What We Check

Your site has a sitemap listing all important pages for agents to discover.

🗺️

Sitemap File

Your site has a dedicated guide that tells AI agents what you offer and how to interact.

🧭

Agent Guide

Your site has an llms.txt file that provides a plain-text overview for large language models.

📄

LLMs.txt File

Your homepage includes link headers that connect related resources together.

🔗

Link Relationships

Your site publishes a catalog of all available APIs in a standard location.

📚

API Catalog

Your robots.txt declares preferences about how AI can use your content.

Content Signals

Your domain has DNS records that help agents discover your services automatically.

DNS Agent Discovery

Blog articles in AI sitemap

map

AI sitemap includes blog/article URLs, not just static pages.

Crawl-delay directive in robots.txt

clock

robots.txt includes a Crawl-delay directive to control crawl rate.

LLM usage policy published at /.well-known/llm-policy.json.

policy

LLM policy file

AI sitemap content type coverage

coverage

AI sitemap covers at least 50% of the URLs in the regular sitemap.

A capabilities list is present in agent-guide.

🧭

Capability list declared

AI-Agent Discovery meta tags

🤖

Your HTML head declares ai-agent-discovery and ai-agent-onboarding meta tags pointing to machine-readable entry points.

high Quick fix Documentation

📡

Agent feeds (JSON Feed 1.1 / RSS 2.0)

Your site serves structured JSON Feed 1.1 or RSS 2.0 feeds at common paths like /agents.json, /jobs.rss, or /feed.json.

Your pricing information is available in a format agents can parse automatically.

🤖

Machine-Readable

Is your site's data structured for AI consumption?

9 rules

💲

Machine-Readable Pricing

Your site declares its rate limits in a machine-readable format.

⏱️

Rate Limits Declared

Structured Error Responses

⚠️

Your API returns errors in a consistent, machine-readable format.

Your MCP server responds to tool listing requests.

🛠️

MCP Tools List

Your MCP server responds when agents try to call a tool.

📞

MCP Tool Calls

Your MCP server supports streaming connections for real-time communication.

📡

MCP Streaming Support

Agent Card version 1.0.0+

card

Agent Card JSON includes a version field >= 1.0.0.

Skill.json (JSON-LD) availability

Your site serves /skill.json as JSON-LD with @context, @type, name, and url/endpoints for machine-readable agent onboarding.

Your site serves a JSON error catalog at /api/meta/errors or /errors.json with error codes and descriptions.

❗

Error catalog endpoint

📋

OpenAPI

Is your API specification complete and reachable?

9 rules

API Spec at Standard Location

Your API specification is published at the standard location agents expect.

high Quick fix Documentation

🛤️

API Paths Defined

Your API specification lists all available paths and endpoints.

All endpoints defined in your API spec actually work when agents call them.

API Paths Reachable

Your API responses match what your specification promises.

🔍

Response Matches Spec

Your API specification clearly states which version it is.

🔢

API Version Identified

Your API specification has a clear title that describes your service.

API Title

At least half the paths declared in your OpenAPI spec return valid responses when probed.

🛤️

OpenAPI Paths Reachable

OpenAPI Response Matches Spec

Your API responses match the structure declared in your OpenAPI specification.

Your OpenAPI spec declares payment information for paid operations so agents know which endpoints cost money.

💳

Payment Info in OpenAPI

Your site has a skill file that describes specialized capabilities agents can use.

🎯

Skills

Can agents discover and use your specialized skills?

3 rules

🎯

Skill File Present

Your skill file follows the expected format with proper metadata.

✓

Skill File Format Valid

Your site has an index listing all available skills in one place.

📚

Skills Index

Your site has an agents.txt file with instructions specifically for AI agents.

📜

Agents.txt

Do you have instructions specifically for AI agents?

1 rule

📜

Agents.txt File

🌐

WebMCP

Can browsers interact with your agent via MCP?

7 rules

Your site has a WebMCP manifest that enables browser-based agent interactions.

WebMCP Manifest

Your forms are annotated so WebMCP agents can fill them automatically.

WebMCP Form Annotations

Your site exposes browser-side tools that agents can call through WebMCP.

🖥️

WebMCP Browser Tools

MCP namespace-based tool isolation

Your MCP server exposes tools with namespace prefixes for multi-registry support.

Well-known MCP descriptor

Your site publishes an MCP server descriptor at /.well-known/mcp.json.

MCP tools and REST endpoints parity

At least 50% of your REST API endpoints have corresponding MCP tools.

check_compliance MCP tool available

Your MCP server exposes a 'check_compliance' tool for self-assessment.

Your site serves appropriate content when an AI agent visits.

🔄

Content Negotiation

Does your site serve the right format to AI agents?

7 rules

🤖

Agent User-Agent Format

Your site returns JSON when an agent requests it.

📊

JSON Format Support

Plain Text Format Support

Your site returns plain text when an agent requests it.

Your site returns Markdown when an agent requests it.

⬇️

Markdown Format Support

Preferred Format Selection

🎯

Your site respects format preferences when agents specify what they want.

Your site tells caches that content varies based on the requested format.

🔀

Vary Header

No Redirect on Negotiation

📍

Your site serves the requested format directly without redirecting.

🔎

SEO / AEO

Is your content optimized for search engines and AI answer engines?

12 rules

Blog Article OpenGraph Type

Blog and article pages declare og:type=article in their OpenGraph meta tags.

Article Author and Date Meta Tags

Article pages include article:author, article:published_time, and article:modified_time meta tags.

AEO Short-Answer Summary Block

Article pages include a short-answer summary block (2-3 sentences) at the top for AI answer engines.

Semantic Definition Lists in Guides

Guide pages use <dl> definition lists for term/definition pairs instead of plain paragraphs.

OG Image Alt Text Brand Consistency

og:image:alt text is present and includes the site's brand name for consistent social sharing.

Service page content depth

Service pages have at least 300 words of meaningful content.

Breadcrumb navigation on service pages

Service pages have breadcrumb navigation (JSON-LD BreadcrumbList or HTML .breadcrumb class).

Answer-first extractability

❓

Question-shaped headings are followed by self-contained answer blocks AI systems can quote.

Evidence density for citability

📊

Pages contain citable evidence: sourced numbers, dated claims, fact tables, attributed quotations.

Entity clarity and canonical naming

The page states what the entity is in one canonical line, names it consistently, and links About/schema signals.

Server-rendered primary content

🖥️

Primary content is present in the initial HTML without executing JavaScript.

low Documentation

🚫

Anti-citation disqualifiers

Content is free of overlays covering it, funnel-grade CTA density, and missing author/date on articles.

Understandability

Can an agent understand you?

Weight: 25

📖

Documentation

Is your API documented in formats that AI agents can read?

16 rules

Your site has a machine-readable API specification that agents can parse.

API Specification

high Complex Documentation

🧪

Agent Guide Schema Validation

Your agent guide follows the expected format with all required fields.

Your site advertises its MCP server so agents can discover and connect to it.

🔌

MCP Server Descriptor

Your site has an extended llms-full.txt with comprehensive information for AI models.

📑

Detailed LLMs File

LLMs File Linked from HTML

📌

Your homepage links to your llms.txt file so AI models can find it.

Your site has an RSS or Atom feed for agents to subscribe to updates.

📡

RSS or Atom Feed

Your site has a social preview image that appears when shared on social media or in AI responses.

🖼️

Social Preview Image

Your site has a scalable SVG favicon that looks crisp at any size.

⭐

SVG Favicon

Your pages have canonical URLs that tell agents which version is the official one.

🔗

Canonical URL

RSS Feed Linked from HTML

📰

Your homepage links to your RSS feed so agents can discover it.

Agent Registration Instructions

Your site has instructions telling agents how to register and authenticate.

Auth.md documents agent auth flow

📖

Your auth.md file documents agent authentication with session-scoped tokens.

Auth.md documents credential vault pattern

📖

Your auth.md mentions credential vault, scoped tokens, or session rotation (optional).

Parameters have descriptions with constraints (min, max, required).

Parameter semantics

Request/response examples

💡

OpenAPI operations include example requests and responses.

A support contact or help URL is declared in agent-guide.

🆘

Support path declared

Guide and API Consistency

⚡

Actionability

Can agents actually call your API with the right authentication?

11 rules

🔄

Your agent guide and your API specification describe the same endpoints.

Your site declares its authentication method in a machine-readable way.

🔑

Authentication Declared

Your agent guide covers all the capabilities your service offers.

🧩

Capability Coverage

Your agent publishes a /.well-known/agent-card.json file so other agents can discover its capabilities via the A2A protocol.

🤝

A2A Agent Card Published

Your agent-card.json includes all required fields: name, description, url, and capabilities.

✅

A2A Agent Card Verified

Your MCP server's initialize response includes serverInfo.name, allowing agents to identify the server.

🔌

MCP Server Name Present

MCP Auth Discovery Resolves

If your MCP descriptor declares authentication, the auth URL is reachable and returns valid metadata.

Every OpenAPI operation has a description or summary.

Operation descriptions

Business constraints documented

⚖️

Business rules (refund windows, cancellation policies) are documented.

Heartbeat.md availability

💓

Your site serves /heartbeat.md with YAML frontmatter, providing a periodic check-in routine for AI agents.

next_call pattern in API responses

➡️

Your OpenAPI spec includes a next_call field in response schemas with method, path, and why to guide agents to the next request.

low Moderate Semantic

♿

Accessibility

Is your site accessible to all users, including those using assistive technology?

2 rules

♿

Image alt text coverage

All images on your page have alt attributes (empty alt is valid for decorative images).

Lazy loading on below-fold images

♿

Images below the fold use loading="lazy" for improved page load performance.

Pricing information is discoverable in agent-guide or llms.txt.

💲

Pricing

Is pricing information available in machine-readable formats for automated clients?

1 rule

💲

Pricing discoverability

high Quick fix Semantic

⏱️

Rate Limits

Are rate limits and over-limit behavior declared machine-readably?

1 rule

⏱️

Rate limits machine-readable

Rate limits are declared in a machine-readable format.

Executability

Can an agent act on your API?

Weight: 30

🔐

Bot Authentication

Can you prove which AI bot is making the request?

23 rules

Your MCP server's authentication info is discoverable by agents.

MCP Auth Discovery

Your site has a directory of bot signatures for verifying AI agent identities.

✍️

Bot Signatures Directory

Your bot signatures directory has valid, recognized members.

👥

Bot Directory Members

Public keys for verified bots are reachable and valid.

🔑

Bot Public Keys

Protected Resource Metadata

🛡️

Your site publishes metadata about what resources are protected and how.

Your site has a directory for web-based bot authentication using HTTP message signatures.

📜

Web Bot Auth Directory

OAuth2 preferred over static API keys

Your API uses OAuth2 security schemes instead of static API keys.

Credentials via headers not query params

API keys and tokens are passed in headers, not query parameters.

high Quick fix Capability

Your OAuth metadata declares scopes_supported.

OAuth scopes defined

medium Quick fix Capability

Token revocation endpoint available

Your OAuth metadata publishes a revocation_endpoint.

Token introspection supported

Your OAuth metadata publishes an introspection_endpoint (optional).

low Moderate Capability

Private key JWT authentication

Your token endpoint supports private_key_jwt auth method (optional).

low Complex Capability

Token Exchange (RFC 8693) supported

Your OAuth metadata supports token-exchange grant type (optional).

AAuth metadata endpoint available

Your API publishes /.well-known/aauth.json with agent authorization metadata.

Agent Authorization Grant supported

Your OAuth metadata includes the agent_authorization grant type.

AAuth scope descriptions published

Your aauth.json publishes scope_descriptions (optional).

low Quick fix Capability

DPoP token binding supported

Your OAuth metadata supports DPoP (RFC 9449) for token binding (optional).

Your OAuth metadata supports mTLS certificate-bound tokens (optional).

mTLS-bound access tokens

Short-lived access tokens

Your token endpoint returns expires_in with access tokens.

medium Quick fix Capability

Refresh token rotation supported

Your OAuth metadata includes refresh_token in grant_types_supported (optional).

Token revocation endpoint reachable

Your credential security analysis confirms revocation endpoint is supported.

No static API keys in OpenAPI security

Your OpenAPI spec does not use apiKey security schemes.

Security schemes are declared in the OpenAPI spec.

Authentication clarity

critical Moderate Capability

🪪

Identity

Can agents verify your on-chain identity?

3 rules

🪪

WebFinger Identity Lookup

Your site can answer 'who is this?' queries from AI agents.

low Moderate Capability

🆔

DID Document

Your site provides a Decentralized Identifier document for on-chain identity verification.

low Complex Capability

key

OAuth Authorization Server metadata (RFC 9728)

OAuth Authorization Server Metadata published at /.well-known/oauth-authorization-server.

When an agent tries to access a paid feature, your site responds with a clear payment request.

💰

Payments

Can agents pay for your services programmatically?

11 rules

💰

Paid Endpoint Response

Payment Challenge Decodable

🔓

The payment request your site sends is properly formatted and can be decoded by agents.

Your payment responses include a header that tells agents payment is needed.

Payment Required Header

Your payment requests specify who should receive the payment.

👤

Payment Recipient

Your payment requests specify how much the agent needs to pay.

💵

Payment Amount

Your site publishes a file that describes all payment options in one place.

📄

Payment Discovery File

Your payment requests specify a facilitator that can process the payment.

🏦

Payment Facilitator

Lightning Payment Support

⚡

Your site supports Lightning Network payments for instant, low-cost transactions.

Lightning Payment Details

🎫

Your Lightning payment responses include all required details for agents to pay.

MPP (Machine Payments Protocol) Support

💳

Checks for /.well-known/mpp.json declaring Machine Payments Protocol support.

medium Quick fix Capability

💳

SPT (Stripe Payment Terms) Support

Checks for /.well-known/spt.json declaring Stripe Payment Terms support.

low Quick fix Capability

🏪

Bazaar

Is your agent listed in the decentralized marketplace?

3 rules

🏪

Bazaar Discoverable

Your agent marketplace listings can be discovered by other agents.

Your site declares what services it offers in the Bazaar marketplace.

Bazaar Service Declared

low Moderate Capability

🛒

Bazaar in Lightning Payments

Your Lightning payment responses include Bazaar marketplace information.

4xx and 5xx error responses are declared with schemas.

🚫

Error Semantics

Are 4xx error responses declared with schemas and descriptions in the spec?

1 rule

🚫

Error response schemas

Idempotency-Key or Retry-After headers are documented.

🔁

Retry Semantics

Are idempotency and retry guidance (Retry-After) declared for agents?

1 rule

🔁

Retry semantics declared

A sandbox/test environment is documented in agent-guide.

🧪

Sandbox

Is a test/sandbox environment advertised for agent experimentation?

1 rule

🧪

Sandbox declared

low Quick fix Capability

📌

Versioning

Is the API version declared with a deprecation/sunset policy?

1 rule

📌

Versioning declared

API version and deprecation policy are documented.

Your site can prove that you own the domain and are who you claim to be.

Verifiability

Can an agent verify what it observed?

Weight: 25

✅

Verification

Can agents verify you are who you say you are?

2 rules

✅

Owner Verification

medium Complex Semantic

🔍

Pricing/limits consistency

Pricing and rate limits are consistent across all sources.

Your site sends cache headers so agents and CDNs know how to cache your content.

🏗️

Infrastructure

Are your caching, errors, and rate limits agent-ready?

6 rules

⚡

Cache Headers

Your site returns structured JSON for 404 errors instead of plain HTML.

🚫

Structured 404 Errors

Your site sends rate limit headers so agents know how many requests they can make.

⏱️

Rate Limit Headers

Your site automatically redirects HTTP requests to HTTPS so agents always use a secure connection.

🔒

HTTPS Redirect Enforced

high Quick fix Semantic

🔒

Content-Security-Policy header

Your homepage returns a Content-Security-Policy header.

Your homepage returns a Referrer-Policy header.

🔒

Referrer-Policy header

Agent policy machine-readable

📜

Agent Policy

Is there a machine-readable usage policy for automated clients?

1 rule

📜

A machine-readable usage policy for AI agents is present.