61 checks · 5 dimensions · 8 site profiles

The 61 checks

Every check states what is measured, the exact requests the scanner makes, a command you can run against your own domain, and the artifact to ship. Nothing here is a checklist item you have to take on faith.

At a glance

Essential: 16; pool 80 pts
Recommended: 28; pool 20 pts
Emerging: 17; pool 5 pts
Conditional: 6; commerce only

Jump to a dimension

All 61 checks in rubric v0.7, grouped by dimension. Every check has its own page with what is measured, the exact requests the scanner makes, a command you can run yourself, and the artifact to ship.

The 61 checks — Dimension, Weight, Checks, Question
Dimension	Weight	Checks	Question
Protocol Discovery	25%	17	Do you expose your service as a callable tool and an authorisable API?
Content Accessibility	22%	15	Is your content genuinely readable as markdown, semantic structure and structured data?
Discoverability	20%	11	Can an agent find you, reach the right page and understand what you offer?
Bot Access Control	18%	8	Can you tell agent traffic apart by identity?
Commerce Protocols	15% (conditional)	10	Which standard do you accept agent-initiated transactions over?

Protocol Discovery — 17 checks

MCP server card, A2A agent card, OAuth discovery, OpenAPI, Agent Skills, WebMCP. The layer that lets an agent use you instead of guessing at you.

Protocol Discovery — 17 checks — Check, Tier, Impact, Maturity, Rationale
Check	Tier	Impact	Maturity	Rationale
`mcp-card` — MCP server card	Essential	high	Draft	Since MCP 2026-07-28, agents discover tool servers through a published declaration.
`oauth-discovery` — OAuth discovery documents	Essential	high	Adopted	Required for agents to connect to your authenticated API on their own (RFC 8414 / RFC 9728).
`openapi` — OpenAPI definition	Essential	high	Adopted	A machine-readable contract so an agent can discover your API and generate correct calls.
`pricing-structured` — Structured pricing information	Recommended	high	Adopted	An offer without a price cannot be compared by an agent — you drop out of consideration.
`service-schema` — Service/product scope machine-readable	Recommended	high	Draft	An agent must be able to answer "what does this site offer, and to whom".
`a2a-card` — A2A agent card	Recommended	medium	Draft	A2A v1.0 (Linux Foundation) is the emerging standard for agent-to-agent discovery. Almost no site publishes a card yet, which makes this one of the cheapest places to be early.
`agent-skills` — Agent Skills declaration	Recommended	medium	Draft	Offers ready-made capability packages to agent runtimes.
`api-catalog` — API catalog	Recommended	medium	Experimental	Lets an agent see which capabilities are callable in a single document (RFC 9727).
`docs` — Documentation reachable	Recommended	medium	Adopted	An agent needs documentation to complete an integration on its own.
`rate-limits-declared` — Rate limits and quotas documented	Recommended	medium	Experimental	An agent that does not know the quota discovers it by being throttled, halfway through a task it cannot resume.
`sandbox-environment` — Sandbox or test environment documented	Recommended	medium	Experimental	An agent cannot safely integrate against a production endpoint; a documented sandbox is the difference between a working trial and a support ticket.
`a2a-signed` — Cryptographically signed agent card	Emerging	medium	Draft	A2A v1.0 makes identity verifiable through JWS (RFC 7515).
`auth-md` — /auth.md agent authentication guide	Emerging	medium	Draft	A guide telling an agent which authentication flow to use.
`contact` — Structured contact information	Emerging	medium	Adopted	An agent must know where to reach you before starting a transaction, or when something fails.
`webmcp` — WebMCP browser tool declaration	Emerging	medium	Experimental	WebMCP lets sites expose tools to in-browser agents. It is the only normative deliverable of the W3C Agentic Web WG.
`ard-manifest` — ARD resource discovery manifest	Emerging	low	Experimental	Cisco/Outshift's Agentic Resource Discovery specification; Lighthouse audits it too.
`status-page` — Service status and changelog feed	Emerging	low	Adopted	An agent should be able to learn about outages and API changes in a machine-readable way.

Content Accessibility — 15 checks

Server-side rendering, markdown negotiation, semantic headings, JSON-LD. Adobe measured that 39% of retail product pages cannot be read by a machine.

Content Accessibility — 15 checks — Check, Tier, Impact, Maturity, Rationale
Check	Tier	Impact	Maturity	Rationale
`jsonld` — JSON-LD structured data	Essential	critical	Adopted	The entity type becomes unambiguous to a machine. Without authoritative data, an agent answers from whatever it can scrape.
`headings` — Semantic heading structure	Essential	high	Adopted	A single H1 and a consistent H2 structure let the content be split correctly.
`meta` — Title and summary metadata	Essential	high	Adopted	This is how an agent learns what a page is about without opening it.
`no-js-fallback` — Content that needs no JavaScript	Essential	high	Adopted	If content is only produced client-side, the page is empty for agents that do not run JavaScript.
`markdown-negotiation` — Markdown content negotiation	Recommended	critical	Adopted	Agents can request a markup-free version with "Accept: text/markdown", which cuts token cost.
`faq-schema` — FAQ / question-answer schema	Recommended	high	Draft	Question-and-answer content is the type agents quote most.
`licensing-terms` — Reuse and licensing terms declared	Recommended	high	Draft	Declaring ai-train=no without stating a licensing path leaves both the publisher and the agent without an answer they can act on.
`document-formats` — Documents in machine-readable formats	Recommended	medium	Draft	A PDF that carries no document structure is unreadable to an agent and to a screen reader alike — the same defect, found twice.
`lang` — Language declaration and multilingual access	Recommended	medium	Adopted	A wrong language tag makes an agent misread the content.
`summary` — Prominent summary block	Recommended	medium	Draft	The llms.txt contract recommends a short summary at the top of every page; agents quote it directly.
`token-efficiency` — Token efficiency (content-to-markup ratio)	Recommended	medium	Draft	A bloated DOM wastes an agent's context window.
`provenance-declared` — Content provenance declared	Emerging	medium	Draft	Author, publication date and update date are what let an agent judge whether a source is current and attributable before it quotes it.
`spa-fallback` — Per-page content separation (no SPA fallback)	Emerging	medium	Experimental	A catch-all route returning the same skeleton for every URL makes pages indistinguishable to an agent.
`breadcrumb` — Breadcrumb / navigation schema	Emerging	low	Draft	Helps an agent make sense of where a page sits in your site.
`viewport` — Responsive markup	Emerging	low	Adopted	Agent browsers mostly run at mobile scale.

Discoverability — 11 checks

Machine discovery through robots.txt, sitemaps, DNS and link headers. The cheapest, highest-return layer of agent readiness.

Discoverability — 11 checks — Check, Tier, Impact, Maturity, Rationale
Check	Tier	Impact	Maturity	Rationale
`llms-txt` — /llms.txt published and well-structured	Essential	critical	Draft	The most widely adopted contract for making a site legible to agents. In the curated corpus we measured, 46% of sites published one and the average quality score was 37 out of 100 — adoption is not the same as usefulness.
`reachable` — Homepage open to agent access	Essential	critical	Adopted	If an agent cannot read your site, every other check is moot. Cloudflare began blocking AI crawlers by default in 2025, with signed agents routed separately.
`robots-txt` — robots.txt with agent directives	Essential	high	Adopted	The front door for agent traffic (RFC 9309).
`sitemap-xml` — sitemap.xml valid and current	Essential	high	Adopted	The primary URL discovery source for agent crawlers.
`agents-md` — AGENTS.md with the required sections	Recommended	high	Draft	The instruction file for coding and operations agents. It fails more often than any other check in the curated corpus we measured, and the usual reason is not a missing file but a file without the sections an agent needs.
`content-signal` — Content-Signal usage signals	Recommended	high	Draft	Declares how your content may be used, inside robots.txt. Cloudflare included this in its readiness checks.
`canonical` — Canonical and hreflang discipline	Recommended	medium	Adopted	An agent needs one consistent URL per important page.
`llms-full` — /llms-full.txt expanded context	Recommended	low	Draft	Lets an agent take in the full context in a single request instead of walking the site step by step.
`dns-aid` — DNS-AID discovery record	Emerging	medium	Experimental	Lets agents read discovery information over DNS without an HTTP round trip. Cloudflare added it to its readiness checklist.
`link-headers` — Discovery via Link response headers	Emerging	medium	Adopted	RFC 8288 Link headers let an agent find your discovery resources without parsing HTML.
`sitemap-md` — /sitemap.md markdown site map	Emerging	low	Draft	Lets an agent read your site structure as markdown in a single file. Adoption is still very low, so this is an early-mover advantage.

Bot Access Control — 8 checks

Cryptographic agent verification, content usage signals and an explicit permission model. Being blocked by IP is not a policy.

Bot Access Control — 8 checks — Check, Tier, Impact, Maturity, Rationale
Check	Tier	Impact	Maturity	Rationale
`agent-permissions` — Agent permission model (agent-permissions.json)	Essential	critical	Experimental	Declares which actions an agent may take, which are refused, and which need a person. It is the difference between a policy and a wish: in the curated corpus we measured, roughly one site in a hundred publishes one.
`webbotauth` — Web Bot Auth key directory	Essential	critical	Draft	RFC 9421 with Ed25519: the mechanism that lets a site verify which agent is calling rather than guessing from a user-agent string. Adoption in the curated corpus we measured is around one site in a hundred.
`ai-policy` — AI usage policy page	Essential	high	Adopted	States the rules agents must follow and reduces licensing ambiguity.
`ai-rules` — Named AI bot rules in robots.txt	Essential	high	Draft	Naming agent crawlers explicitly is the first step to being visible in agent traffic.
`bot-page` — Crawler and agent policy page	Recommended	medium	Adopted	Explains which agents are permitted and how they are verified.
`security-txt` — security.txt (RFC 9116)	Recommended	low	Adopted	Provides a responsible disclosure channel for agent-related security incidents.
`ai-txt` — /ai.txt access declaration	Emerging	low	Draft	Some agent ecosystems read an /ai.txt contract alongside robots.txt.
`crawl-delay` — Crawl rate declaration	Emerging	low	Adopted	Cloudflare's Verified Bots policy drops AI crawlers that ignore crawl-delay.

Commerce Protocols — 10 checks

ACP, AP2, x402, UCP/MPP, product schema and machine-readable returns. Excluded from the denominator unless the site shows a commercial signal.

Commerce Protocols — 10 checks — Check, Tier, Impact, Maturity, Rationale
Check	Tier	Impact	Maturity	Rationale
`product-schema` — Product/catalog schema	Essential	critical	Adopted	Product data is the most valuable and the least machine-readable: price, availability and returns are usually rendered for a person to read and never declared for a machine to parse.
`agent-purchase` — Agent purchase policy	Recommended	high	Draft	Liability is the open question in agent commerce, and it is a policy decision rather than a technical one: a site that accepts an agent purchase has to decide who carries the cost when the agent is wrong, and publish that decision where an agent can read it.
`inventory-freshness` — Inventory and price freshness	Recommended	high	Adopted	An agent that cannot tell whether an item is in stock — or when a price was last valid — will quote a stale offer to a buyer, or refuse to quote at all.
`payment-protocols` — Agent payment standard support (AP2/ACP/x402/UCP)	Recommended	high	Draft	The least-implemented surface in the rubric. Accepting an agent payment means choosing a standard and changing a checkout, which is a business decision most sites have not made yet.
`shipping-costs` — Shipping cost and delivery declared	Recommended	high	Adopted	A purchase agent that cannot compute the delivered total cannot complete a checkout, and returns to the merchant without it.
`booking-action` — Machine-readable booking action	Recommended	medium	Draft	For a service business the agent's task is to book, not to browse — a declared action is what turns a contact page into a completed job.
`returns` — Return and shipping terms machine-readable	Recommended	medium	Adopted	An agent must verify return terms before making a purchase decision.
`seller-identity` — Seller identity declared	Recommended	medium	Adopted	On a marketplace an offer is meaningless without knowing who is selling and who is the merchant of record, because that is who the agent has a contract with.
`ucp-manifest` — UCP manifest (/.well-known/ucp)	Emerging	medium	Draft	Google and Shopify's Universal Commerce Protocol; lets a merchant declare checkout capabilities at transaction time.
`agent-analytics` — Agent traffic measurement	Emerging	low	Draft	If agent traffic is not measured separately, the channel's return is invisible and never funded.