Agent Readiness Checklist
Agent Readiness Checklist
142 rules across 25 categories, 4 pillars, 20 core rules.
Agent Readiness Checklist
The Agent Readiness Checklist is a practical, scannable list of the most important rules for making your API or service discoverable, understandable, and usable by AI agents.
How to Use This Checklist
- Scan your site — Run a free scan at agentbadge.xyz or use the CLI.
- Match against rules — Compare your results to the checklist below.
- Fix gaps — Each rule links to a detail page with evidence, examples, and fix instructions.
- Re-scan — Verify your fixes with a second scan.
How Scoring Works
AgentBadge evaluates your API across four pillars:
- Discovery — Can AI agents find your API or service?
- Understandability — Can AI agents understand what your API does and how to use it?
- Executability — Can AI agents successfully call your API end-to-end?
- Verifiability — Can AI agents verify the results of their API calls?
Each rule is binary — either your API passes it or it doesn't. There's no partial credit. Every check is evidence-based: AgentBadge shows you exactly what it found (or didn't find) so you can verify the result yourself.
Core Rules vs Advanced Rules
Core rules (highlighted with a badge) are the ~20 essential checks every API should pass before claiming agent readiness. They cover the fundamentals: discovery files, structured specs, error handling, pricing, and authentication.
Advanced rules go deeper into edge cases, content signals, DNS discovery, and social preview metadata. Pass them to go from "agent-ready" to "agent-optimized."
Learn More
- What Is Agent Readiness? — the concept behind this checklist
- FAQ — common questions about AgentBadge
- Blog — deep dives into agent-ready infrastructure
Discovery
Can an agent find you?
🔍
Discovery
Can AI agents find your site and understand what it offers?
7 core
15 rules
Discovery
Can AI agents find your site and understand what it offers?
🔍
Robots.txt File
Core
Your site has a robots.txt file that tells crawlers and AI agents what they can access.
Quick fix
AB-001
🗺️
Sitemap File
Core
Your site has a sitemap listing all important pages for agents to discover.
Quick fix
AB-002
🧭
Agent Guide
Core
Your site has a dedicated guide that tells AI agents what you offer and how to interact.
Moderate
AB-003
📄
LLMs.txt File
Core
Your site has an llms.txt file that provides a plain-text overview for large language models.
Quick fix
AB-014
🔗
Link Relationships
Core
Your homepage includes link headers that connect related resources together.
Moderate
AB-061
📚
Your site publishes a catalog of all available APIs in a standard location.
Moderate
AB-062
🏷️
Content Signals
Core
Your robots.txt declares preferences about how AI can use your content.
Quick fix
AB-066
🌐
DNS Agent Discovery
Core
Your domain has DNS records that help agents discover your services automatically.
Moderate
AB-068
map
AI sitemap includes blog/article URLs, not just static pages.
Moderate
AB-110
clock
robots.txt includes a Crawl-delay directive to control crawl rate.
Quick fix
AB-111
policy
LLM usage policy published at /.well-known/llm-policy.json.
Moderate
AB-113
coverage
AI sitemap covers at least 50% of the URLs in the regular sitemap.
Moderate
AB-114
🧭
A capabilities list is present in agent-guide.
Quick fix
AB-158
🤖
Your HTML head declares ai-agent-discovery and ai-agent-onboarding meta tags pointing to machine-readable entry points.
Quick fix
AB-161
📡
Your site serves structured JSON Feed 1.1 or RSS 2.0 feeds at common paths like /agents.json, /jobs.rss, or /feed.json.
Moderate
AB-165
🤖
Machine-Readable
Is your site's data structured for AI consumption?
3 core
9 rules
Machine-Readable
Is your site's data structured for AI consumption?
💲
Your pricing information is available in a format agents can parse automatically.
Moderate
AB-010
⏱️
Rate Limits Declared
Core
Your site declares its rate limits in a machine-readable format.
Moderate
AB-011
⚠️
Your API returns errors in a consistent, machine-readable format.
Moderate
AB-012
🛠️
Your MCP server responds to tool listing requests.
Moderate
AB-020
📞
Your MCP server responds when agents try to call a tool.
Moderate
AB-021
📡
Your MCP server supports streaming connections for real-time communication.
Complex
AB-022
card
Agent Card JSON includes a version field >= 1.0.0.
Quick fix
AB-109
📋
Your site serves /skill.json as JSON-LD with @context, @type, name, and url/endpoints for machine-readable agent onboarding.
Moderate
AB-163
❗
Your site serves a JSON error catalog at /api/meta/errors or /errors.json with error codes and descriptions.
Moderate
AB-164
📋
OpenAPI
Is your API specification complete and reachable?
9 rules
OpenAPI
Is your API specification complete and reachable?
📋
Your API specification is published at the standard location agents expect.
Quick fix
AB-039
🛤️
Your API specification lists all available paths and endpoints.
Complex
AB-040
🌐
All endpoints defined in your API spec actually work when agents call them.
Moderate
AB-041
🔍
Your API responses match what your specification promises.
Moderate
AB-042
🔢
Your API specification clearly states which version it is.
Quick fix
AB-043
🏷️
Your API specification has a clear title that describes your service.
Quick fix
AB-044
🛤️
At least half the paths declared in your OpenAPI spec return valid responses when probed.
Moderate
AB-076
📋
Your API responses match the structure declared in your OpenAPI specification.
Moderate
AB-077
💳
Your OpenAPI spec declares payment information for paid operations so agents know which endpoints cost money.
Moderate
AB-078
🎯
Skills
Can agents discover and use your specialized skills?
3 rules
Skills
Can agents discover and use your specialized skills?
🎯
Your site has a skill file that describes specialized capabilities agents can use.
Moderate
AB-026
✓
Your skill file follows the expected format with proper metadata.
Quick fix
AB-027
📚
Your site has an index listing all available skills in one place.
Moderate
AB-065
📜
Agents.txt
Do you have instructions specifically for AI agents?
1 rule
Agents.txt
Do you have instructions specifically for AI agents?
📜
Your site has an agents.txt file with instructions specifically for AI agents.
Moderate
AB-048
🌐
WebMCP
Can browsers interact with your agent via MCP?
7 rules
WebMCP
Can browsers interact with your agent via MCP?
🌐
Your site has a WebMCP manifest that enables browser-based agent interactions.
Complex
AB-050
📝
Your forms are annotated so WebMCP agents can fill them automatically.
Moderate
AB-051
🖥️
Your site exposes browser-side tools that agents can call through WebMCP.
Complex
AB-069
🌐
Your MCP server exposes tools with namespace prefixes for multi-registry support.
Moderate
AB-115
🌐
Your site publishes an MCP server descriptor at /.well-known/mcp.json.
Quick fix
AB-116
🌐
At least 50% of your REST API endpoints have corresponding MCP tools.
Complex
AB-102
🌐
Your MCP server exposes a 'check_compliance' tool for self-assessment.
Moderate
AB-103
🔄
Content Negotiation
Does your site serve the right format to AI agents?
2 core
7 rules
Content Negotiation
Does your site serve the right format to AI agents?
🤖
Your site serves appropriate content when an AI agent visits.
Moderate
AB-015
📊
JSON Format Support
Core
Your site returns JSON when an agent requests it.
Moderate
AB-016
📝
Your site returns plain text when an agent requests it.
Quick fix
AB-017
⬇️
Your site returns Markdown when an agent requests it.
Quick fix
AB-018
🎯
Your site respects format preferences when agents specify what they want.
Moderate
AB-019
🔀
Your site tells caches that content varies based on the requested format.
Quick fix
AB-028
📍
Your site serves the requested format directly without redirecting.
Quick fix
AB-029
🔎
SEO / AEO
Is your content optimized for search engines and AI answer engines?
7 rules
SEO / AEO
Is your content optimized for search engines and AI answer engines?
🔎
Blog and article pages declare og:type=article in their OpenGraph meta tags.
Quick fix
AB-104
🔎
Article pages include article:author, article:published_time, and article:modified_time meta tags.
Quick fix
AB-105
🔎
Article pages include a short-answer summary block (2-3 sentences) at the top for AI answer engines.
Moderate
AB-106
🔎
Guide pages use
- definition lists for term/definition pairs instead of plain paragraphs.
Moderate
AB-107
🔎
og:image:alt text is present and includes the site's brand name for consistent social sharing.
Quick fix
AB-108
📝
Service pages have at least 300 words of meaningful content.
Moderate
AB-100
📝
Service pages have breadcrumb navigation (JSON-LD BreadcrumbList or HTML .breadcrumb class).
Quick fix
AB-101
Understandability
Can an agent understand you?
📖
Documentation
Is your API documented in formats that AI agents can read?
5 core
16 rules
Documentation
Is your API documented in formats that AI agents can read?
📋
API Specification
Core
Your site has a machine-readable API specification that agents can parse.
Complex
AB-004
🧪
Your agent guide follows the expected format with all required fields.
Moderate
AB-005
🔌
Your site advertises its MCP server so agents can discover and connect to it.
Moderate
AB-006
📑
Detailed LLMs File
Core
Your site has an extended llms-full.txt with comprehensive information for AI models.
Moderate
AB-024
📌
Your homepage links to your llms.txt file so AI models can find it.
Quick fix
AB-025
📡
RSS or Atom Feed
Core
Your site has an RSS or Atom feed for agents to subscribe to updates.
Moderate
AB-049
🖼️
Social Preview Image
Core
Your site has a social preview image that appears when shared on social media or in AI responses.
Quick fix
AB-052
⭐
Your site has a scalable SVG favicon that looks crisp at any size.
Quick fix
AB-053
🔗
Canonical URL
Core
Your pages have canonical URLs that tell agents which version is the official one.
Quick fix
AB-054
📰
Your homepage links to your RSS feed so agents can discover it.
Quick fix
AB-055
📝
Your site has instructions telling agents how to register and authenticate.
Moderate
AB-064
📖
Your auth.md file documents agent authentication with session-scoped tokens.
Quick fix
AB-140
📖
Your auth.md mentions credential vault, scoped tokens, or session rotation (optional).
Quick fix
AB-144
📋
Parameters have descriptions with constraints (min, max, required).
Quick fix
AB-147
💡
OpenAPI operations include example requests and responses.
Quick fix
AB-148
🆘
A support contact or help URL is declared in agent-guide.
Quick fix
AB-160
⚡
Actionability
Can agents actually call your API with the right authentication?
2 core
11 rules
Actionability
Can agents actually call your API with the right authentication?
🔄
Your agent guide and your API specification describe the same endpoints.
Moderate
AB-007
🔑
Your site declares its authentication method in a machine-readable way.
Moderate
AB-008
🧩
Your agent guide covers all the capabilities your service offers.
Moderate
AB-009
🤝
Your agent publishes a /.well-known/agent-card.json file so other agents can discover its capabilities via the A2A protocol.
Quick fix
AB-074
✅
Your agent-card.json includes all required fields: name, description, url, and capabilities.
Quick fix
AB-075
🔌
Your MCP server's initialize response includes serverInfo.name, allowing agents to identify the server.
Quick fix
AB-085
🔐
If your MCP descriptor declares authentication, the auth URL is reachable and returns valid metadata.
Moderate
AB-086
📝
Every OpenAPI operation has a description or summary.
Quick fix
AB-146
⚖️
Business rules (refund windows, cancellation policies) are documented.
Quick fix
AB-159
💓
Your site serves /heartbeat.md with YAML frontmatter, providing a periodic check-in routine for AI agents.
Quick fix
AB-162
➡️
Your OpenAPI spec includes a next_call field in response schemas with method, path, and why to guide agents to the next request.
Moderate
AB-166
♿
Accessibility
Is your site accessible to all users, including those using assistive technology?
2 rules
Accessibility
Is your site accessible to all users, including those using assistive technology?
♿
All images on your page have alt attributes (empty alt is valid for decorative images).
Moderate
AB-117
♿
Images below the fold use loading="lazy" for improved page load performance.
Quick fix
AB-118
💲
Pricing
Is pricing information available in machine-readable formats for automated clients?
1 rule
Pricing
Is pricing information available in machine-readable formats for automated clients?
💲
Pricing information is discoverable in agent-guide or llms.txt.
Quick fix
AB-150
⏱️
Rate Limits
Are rate limits and over-limit behavior declared machine-readably?
1 rule
Rate Limits
Are rate limits and over-limit behavior declared machine-readably?
⏱️
Rate limits are declared in a machine-readable format.
Moderate
AB-151
Executability
Can an agent act on your API?
🔐
Bot Authentication
Can you prove which AI bot is making the request?
23 rules
Bot Authentication
Can you prove which AI bot is making the request?
🔐
Your MCP server's authentication info is discoverable by agents.
Moderate
AB-023
✍️
Your site has a directory of bot signatures for verifying AI agent identities.
Complex
AB-058
👥
Your bot signatures directory has valid, recognized members.
Moderate
AB-059
🔑
Public keys for verified bots are reachable and valid.
Moderate
AB-060
🛡️
Your site publishes metadata about what resources are protected and how.
Moderate
AB-063
📜
Your site has a directory for web-based bot authentication using HTTP message signatures.
Complex
AB-067
🔐
Your API uses OAuth2 security schemes instead of static API keys.
Moderate
AB-128
🔐
API keys and tokens are passed in headers, not query parameters.
Quick fix
AB-129
🔐
Your OAuth metadata declares scopes_supported.
Quick fix
AB-130
🔐
Your OAuth metadata publishes a revocation_endpoint.
Moderate
AB-131
🔐
Your OAuth metadata publishes an introspection_endpoint (optional).
Moderate
AB-132
🔐
Your token endpoint supports private_key_jwt auth method (optional).
Complex
AB-133
🔐
Your OAuth metadata supports token-exchange grant type (optional).
Complex
AB-134
🔐
Your API publishes /.well-known/aauth.json with agent authorization metadata.
Moderate
AB-135
🔐
Your OAuth metadata includes the agent_authorization grant type.
Complex
AB-136
🔐
Your aauth.json publishes scope_descriptions (optional).
Quick fix
AB-137
🔐
Your OAuth metadata supports DPoP (RFC 9449) for token binding (optional).
Complex
AB-138
🔐
Your OAuth metadata supports mTLS certificate-bound tokens (optional).
Complex
AB-139
🔐
Your token endpoint returns expires_in with access tokens.
Quick fix
AB-141
🔐
Your OAuth metadata includes refresh_token in grant_types_supported (optional).
Moderate
AB-142
🔐
Your credential security analysis confirms revocation endpoint is supported.
Moderate
AB-143
🔐
Your OpenAPI spec does not use apiKey security schemes.
Moderate
AB-145
🔐
Security schemes are declared in the OpenAPI spec.
Moderate
AB-153
🪪
Identity
Can agents verify your on-chain identity?
3 rules
Identity
Can agents verify your on-chain identity?
🪪
Your site can answer 'who is this?' queries from AI agents.
Moderate
AB-056
🆔
Your site provides a Decentralized Identifier document for on-chain identity verification.
Complex
AB-057
key
OAuth Authorization Server Metadata published at /.well-known/oauth-authorization-server.
Moderate
AB-112
💰
Payments
Can agents pay for your services programmatically?
11 rules
Payments
Can agents pay for your services programmatically?
💰
When an agent tries to access a paid feature, your site responds with a clear payment request.
Complex
AB-030
🔓
The payment request your site sends is properly formatted and can be decoded by agents.
Complex
AB-031
📋
Your payment responses include a header that tells agents payment is needed.
Moderate
AB-032
👤
Your payment requests specify who should receive the payment.
Moderate
AB-033
💵
Your payment requests specify how much the agent needs to pay.
Moderate
AB-034
📄
Your site publishes a file that describes all payment options in one place.
Moderate
AB-035
🏦
Your payment requests specify a facilitator that can process the payment.
Complex
AB-038
⚡
Your site supports Lightning Network payments for instant, low-cost transactions.
Complex
AB-070
🎫
Your Lightning payment responses include all required details for agents to pay.
Complex
AB-071
💳
Checks for /.well-known/mpp.json declaring Machine Payments Protocol support.
Quick fix
AB-088
💳
Checks for /.well-known/spt.json declaring Stripe Payment Terms support.
Quick fix
AB-093
🏪
Bazaar
Is your agent listed in the decentralized marketplace?
3 rules
Bazaar
Is your agent listed in the decentralized marketplace?
🏪
Your agent marketplace listings can be discovered by other agents.
Moderate
AB-036
🏷️
Your site declares what services it offers in the Bazaar marketplace.
Moderate
AB-037
🛒
Your Lightning payment responses include Bazaar marketplace information.
Complex
AB-072
🚫
Error Semantics
Are 4xx error responses declared with schemas and descriptions in the spec?
1 rule
Error Semantics
Are 4xx error responses declared with schemas and descriptions in the spec?
🚫
4xx and 5xx error responses are declared with schemas.
Moderate
AB-149
🔁
Retry Semantics
Are idempotency and retry guidance (Retry-After) declared for agents?
1 rule
Retry Semantics
Are idempotency and retry guidance (Retry-After) declared for agents?
🔁
Idempotency-Key or Retry-After headers are documented.
Moderate
AB-154
🧪
Sandbox
Is a test/sandbox environment advertised for agent experimentation?
1 rule
Sandbox
Is a test/sandbox environment advertised for agent experimentation?
🧪
A sandbox/test environment is documented in agent-guide.
Quick fix
AB-156
📌
Versioning
Is the API version declared with a deprecation/sunset policy?
1 rule
Versioning
Is the API version declared with a deprecation/sunset policy?
📌
API version and deprecation policy are documented.
Quick fix
AB-155
Verifiability
Can an agent verify what it observed?
✅
Verification
Can agents verify you are who you say you are?
1 core
2 rules
Verification
Can agents verify you are who you say you are?
✅
Owner Verification
Core
Your site can prove that you own the domain and are who you claim to be.
Complex
AB-013
🔍
Pricing and rate limits are consistent across all sources.
Quick fix
AB-152
🏗️
Infrastructure
Are your caching, errors, and rate limits agent-ready?
6 rules
Infrastructure
Are your caching, errors, and rate limits agent-ready?
⚡
Your site sends cache headers so agents and CDNs know how to cache your content.
Quick fix
AB-045
🚫
Your site returns structured JSON for 404 errors instead of plain HTML.
Quick fix
AB-046
⏱️
Your site sends rate limit headers so agents know how many requests they can make.
Quick fix
AB-047
🔒
Your site automatically redirects HTTP requests to HTTPS so agents always use a secure connection.
Quick fix
AB-073
🔒
Your homepage returns a Content-Security-Policy header.
Moderate
AB-098
🔒
Your homepage returns a Referrer-Policy header.
Quick fix
AB-099
📜
Agent Policy
Is there a machine-readable usage policy for automated clients?
1 rule
Agent Policy
Is there a machine-readable usage policy for automated clients?
📜
A machine-readable usage policy for AI agents is present.
Quick fix
AB-157
Want to check your site against all 142 rules?
Scan Your Site