skills/webmcp/SKILL.md - Implementation prompt: available per scan to entitled plans #### ARD manifest An Agentic Resource Discovery manifest is a single index of everything machine-usable you publish: MCP servers, A2A agents, OpenAPI schemas, skills. - Pass criteria: /.well-known/ai-catalog.json declares specVersion, host and at least one entry. - Goal: Publish an ARD (Agentic Resource Discovery) manifest so agents can discover your site's capabilities - Specs: https://agenticresourcediscovery.org/ - Skill: https://agent-ready.t0ols.com/.well-known/agent-skills/ard/SKILL.md - Implementation prompt: available per scan to entitled plans ### Commerce #### x402 x402 revives HTTP 402 Payment Required as an agent-native payment flow: the server states its price, the client pays, the request completes. - Pass criteria: Payable routes answer HTTP 402 with x402 requirements, or a discovery document is published. - Goal: Support x402 protocol for agent-native HTTP payments - Specs: https://www.x402.org/, https://github.com/coinbase/x402 - Skill: https://agent-ready.t0ols.com/.well-known/agent-skills/x402/SKILL.md - Implementation prompt: available per scan to entitled plans #### MPP The Machine Payment Protocol describes prices and settlement for API calls using OpenAPI extensions your existing description can carry. - Pass criteria: An OpenAPI document annotates payable operations with x-payment-info. - Goal: Support MPP (Machine Payment Protocol) for agent-native HTTP payments - Specs: https://mpp.dev - Skill: https://agent-ready.t0ols.com/.well-known/agent-skills/mpp/SKILL.md - Implementation prompt: available per scan to entitled plans #### UCP The Universal Commerce Protocol describes catalog, cart, checkout and order services so an agent can transact end to end. - Pass criteria: /.well-known/ucp declares protocol_version and at least one service. - Goal: Enable content payments via Universal Commerce Protocol - Specs: https://ucp.dev/ - Skill: https://agent-ready.t0ols.com/.well-known/agent-skills/ucp/SKILL.md - Implementation prompt: available per scan to entitled plans #### ACP ACP is a discovery document for agent-driven commerce APIs: where the base URL is and what it can do. - Pass criteria: /.well-known/acp.json declares protocol.name, api_base_url, transports and capabilities.services. - Goal: Publish ACP discovery metadata so agents can discover your commerce API - Specs: https://agenticcommerce.dev - Skill: https://agent-ready.t0ols.com/.well-known/agent-skills/acp/SKILL.md - Implementation prompt: available per scan to entitled plans #### AP2 AP2 carries payment mandates over the A2A protocol, declaring which roles an agent plays in a transaction. - Pass criteria: The A2A Agent Card advertises an AP2 extension with role information. - Goal: Advertise Agent Payments Protocol support through your A2A Agent Card - Specs: https://ap2-protocol.org/, https://a2a-protocol.org/ - Skill: https://agent-ready.t0ols.com/.well-known/agent-skills/ap2/SKILL.md - Implementation prompt: available per scan to entitled plans ## Scoring The 0–100 score is the share of applicable checks that were satisfied, with a warning counting as half credit. Checks that were excluded or do not apply are removed from both numerator and denominator. ## Exclusions Web Bot Auth is informational: publishing a key directory asserts that you sign your outbound requests, so a site that does not sign should not publish one. The five commerce checks (x402, MPP, UCP, ACP, AP2) are scored only when the scanner detects e-commerce signals on the site. ## Public and private layers The check engine, the diagnostics, the evidence and the specification links are open source under MIT. The prescriptive layer — the implementation prompt you hand to a coding agent — is not in the repository; it is injected into the deployment at build time and served only to entitled plans.