Readiness levels and scoring
A level is a cumulative statement about what an agent can already do with your site. Rungs are evaluated in order and a site sits at the highest rung it fully satisfies.
The five levels
Levels are cumulative: a site sits at the highest rung where every requirement is fully satisfied. Reaching Level 3 requires Level 2 first.
Not Ready
No crawl policy or discovery basics are in place yet.
Basic Web Presence
Pass two of three: robots.txt, a sitemap, or Link headers.
- robots.txt
- Sitemap
- Link headers
Bot-Aware
Level 1 plus explicit AI bot rules and Content Signals in robots.txt.
- AI bot rules
- Content Signals
Agent-Readable
Level 2 plus markdown content negotiation, so agents read clean content.
- Markdown negotiation
Agent-Integrated
Level 3 plus at least one discoverable integration: an MCP Server Card, A2A Agent Card, Agent Skills index or API Catalog.
- MCP Server Card
- API Catalog
- Agent Skills
Agent-Native
Level 4 plus two of three: verifiable bot identity (Web Bot Auth), integrations in place, and auth metadata (OAuth or auth.md).
- Web Bot Auth
- OAuth discovery
- Auth.md
Partial scans
You can choose which checks to run. A check that was not run never blocks a level, because it is skipped rather than failed, so a focused seven-check scan of a well-built content site reports a high level. The result card always labels a partial scan with the exact count, so a high number is never mistaken for a full pass.
Scoring
The 0-100 score is the share of applicable checks that were satisfied. Checks excluded by configuration, or not applicable to this kind of site, are removed from both the numerator and the denominator; a warning counts as half credit.
How the level criteria were derived
The ladder and the pass criteria were reverse-engineered from observed behaviour of the reference scanner across a sample of sites, then pinned down with regression tests. Where a criterion was ambiguous, the interpretation that reproduces the reference result was chosen and is documented in the tests.
Excluded checks
Web Bot Auth is informational: publishing a key directory claims that you sign your outbound requests, so a site that does not sign should not publish one. The five commerce checks are scored only on sites with e-commerce signals.
| Check | Category | Default | Scored on |
|---|---|---|---|
| robots.txt | Discoverability | yes | every site |
| Sitemap | Discoverability | yes | every site |
| Link headers | Discoverability | yes | every site |
| DNS for AI Discovery | Discoverability | yes | every site |
| Markdown negotiation | Content | yes | every site |
| AI bot rules | Bot Access Control | yes | every site |
| Content Signals | Bot Access Control | yes | every site |
| Web Bot Auth | Bot Access Control | yes | every site (informational) |
| API Catalog | API, Auth, MCP & Skill Discovery | yes | every site |
| OAuth discovery | API, Auth, MCP & Skill Discovery | yes | every site |
| OAuth Protected Resource | API, Auth, MCP & Skill Discovery | yes | every site |
| Auth.md | API, Auth, MCP & Skill Discovery | yes | every site |
| MCP Server Card | API, Auth, MCP & Skill Discovery | yes | every site |
| A2A Agent Card | API, Auth, MCP & Skill Discovery | opt-in | every site |
| Agent Skills | API, Auth, MCP & Skill Discovery | yes | every site |
| WebMCP | API, Auth, MCP & Skill Discovery | yes | every site |
| ARD manifest | API, Auth, MCP & Skill Discovery | yes | every site |
| x402 | Commerce | yes | commerce sites only |
| MPP | Commerce | yes | commerce sites only |
| UCP | Commerce | yes | commerce sites only |
| ACP | Commerce | yes | commerce sites only |
| AP2 | Commerce | opt-in | commerce sites only |
See it on your own domain
The scanner shows its evidence for every check, so you can audit the result.