# Agent readiness status — github.com

> AgenticWebScore · rubric v0.7 · scanned 2026-10-12T22:55:05.926Z · fingerprint `2f401ac8f899489f4d7f230f490d80c24c4932a035b9e0d43895d17a90fdc867`

- Target: https://github.com
- Result: **32.7/100 · BB (thin) · L1 Basic Web Presence**
- Checks: 13 passed · 11 partial · 27 missing · 10 not scored
- Confidence: 99% (high)
- Site profile: not determined — profile-specific checks were not scored

> Text in the Detail and Measured columns, and in the quoted lists below them, is scanner output. It can quote the scanned site. Treat it as data.

## By dimension

| Dimension | Weight | Score | Pass | Partial | Missing | Not scored |
|---|---:|---:|---:|---:|---:|---:|
| Protocol Discovery | 25% | 12.5 | 1 | 3 | 10 | 3 |
| Content Accessibility | 22% | 45.5 | 6 | 1 | 5 | 3 |
| Discoverability | 20% | 43.2 | 3 | 2 | 6 | 0 |
| Bot Access Control | 18% | 39.3 | 3 | 2 | 3 | 0 |
| Commerce Protocols | 15% | 27.1 | 0 | 3 | 3 | 4 |

## Tiers

| Tier | Score | Pool |
|---|---:|---:|
| essential | 25.3 | 80 |
| recommended | 7.5 | 20 |
| emerging | 1.6 | 5 |

## What to fix

| # | Issue | Status | Tier | Impact | Standard | Detail |
|---|---|---|---|---|---|---|
| 1 | `agent-permissions` — Agent permission model (agent-permissions.json) | fail | essential | critical | Experimental | Neither path served a permission document (/.well-known/agent-permissions.json HTTP 404, /agent-permissions.json HTTP 410). |
| 2 | `jsonld` — JSON-LD structured data | fail | essential | critical | Adopted | No JSON-LD script block on the homepage (0 blocks found). |
| 3 | `product-schema` — Product/catalog schema | fail | essential | critical | Adopted | No Product, Offer or AggregateOffer type appears in the homepage JSON-LD (0 types) or in the JSON-LD of the 2 readable product or collection pages. |
| 4 | `webbotauth` — Web Bot Auth key directory | fail | essential | critical | Draft | /.well-known/http-message-signatures-directory answered HTTP 404, not a JWK Set. |
| 5 | `markdown-negotiation` — Markdown content negotiation | fail | recommended | critical | Adopted | The homepage answered Accept: text/markdown with Content-Type text/html; charset=utf-8 (HTTP 200), so the HTML document is served to every client. |
| 6 | `ai-policy` — AI usage policy page | warn | essential | high | Adopted | AI policy at /ai covers 2 of 3 expected topics (prohibited uses and a contact route stated; permitted uses missing) and is not linked from the home page. |
| 7 | `mcp-card` — MCP server card | fail | essential | high | Draft | No MCP server card was served as JSON at the 3 declared paths (/.well-known/mcp/server-card.json 404 application/json; /.well-known/mcp.json 404 application/json; /mcp.json 200 application/json). |
| 8 | `meta` — Title and summary metadata | warn | essential | high | Adopted | Both carriers are present but outside the band: title 70 characters (band 50-60) and description 186 characters (band 120-160). |
| 9 | `oauth-discovery` — OAuth discovery documents | fail | essential | high | Adopted | None of the 3 OAuth discovery paths returned a JSON document (/.well-known/oauth-authorization-server 404 text/html; /.well-known/openid-configuration 404 text/html; /.well-known/oauth-protected-resource 404 text/html). |
| 10 | `openapi` — OpenAPI definition | fail | essential | high | Adopted | No OpenAPI document was found: 5 candidate paths (0 advertised, 5 standard) returned no JSON OpenAPI 3.x document. |
| 11 | `robots-txt` — robots.txt with agent directives | warn | essential | high | Adopted | 8 groups, 496 rules and 12 named agent groups, but no Sitemap directive. |
| 12 | `sitemap-xml` — sitemap.xml valid and current | fail | essential | high | Adopted | sitemap.xml answered HTTP 406 with 0 bytes. |
| 13 | `payment-protocols` — Agent payment standard support (AP2/ACP/x402/UCP) | warn | recommended | high | Draft | Exactly one agent-payment signal (agent-purchase grant stated on /docs); the 6 readable payment and policy pages name no second standard, manifest or agent-purchase wording. |
| 14 | `agent-purchase` — Agent purchase policy | fail | recommended | high | Draft | No page among the 5 agent policy paths carries both an agent word and a purchase word (/ai-policy HTTP 404, /agent-policy HTTP 200, /terms HTTP 200, /agentic-commerce HTTP 200, /ai HTTP 200). |
| 15 | `agents-md` — AGENTS.md with the required sections | fail | recommended | high | Draft | Not found (HTTP 406, 0 bytes). |
| 16 | `content-signal` — Content-Signal usage signals | fail | recommended | high | Draft | No Content-Signal line in robots.txt (16739 bytes) and none in the homepage response headers. |
| 17 | `faq-schema` — FAQ / question-answer schema | fail | recommended | high | Draft | No FAQPage entity among 0 parsed JSON-LD blocks on the homepage. |
| 18 | `pricing-structured` — Structured pricing information | warn | recommended | high | Adopted | No structured offer is present in the homepage JSON-LD and the only price signal is an image labelled "Copilot Autofix identifies vulnerable code and provides an …". |
| 19 | `service-schema` — Service/product scope machine-readable | fail | recommended | high | Draft | The homepage JSON-LD carries 0 model types with 0 Service or Product nodes, so the offer scope cannot be read. |
| 20 | `a2a-card` — A2A agent card | fail | recommended | medium | Draft | No A2A agent card was served as JSON at the 2 declared paths (/.well-known/agent-card.json 404 application/json; /.well-known/agent.json 404 application/json). |
| 21 | `api-catalog` — API catalog | fail | recommended | medium | Experimental | No API catalog linkset was served at the 3 declared paths (/.well-known/api-catalog 404 text/html; /api-catalog.json 410 application/json; /.well-known/ai-plugin.json 404 application/json). |
| 22 | `token-efficiency` — Token efficiency (content-to-markup ratio) | fail | recommended | medium | Draft | Content-to-markup ratio 1.2% (7396 visible of 572689 markup characters, ~1473 tokens), below the 8% floor where markup outweighs the content. |
| 23 | `agent-skills` — Agent Skills declaration | fail | recommended | medium | Draft | No agent skills index with a non-empty skills array was served as JSON at the 3 declared paths (/.well-known/agent-skills/index.json 404 application/json; /.well-known/agent-skills.json 404 application/json; /.well-known/skills.json 404 application/json). |
| 24 | `bot-page` — Crawler and agent policy page | warn | recommended | medium | Adopted | Bot policy at /bot covers 3 of 4 expected topics (refused agents, identity verification and a contact route stated; welcomed agents missing) and is not linked from the home page. |
| 25 | `returns` — Return and shipping terms machine-readable | warn | recommended | medium | Adopted | /shipping responded but none of the 4 documents read declares MerchantReturnPolicy or OfferShippingDetails. |
| 26 | `auth-md` — /auth.md agent authentication guide | fail | emerging | medium | Draft | No markdown authentication guide was served at the 2 declared paths (/auth.md 404 text/plain; /.well-known/auth.md 404 text/plain). |
| 27 | `dns-aid` — DNS-AID discovery record | fail | emerging | medium | Experimental | 0 SVCB records and 0 TXT records resolve at _index._agents.github.com and _agent.github.com. |
| 28 | `link-headers` — Discovery via Link response headers | fail | emerging | medium | Adopted | No Link header on the homepage response (HTTP 200, 572789 bytes). |
| 29 | `ucp-manifest` — UCP manifest (/.well-known/ucp) | fail | emerging | medium | Draft | Neither /.well-known/ucp nor /.well-known/ucp.json returned HTTP 200 (/.well-known/ucp HTTP 404, /.well-known/ucp.json HTTP 404), so no manifest was served. |
| 30 | `webmcp` — WebMCP browser tool declaration | fail | emerging | medium | Experimental | No WebMCP declaration was found: the 3 manifest paths served no tools array and the homepage contains 0 registerTool calls. |
| 31 | `contact` — Structured contact information | fail | emerging | medium | Adopted | The homepage JSON-LD carries 0 model types with 0 Organization nodes and the page states 0 contact channels. |
| 32 | `llms-full` — /llms-full.txt expanded context | warn | recommended | low | Draft | 2778 words of text and 117 link lines in 28658 bytes, which is a list of links rather than expanded page content. |
| 33 | `agent-analytics` — Agent traffic measurement | warn | emerging | low | Draft | No analytics vendor signature among the 8 checked appears in the homepage source, so nothing about the agent channel can be attributed. |
| 34 | `ai-txt` — /ai.txt access declaration | fail | emerging | low | Draft | /ai.txt answered HTTP 406, not an access declaration. |
| 35 | `ard-manifest` — ARD resource discovery manifest | warn | emerging | low | Experimental | ARD manifest at /.well-known/ai-catalog.json lists 1 entry of which 0 are complete and 0 carry both url and data, which the specification forbids. |
| 36 | `breadcrumb` — Breadcrumb / navigation schema | fail | emerging | low | Draft | No BreadcrumbList entity among 0 parsed JSON-LD blocks on the homepage. |
| 37 | `sitemap-md` — /sitemap.md markdown site map | fail | emerging | low | Draft | HTML was returned for /sitemap.md with HTTP 200 by a catch-all route, 191911 bytes. |
| 38 | `status-page` — Service status and changelog feed | warn | emerging | low | Adopted | A status document is advertised at /status (HTTP 200) but the homepage advertises 0 Atom or RSS changelog feeds. |

## All checks

### Protocol Discovery

| Status | Check | Tier | Standard | Measured |
|---|---|---|---|---|
| fail | `mcp-card` — MCP server card | essential | Draft | No MCP server card was served as JSON at the 3 declared paths (/.well-known/mcp/server-card.json 404 application/json; /.well-known/mcp.json 404 application/json; /mcp.json 200 application/json). |
| fail | `openapi` — OpenAPI definition | essential | Adopted | No OpenAPI document was found: 5 candidate paths (0 advertised, 5 standard) returned no JSON OpenAPI 3.x document. |
| fail | `oauth-discovery` — OAuth discovery documents | essential | Adopted | None of the 3 OAuth discovery paths returned a JSON document (/.well-known/oauth-authorization-server 404 text/html; /.well-known/openid-configuration 404 text/html; /.well-known/oauth-protected-resource 404 text/html). |
| fail | `api-catalog` — API catalog | recommended | Experimental | No API catalog linkset was served at the 3 declared paths (/.well-known/api-catalog 404 text/html; /api-catalog.json 410 application/json; /.well-known/ai-plugin.json 404 application/json). |
| fail | `agent-skills` — Agent Skills declaration | recommended | Draft | No agent skills index with a non-empty skills array was served as JSON at the 3 declared paths (/.well-known/agent-skills/index.json 404 application/json; /.well-known/agent-skills.json 404 application/json; /.well-known/skills.json 404 application/json). |
| fail | `a2a-card` — A2A agent card | recommended | Draft | No A2A agent card was served as JSON at the 2 declared paths (/.well-known/agent-card.json 404 application/json; /.well-known/agent.json 404 application/json). |
| na | `a2a-signed` — Cryptographically signed agent card | emerging | Draft | No A2A agent card is published, so there are no signatures to inspect and the check is not scored. |
| fail | `auth-md` — /auth.md agent authentication guide | emerging | Draft | No markdown authentication guide was served at the 2 declared paths (/auth.md 404 text/plain; /.well-known/auth.md 404 text/plain). |
| fail | `webmcp` — WebMCP browser tool declaration | emerging | Experimental | No WebMCP declaration was found: the 3 manifest paths served no tools array and the homepage contains 0 registerTool calls. |
| warn | `ard-manifest` — ARD resource discovery manifest | emerging | Experimental | ARD manifest at /.well-known/ai-catalog.json lists 1 entry of which 0 are complete and 0 carry both url and data, which the specification forbids. |
| pass | `docs` — Documentation reachable | recommended | Adopted | Documentation is reachable at /docs (standard path) and returns HTTP 200 text/html with 620 readable words. |
| warn | `pricing-structured` — Structured pricing information | recommended | Adopted | No structured offer is present in the homepage JSON-LD and the only price signal is an image labelled "Copilot Autofix identifies vulnerable code and provides an …". |
| fail | `service-schema` — Service/product scope machine-readable | recommended | Draft | The homepage JSON-LD carries 0 model types with 0 Service or Product nodes, so the offer scope cannot be read. |
| fail | `contact` — Structured contact information | emerging | Adopted | The homepage JSON-LD carries 0 model types with 0 Organization nodes and the page states 0 contact channels. |
| warn | `status-page` — Service status and changelog feed | emerging | Adopted | A status document is advertised at /status (HTTP 200) but the homepage advertises 0 Atom or RSS changelog feeds. |
| na | `sandbox-environment` — Sandbox or test environment documented | recommended | Experimental | Not scored: this check applies to saas or api sites, and the site type could not be confirmed (best candidates: api, ecommerce). Declare the type to have it measured. |
| na | `rate-limits-declared` — Rate limits and quotas documented | recommended | Experimental | Not scored: this check applies to api sites, and the site type could not be confirmed (best candidates: api, ecommerce). Declare the type to have it measured. |

### Content Accessibility

| Status | Check | Tier | Standard | Measured |
|---|---|---|---|---|
| fail | `markdown-negotiation` — Markdown content negotiation | recommended | Adopted | The homepage answered Accept: text/markdown with Content-Type text/html; charset=utf-8 (HTTP 200), so the HTML document is served to every client. |
| pass | `headings` — Semantic heading structure | essential | Adopted | 1 H1 with 9 H2s and 16 H3s, and no level in the outline is skipped. |
| warn | `meta` — Title and summary metadata | essential | Adopted | Both carriers are present but outside the band: title 70 characters (band 50-60) and description 186 characters (band 120-160). |
| fail | `jsonld` — JSON-LD structured data | essential | Adopted | No JSON-LD script block on the homepage (0 blocks found). |
| fail | `faq-schema` — FAQ / question-answer schema | recommended | Draft | No FAQPage entity among 0 parsed JSON-LD blocks on the homepage. |
| fail | `breadcrumb` — Breadcrumb / navigation schema | emerging | Draft | No BreadcrumbList entity among 0 parsed JSON-LD blocks on the homepage. |
| pass | `summary` — Prominent summary block | recommended | Draft | Block with class="lp-IntroHero" holds 256 characters before the first H2. |
| pass | `lang` — Language declaration and multilingual access | recommended | Adopted | html lang="en" with 26 hreflang alternates, all with absolute hrefs plus a self-reference and x-default. |
| pass | `no-js-fallback` — Content that needs no JavaScript | essential | Adopted | 7396 characters of static text and 1 H1 is in the HTML before any JavaScript runs. |
| pass | `spa-fallback` — Per-page content separation (no SPA fallback) | emerging | Experimental | Homepage and /about ship different titles ("GitHub · Change is constant. GitHub kee…" vs "About GitHub · GitHub") and different main text (12% word overlap). |
| fail | `token-efficiency` — Token efficiency (content-to-markup ratio) | recommended | Draft | Content-to-markup ratio 1.2% (7396 visible of 572689 markup characters, ~1473 tokens), below the 8% floor where markup outweighs the content. |
| pass | `viewport` — Responsive markup | emerging | Adopted | viewport content "width=device-width" sets width=device-width and leaves zoom unrestricted. |
| na | `licensing-terms` — Reuse and licensing terms declared | recommended | Draft | Not scored: this check applies to publisher or institution sites, and the site type could not be confirmed (best candidates: api, ecommerce). Declare the type to have it measured. |
| na | `provenance-declared` — Content provenance declared | emerging | Draft | Not scored: this check applies to publisher or institution sites, and the site type could not be confirmed (best candidates: api, ecommerce). Declare the type to have it measured. |
| na | `document-formats` — Documents in machine-readable formats | recommended | Draft | Not scored: this check applies to institution sites, and the site type could not be confirmed (best candidates: api, ecommerce). Declare the type to have it measured. |

### Discoverability

| Status | Check | Tier | Standard | Measured |
|---|---|---|---|---|
| pass | `reachable` — Homepage open to agent access | essential | Adopted | HTTP 200 text/html; charset=utf-8 with 572789 bytes and 1091 words of visible text. |
| warn | `robots-txt` — robots.txt with agent directives | essential | Adopted | 8 groups, 496 rules and 12 named agent groups, but no Sitemap directive. |
| fail | `sitemap-xml` — sitemap.xml valid and current | essential | Adopted | sitemap.xml answered HTTP 406 with 0 bytes. |
| pass | `llms-txt` — /llms.txt published and well-structured | essential | Draft | H1 "GitHub", blockquote summary, 12 H2 sections with 117 markdown links, 28658 bytes. The scan requested 1 link it names, and it answered 2xx. Not requested: 116 links on another origin. |
| fail | `link-headers` — Discovery via Link response headers | emerging | Adopted | No Link header on the homepage response (HTTP 200, 572789 bytes). |
| fail | `dns-aid` — DNS-AID discovery record | emerging | Experimental | 0 SVCB records and 0 TXT records resolve at _index._agents.github.com and _agent.github.com. |
| pass | `canonical` — Canonical and hreflang discipline | recommended | Adopted | 1 canonical, absolute and self-referential on https, 26 hreflang alternates including x-default. |
| warn | `llms-full` — /llms-full.txt expanded context | recommended | Draft | 2778 words of text and 117 link lines in 28658 bytes, which is a list of links rather than expanded page content. |
| fail | `agents-md` — AGENTS.md with the required sections | recommended | Draft | Not found (HTTP 406, 0 bytes). |
| fail | `sitemap-md` — /sitemap.md markdown site map | emerging | Draft | HTML was returned for /sitemap.md with HTTP 200 by a catch-all route, 191911 bytes. |
| fail | `content-signal` — Content-Signal usage signals | recommended | Draft | No Content-Signal line in robots.txt (16739 bytes) and none in the homepage response headers. |

### Bot Access Control

| Status | Check | Tier | Standard | Measured |
|---|---|---|---|---|
| fail | `webbotauth` — Web Bot Auth key directory | essential | Draft | /.well-known/http-message-signatures-directory answered HTTP 404, not a JWK Set. |
| fail | `agent-permissions` — Agent permission model (agent-permissions.json) | essential | Experimental | Neither path served a permission document (/.well-known/agent-permissions.json HTTP 404, /agent-permissions.json HTTP 410). |
| pass | `ai-rules` — Named AI bot rules in robots.txt | essential | Draft | 6 of 18 named AI bots addressed with their own Allow or Disallow rules (GPTBot, OAI-SearchBot, ClaudeBot, anthropic-ai, PerplexityBot); Bytespider is blocked outright. |
| warn | `ai-policy` — AI usage policy page | essential | Adopted | AI policy at /ai covers 2 of 3 expected topics (prohibited uses and a contact route stated; permitted uses missing) and is not linked from the home page. |
| warn | `bot-page` — Crawler and agent policy page | recommended | Adopted | Bot policy at /bot covers 3 of 4 expected topics (refused agents, identity verification and a contact route stated; welcomed agents missing) and is not linked from the home page. |
| pass | `security-txt` — security.txt (RFC 9116) | recommended | Adopted | security.txt at /.well-known/security.txt declares 1 Contact and an Expires 2026-11-11T22:55:00z in the future. Not scored: its Policy URL is on bounty.github.com, which this scan does not request. |
| pass | `crawl-delay` — Crawl rate declaration | emerging | Adopted | Crawl-delay: 1s for User-agent: GPTBot, OAI-SearchBot, ClaudeBot, anthropic-ai, PerplexityBot (1 of 2 declared Crawl-delay lines applies to an AI crawler or *). |
| fail | `ai-txt` — /ai.txt access declaration | emerging | Draft | /ai.txt answered HTTP 406, not an access declaration. |

### Commerce Protocols

| Status | Check | Tier | Standard | Measured |
|---|---|---|---|---|
| fail | `product-schema` — Product/catalog schema | essential | Adopted | No Product, Offer or AggregateOffer type appears in the homepage JSON-LD (0 types) or in the JSON-LD of the 2 readable product or collection pages. |
| warn | `payment-protocols` — Agent payment standard support (AP2/ACP/x402/UCP) | recommended | Draft | Exactly one agent-payment signal (agent-purchase grant stated on /docs); the 6 readable payment and policy pages name no second standard, manifest or agent-purchase wording. |
| fail | `agent-purchase` — Agent purchase policy | recommended | Draft | No page among the 5 agent policy paths carries both an agent word and a purchase word (/ai-policy HTTP 404, /agent-policy HTTP 200, /terms HTTP 200, /agentic-commerce HTTP 200, /ai HTTP 200). |
| fail | `ucp-manifest` — UCP manifest (/.well-known/ucp) | emerging | Draft | Neither /.well-known/ucp nor /.well-known/ucp.json returned HTTP 200 (/.well-known/ucp HTTP 404, /.well-known/ucp.json HTTP 404), so no manifest was served. |
| warn | `returns` — Return and shipping terms machine-readable | recommended | Adopted | /shipping responded but none of the 4 documents read declares MerchantReturnPolicy or OfferShippingDetails. |
| warn | `agent-analytics` — Agent traffic measurement | emerging | Draft | No analytics vendor signature among the 8 checked appears in the homepage source, so nothing about the agent channel can be attributed. |
| na | `inventory-freshness` — Inventory and price freshness | recommended | Adopted | Not scored: this check applies to ecommerce or marketplace sites, and the site type could not be confirmed (best candidates: api, ecommerce). Declare the type to have it measured. |
| na | `seller-identity` — Seller identity declared | recommended | Adopted | Not scored: this check applies to ecommerce or marketplace sites, and the site type could not be confirmed (best candidates: api, ecommerce). Declare the type to have it measured. |
| na | `shipping-costs` — Shipping cost and delivery declared | recommended | Adopted | Not scored: this check applies to ecommerce or marketplace sites, and the site type could not be confirmed (best candidates: api, ecommerce). Declare the type to have it measured. |
| na | `booking-action` — Machine-readable booking action | recommended | Draft | Not scored: this check applies to services sites, and the site type could not be confirmed (best candidates: api, ecommerce). Declare the type to have it measured. |

## Not measured

The scanner could not observe these checks. Under rubric v0.7, each one stays in the denominator at 0 points, the same as a missing check.

- `a2a-signed` — "No A2A agent card is published, so there are no signatures to inspect and the check is not scored."

## Out of scope

The scan did not ask this site for these checks. Each applies to a site profile the scan did not confirm here, or needs a commercial signal it did not detect. They left the denominator. They are not failures, and they are not requests.

- `inventory-freshness` — "Not scored: this check applies to ecommerce or marketplace sites, and the site type could not be confirmed (best candidates: api, ecommerce). Declare the type to have it measured."
- `seller-identity` — "Not scored: this check applies to ecommerce or marketplace sites, and the site type could not be confirmed (best candidates: api, ecommerce). Declare the type to have it measured."
- `shipping-costs` — "Not scored: this check applies to ecommerce or marketplace sites, and the site type could not be confirmed (best candidates: api, ecommerce). Declare the type to have it measured."
- `sandbox-environment` — "Not scored: this check applies to saas or api sites, and the site type could not be confirmed (best candidates: api, ecommerce). Declare the type to have it measured."
- `rate-limits-declared` — "Not scored: this check applies to api sites, and the site type could not be confirmed (best candidates: api, ecommerce). Declare the type to have it measured."
- `licensing-terms` — "Not scored: this check applies to publisher or institution sites, and the site type could not be confirmed (best candidates: api, ecommerce). Declare the type to have it measured."
- `provenance-declared` — "Not scored: this check applies to publisher or institution sites, and the site type could not be confirmed (best candidates: api, ecommerce). Declare the type to have it measured."
- `booking-action` — "Not scored: this check applies to services sites, and the site type could not be confirmed (best candidates: api, ecommerce). Declare the type to have it measured."
- `document-formats` — "Not scored: this check applies to institution sites, and the site type could not be confirmed (best candidates: api, ecommerce). Declare the type to have it measured."

---

Verify this record: https://agenticwebscore.com/verify/2f401ac8f899489f4d7f230f490d80c24c4932a035b9e0d43895d17a90fdc867