{ "$comment": "Canonical, machine-readable rubric. English is the only source language. The score, the report, the per-check pages and the published skills are all generated from this file.", "version": "0.7", "updated": "2026-10-12", "changes": [ { "version": "0.7", "date": "2026-10-12", "outcome": [ { "checks": [ "llms-txt" ], "change": "The link sample counts requests, not positions. A link on another origin, or one the scan already requested, no longer uses up the sample. A requested link that gets no answer is not measured, so it no longer makes the check partial." }, { "checks": [ "mcp-card" ], "change": "A streamable-http remote that answers 405 or 406 to a plain GET counts as a running server. So does any remote that answers 401 with a challenge naming resource_metadata. A bare 401 still does not count." }, { "checks": [ "mcp-card" ], "change": "The remotes sampled are those of the first card that offers a transport, which is the card the check reads." }, { "checks": [ "mcp-card", "api-catalog", "agent-skills", "oauth-discovery", "status-page", "docs", "sandbox-environment" ], "change": "A URL is on the scanned origin only when its scheme, host and port all match. A URL on another port or scheme is no longer judged by the scanned origin’s response." }, { "checks": [ "oauth-discovery" ], "change": "The scan requests the metadata of a same-origin authorization server named by protected resource metadata. When that metadata was requested and is missing, the check is partial." }, { "checks": [ "docs" ], "change": "The scan requests documentation pointers on the homepage, service-doc first, up to a published cap. It does not request API catalog targets. An anchor counts only when a whole path segment names a documentation section, and its text no longer counts. A requested pointer that gives no response earns no partial credit." }, { "checks": [ "breadcrumb" ], "change": "The last entry of a trail may omit item, as Google’s breadcrumb guidance allows. A value that is not a URL is still a defect." }, { "checks": [ "dns-aid" ], "change": "A record of another type in the answer, such as the CNAME of an alias, no longer counts as a DNS-AID record. When the DNS-over-HTTPS resolver answers no question, the check is not measured. It used to fail, or be judged on the TXT records the system resolver returned." }, { "checks": [], "change": "The probe phase stops at a whole-scan deadline. A scan that reaches it is reported as not measured, with no score, because part of the site was never requested." } ], "reporting": [ { "checks": [ "security-txt", "openapi", "api-catalog" ], "change": "The detail adds sentences prefixed “Not scored:” about the endpoints the document declares. They never change the status or the points." }, { "checks": [ "llms-txt" ], "change": "The detail counts the links the scan requested and names each link that did not answer 2xx with the status it answered." }, { "checks": [ "mcp-card" ], "change": "The detail names the remotes the scan did not request, instead of saying it requested them." }, { "checks": [ "openapi" ], "change": "A partial names the missing info.title or info.version, instead of saying the document has no callable operation." }, { "checks": [ "dns-aid" ], "change": "One TXT record that both resolvers return counts once in the detail." }, { "checks": [ "dns-aid" ], "change": "The evidence names the DNS names and record types the scan queried, instead of agent names it never queried. A fail names the same names in its detail." }, { "checks": [], "change": "A check that raises an internal error is reported as not measured, in one sentence the health endpoint recognises. Every detail and evidence line is cut to one published length." }, { "checks": [], "change": "A record counts the markdown negotiation request in its request total and request log." } ], "text": [ { "checks": [ "reachable" ], "change": "The measures text names the homepage statuses that make the whole scan not measured, which the engine already did." }, { "checks": [ "llms-txt" ], "change": "The measures text names every partial the check returns, including a missing blockquote and an H1 after other lines." }, { "checks": [ "agent-skills" ], "change": "The measures text states the fail clauses the check already returned: no index, or an artifact that does not match its digest." }, { "checks": [ "mcp-card", "docs", "oauth-discovery" ], "change": "The measures text describes the requests the scan now makes for these checks." }, { "checks": [ "dns-aid" ], "change": "The measures text names _agent., which the scan already queried, instead of agent names it never queried. It also says when the check is not measured." } ] } ], "totals": { "checks": 61, "skills": 60, "categories": 5, "profiles": 8, "byTier": { "essential": 16, "emerging": 17, "recommended": 28 }, "byScope": { "universal": 46, "commercial": 6, "profile": 9 }, "byMaturity": { "adopted": 27, "draft": 26, "experimental": 8 } }, "tiers": { "essential": 80, "recommended": 20, "emerging": 5 }, "grades": [ { "grade": "AAA", "min": 90, "label": "near-complete" }, { "grade": "AA", "min": 75, "label": "strong" }, { "grade": "A", "min": 60, "label": "solid" }, { "grade": "BBB", "min": 45, "label": "partial" }, { "grade": "BB", "min": 30, "label": "thin" }, { "grade": "B", "min": 15, "label": "minimal" }, { "grade": "C", "min": 5, "label": "barely started" }, { "grade": "D", "min": 0, "label": "nothing measurable" } ], "levels": [ { "level": 0, "name": "Not Ready", "min": 0, "blurb": "Agents cannot read, verify or use this site." }, { "level": 1, "name": "Basic Web Presence", "min": 14, "blurb": "The site is reachable, but there are no agent-specific signals." }, { "level": 2, "name": "Bot-Aware", "min": 30, "blurb": "Agent traffic is recognised and routed deliberately." }, { "level": 3, "name": "Agent-Readable", "min": 48, "blurb": "Content is genuinely machine-readable." }, { "level": 4, "name": "Agent-Integrated", "min": 66, "blurb": "The service is exposed as a callable, authorisable tool." }, { "level": 5, "name": "Agent-Native", "min": 82, "blurb": "Agents are first-class users: cryptographic identity and commerce protocols." } ], "levelRequirements": { "1": { "checks": [ "reachable" ], "note": "The site must first respond to agent requests." }, "2": { "checks": [ "robots-txt", "ai-rules", "content-signal", "sitemap-xml" ], "note": "Recognise agent traffic and route it deliberately." }, "3": { "checks": [ "llms-txt", "markdown-negotiation", "headings", "meta", "jsonld", "no-js-fallback" ], "note": "Present content in a form a machine can read." }, "4": { "checks": [ "mcp-card", "oauth-discovery", "api-catalog", "agent-permissions", "openapi" ], "note": "Make your service callable and authorisable." }, "5": { "checks": [ "webbotauth", "agent-permissions", "a2a-card", "payment-protocols", "product-schema" ], "note": "Cryptographic identity and commerce protocols." } }, "categories": [ { "id": "protocol", "label": "Protocol Discovery", "short": "Protocol", "weight": 0.25, "order": 1, "question": "Do you expose your service as a callable tool and an authorisable API?", "blurb": "MCP server card, A2A agent card, OAuth discovery, OpenAPI, Agent Skills, WebMCP. The layer that lets an agent use you instead of guessing at you." }, { "id": "content", "label": "Content Accessibility", "short": "Content", "weight": 0.22, "order": 2, "question": "Is your content genuinely readable as markdown, semantic structure and structured data?", "blurb": "Server-side rendering, markdown negotiation, semantic headings, JSON-LD. Adobe measured that 39% of retail product pages cannot be read by a machine." }, { "id": "discoverability", "label": "Discoverability", "short": "Discovery", "weight": 0.2, "order": 3, "question": "Can an agent find you, reach the right page and understand what you offer?", "blurb": "Machine discovery through robots.txt, sitemaps, DNS and link headers. The cheapest, highest-return layer of agent readiness." }, { "id": "botaccess", "label": "Bot Access Control", "short": "Access", "weight": 0.18, "order": 4, "question": "Can you tell agent traffic apart by identity?", "blurb": "Cryptographic agent verification, content usage signals and an explicit permission model. Being blocked by IP is not a policy." }, { "id": "commerce", "label": "Commerce Protocols", "short": "Commerce", "weight": 0.15, "order": 5, "conditional": true, "question": "Which standard do you accept agent-initiated transactions over?", "blurb": "ACP, AP2, x402, UCP/MPP, product schema and machine-readable returns. Excluded from the denominator unless the site shows a commercial signal." } ], "profiles": { "version": "1.1", "baseline": { "protocol": 0.25, "content": 0.22, "discoverability": 0.2, "botaccess": 0.18, "commerce": 0.15 }, "thresholds": { "minSignalScore": 3, "minMargin": 2, "strongSignalWeight": 3, "weakSignalWeight": 1, "note": "A profile is selected when its total signal weight reaches minSignalScore and it is the highest scorer. Otherwise the site is evaluated as 'general'." }, "policy": { "principle": "No profile-specific demand without a positively identified profile. Failing to understand a site must never turn into work for its owner.", "identified": "The profile's weights, not-applicable list and level requirements apply. Profile-scoped checks are in scope.", "ambiguous": "Baseline weights apply. Profile-scoped checks are NOT scored and leave the denominator. Both candidate types are reported and the owner is invited to declare one.", "unknown": "Baseline weights apply. Profile-scoped checks are NOT scored and leave the denominator. The report states plainly that the site type could not be determined.", "override": "A site owner may declare the type. A declared profile is treated as identified and the record states that it was declared rather than detected.", "why": [ "Demanding a product feed from a news publisher, or a booking action from a developer platform, is a false positive that costs the site owner real work.", "The cost of a missed optimisation is smaller than the cost of an incorrect instruction, because an incorrect instruction spends the site owner's trust as well as their time.", "So a check that only applies to some site types stays out of scope unless the type was positively identified — and the report says which checks were left out and why." ] }, "types": [ { "id": "ecommerce", "label": "E-commerce / retail", "short": "E-commerce", "question": "Can an agent find, price and buy your products without a human?", "blurb": "A catalogue that an agent cannot read is a catalogue that does not exist. Product truth, price, availability, returns and a declared checkout path carry most of the weight here.", "weights": { "commerce": 0.28, "protocol": 0.2, "content": 0.2, "discoverability": 0.18, "botaccess": 0.14 }, "weightRationale": "Commerce rises to the largest single dimension because a purchase agent that cannot read price, availability or returns cannot transact. Discovery and bot access stay relevant but are not what fails here.", "signals": [ { "kind": "jsonld-type", "value": "Product", "label": "Product schema on the homepage", "weight": 3 }, { "kind": "jsonld-type", "value": "Offer", "label": "Offer schema on the homepage", "weight": 3 }, { "kind": "jsonld-type", "value": "AggregateOffer", "label": "AggregateOffer schema on the homepage", "weight": 3 }, { "kind": "path", "value": "/cart", "label": "A cart path responds", "weight": 2 }, { "kind": "path", "value": "/checkout", "label": "A checkout path responds", "weight": 3 }, { "kind": "copy", "value": "add to cart", "label": "Purchase-intent copy", "weight": 2 }, { "kind": "copy", "value": "add to bag", "label": "Purchase-intent copy", "weight": 2 }, { "kind": "path", "value": "/products", "label": "A product listing path responds", "weight": 1 }, { "kind": "path", "value": "/shop", "label": "A shop path responds", "weight": 1 }, { "kind": "jsonld-type", "value": "ItemList", "label": "A product list schema", "weight": 1 } ], "notApplicable": [], "required": { "3": [ "llms-txt", "product-schema", "no-js-fallback" ], "4": [ "mcp-card", "api-catalog", "agent-purchase", "returns" ], "5": [ "payment-protocols", "ucp-manifest", "webbotauth", "inventory-freshness" ] }, "extraChecks": [ "inventory-freshness", "seller-identity", "shipping-costs" ] }, { "id": "marketplace", "label": "Marketplace / aggregator", "short": "Marketplace", "question": "Can an agent tell who is selling what, at what price, and buy it?", "blurb": "A marketplace has to expose two things an ordinary shop does not: seller identity and per-offer availability across many vendors.", "weights": { "commerce": 0.24, "protocol": 0.24, "content": 0.18, "discoverability": 0.18, "botaccess": 0.16 }, "weightRationale": "Commerce and protocol share the weight: the transaction surface and the seller/offer contract matter equally, and neither can be inferred from the other.", "signals": [ { "kind": "copy", "value": "marketplace", "label": "Describes itself as a marketplace", "weight": 3 }, { "kind": "copy", "value": "sellers", "label": "Refers to sellers", "weight": 2 }, { "kind": "path", "value": "/sell", "label": "A seller onboarding path responds", "weight": 3 }, { "kind": "jsonld-type", "value": "AggregateOffer", "label": "AggregateOffer schema", "weight": 2 }, { "kind": "jsonld-type", "value": "Product", "label": "Product schema", "weight": 2 }, { "kind": "copy", "value": "free shipping", "label": "Shipping signals", "weight": 1 } ], "notApplicable": [], "required": { "3": [ "llms-txt", "product-schema" ], "4": [ "mcp-card", "api-catalog", "agent-purchase", "seller-identity" ], "5": [ "payment-protocols", "ucp-manifest", "inventory-freshness", "webbotauth" ] }, "extraChecks": [ "inventory-freshness", "seller-identity", "shipping-costs" ] }, { "id": "saas", "label": "SaaS / software product", "short": "SaaS", "question": "Can an agent understand what the product does, what it costs, and how to call it?", "blurb": "The agent's job here is evaluation and integration, not purchase. Pricing truth, a machine-readable API contract and a callable tool surface dominate.", "weights": { "protocol": 0.3, "content": 0.22, "discoverability": 0.18, "botaccess": 0.18, "commerce": 0.12 }, "weightRationale": "Protocol rises because the product is a service: an agent that cannot discover the API or the MCP surface cannot do anything with the site at all. Commerce drops to a minor dimension.", "signals": [ { "kind": "jsonld-type", "value": "SoftwareApplication", "label": "SoftwareApplication schema", "weight": 3 }, { "kind": "path", "value": "/pricing", "label": "A pricing page responds", "weight": 2 }, { "kind": "copy", "value": "free trial", "label": "Trial signup copy", "weight": 2 }, { "kind": "path", "value": "/docs", "label": "A documentation path responds", "weight": 2 }, { "kind": "copy", "value": "api key", "label": "API credential copy", "weight": 2 }, { "kind": "jsonld-type", "value": "Service", "label": "Service schema", "weight": 1 } ], "notApplicable": [], "required": { "3": [ "llms-txt", "pricing-structured", "docs" ], "4": [ "mcp-card", "openapi", "oauth-discovery", "auth-md" ], "5": [ "webbotauth", "a2a-card", "sandbox-environment", "webmcp" ] }, "extraChecks": [ "sandbox-environment" ] }, { "id": "api", "label": "API / developer platform", "short": "API platform", "question": "Can an agent discover, authorise against and call the API without reading a tutorial?", "blurb": "For a developer platform the site is a means to an endpoint. Contract, authorisation and tool exposure are the product.", "weights": { "protocol": 0.34, "content": 0.2, "discoverability": 0.18, "botaccess": 0.18, "commerce": 0.1 }, "weightRationale": "The strongest protocol weight in the model. Discovery, contract and authorisation are what an integrating agent needs; commerce is almost incidental.", "signals": [ { "kind": "path", "value": "/openapi.json", "label": "An OpenAPI document responds", "weight": 3 }, { "kind": "path", "value": "/.well-known/openapi.json", "label": "A well-known OpenAPI document responds", "weight": 3 }, { "kind": "path", "value": "/docs", "label": "A documentation path responds", "weight": 2 }, { "kind": "copy", "value": "rate limit", "label": "Rate-limit documentation", "weight": 2 }, { "kind": "copy", "value": "api reference", "label": "API reference copy", "weight": 2 }, { "kind": "path", "value": "/developers", "label": "A developer portal responds", "weight": 2 } ], "notApplicable": [], "required": { "3": [ "llms-txt", "docs", "openapi" ], "4": [ "mcp-card", "api-catalog", "oauth-discovery", "auth-md", "agent-skills" ], "5": [ "webbotauth", "sandbox-environment", "a2a-card", "webmcp" ] }, "extraChecks": [ "sandbox-environment", "rate-limits-declared" ] }, { "id": "publisher", "label": "Content / media / publisher", "short": "Publisher", "question": "Can an agent read, quote and correctly attribute your content?", "blurb": "The content is the product. Machine readability, provenance, licensing and usage signals carry the weight; commerce is present only as licensing.", "weights": { "content": 0.3, "discoverability": 0.24, "botaccess": 0.18, "protocol": 0.16, "commerce": 0.12 }, "weightRationale": "Content and discovery dominate. Bot access stays high because a publisher's central decision is who may read and reuse the work.", "signals": [ { "kind": "jsonld-type", "value": "NewsArticle", "label": "NewsArticle schema", "weight": 3 }, { "kind": "jsonld-type", "value": "Article", "label": "Article schema", "weight": 3 }, { "kind": "jsonld-type", "value": "BlogPosting", "label": "BlogPosting schema", "weight": 3 }, { "kind": "path", "value": "/blog", "label": "A blog index responds", "weight": 2 }, { "kind": "path", "value": "/news", "label": "A news index responds", "weight": 2 }, { "kind": "copy", "value": "subscribe", "label": "Subscription copy", "weight": 1 } ], "notApplicable": [ "product-schema", "payment-protocols", "agent-purchase", "ucp-manifest", "returns", "pricing-structured", "inventory-freshness", "seller-identity", "shipping-costs", "sandbox-environment", "rate-limits-declared" ], "required": { "3": [ "llms-txt", "markdown-negotiation", "jsonld", "canonical" ], "4": [ "content-signal", "ai-policy", "api-catalog", "mcp-card" ], "5": [ "licensing-terms", "webbotauth", "agent-permissions" ] }, "extraChecks": [ "licensing-terms", "provenance-declared" ] }, { "id": "services", "$comment": "a2a-card is deliberately NOT in notApplicable. It was, while the same profile required it at L5 — a requirement that could never bite, because an out-of-scope check cannot hold a level back. The requirement is the right half of that pair: the card is how an agent reaches a service business at all, the baseline requires it at L5 too, and the remaining exclusions (openapi, agent-skills, webmcp, ard-manifest, ucp-manifest, docs) are developer-platform artifacts a local business does not publish. a2a-signed stays excluded: signing the card is emerging hardening, and no level gates on it.", "label": "Services / local business", "short": "Services", "question": "Can an agent understand what you offer, where, when and for how much?", "blurb": "The agent's task is qualification and booking. Service scope, location, hours, price range and a booking action are the signals that matter.", "weights": { "discoverability": 0.24, "content": 0.24, "protocol": 0.18, "botaccess": 0.16, "commerce": 0.18 }, "weightRationale": "Discovery and content lead because the site's job is to answer 'do you do this, here, and what does it cost'. Commerce is non-trivial because quotes and bookings are transactions.", "signals": [ { "kind": "jsonld-type", "value": "LocalBusiness", "label": "LocalBusiness schema", "weight": 3 }, { "kind": "jsonld-type", "value": "Service", "label": "Service schema", "weight": 2 }, { "kind": "copy", "value": "book an appointment", "label": "Booking copy", "weight": 3 }, { "kind": "copy", "value": "get a quote", "label": "Quote request copy", "weight": 2 }, { "kind": "path", "value": "/contact", "label": "A contact path responds", "weight": 1 }, { "kind": "path", "value": "/pricing", "label": "A pricing path responds", "weight": 1 } ], "notApplicable": [ "openapi", "agent-skills", "webmcp", "ard-manifest", "a2a-signed", "ucp-manifest", "product-schema", "inventory-freshness", "seller-identity", "shipping-costs", "sandbox-environment", "rate-limits-declared", "docs" ], "required": { "3": [ "llms-txt", "service-schema", "contact" ], "4": [ "pricing-structured", "mcp-card", "jsonld" ], "5": [ "booking-action", "webbotauth", "a2a-card" ] }, "extraChecks": [ "booking-action" ] }, { "id": "institution", "label": "Institution / public sector / education", "short": "Institution", "question": "Can an agent find the authoritative document, in an accessible form, and cite it?", "blurb": "The content is public by mandate. Accessibility, document formats, language declaration and a stable citation surface outrank any protocol ambition.", "weights": { "content": 0.26, "discoverability": 0.22, "botaccess": 0.2, "protocol": 0.18, "commerce": 0.14 }, "weightRationale": "Content and discovery lead, and bot access stays high because the material is meant to be read. Protocol is lower: these sites rarely expose callable services.", "signals": [ { "kind": "tld", "value": ".gov", "label": "A government domain", "weight": 3 }, { "kind": "tld", "value": ".edu", "label": "An education domain", "weight": 3 }, { "kind": "copy", "value": "university", "label": "University copy", "weight": 2 }, { "kind": "copy", "value": "municipality", "label": "Municipality copy", "weight": 2 }, { "kind": "copy", "value": "public records", "label": "Public records copy", "weight": 2 }, { "kind": "tld", "value": ".org", "label": "An organisation domain", "weight": 1 } ], "notApplicable": [ "product-schema", "payment-protocols", "agent-purchase", "ucp-manifest", "returns", "pricing-structured", "inventory-freshness", "seller-identity", "shipping-costs", "sandbox-environment", "rate-limits-declared" ], "required": { "3": [ "llms-txt", "lang", "headings", "no-js-fallback" ], "4": [ "content-signal", "ai-policy", "api-catalog", "docs" ], "5": [ "webbotauth", "agent-permissions", "licensing-terms" ] }, "extraChecks": [ "document-formats", "provenance-declared" ] }, { "id": "general", "label": "General website", "short": "General", "question": "Can an agent find you, read you and trust you?", "blurb": "No strong commercial, editorial or platform signal was detected. The baseline weighting applies and every non-conditional check is in scope.", "weights": { "protocol": 0.25, "content": 0.22, "discoverability": 0.2, "botaccess": 0.18, "commerce": 0.15 }, "weightRationale": "The published baseline. Used when no profile reaches the detection threshold, so that an unclassifiable site is still measured rather than skipped.", "signals": [], "notApplicable": [], "required": { "3": [ "llms-txt", "headings", "meta", "no-js-fallback" ], "4": [ "mcp-card", "api-catalog", "agent-permissions" ], "5": [ "webbotauth", "a2a-card", "content-signal" ] }, "extraChecks": [] } ] }, "skills": [ { "name": "agent-access", "title": "Open agent access (clear the 403/429 block)", "standards": [], "checks": [ "reachable" ] }, { "name": "robots-txt", "title": "Publish a valid robots.txt", "standards": [ "RFC 9309" ], "checks": [ "robots-txt" ] }, { "name": "sitemap", "title": "Publish a sitemap with lastmod", "standards": [], "checks": [ "sitemap-xml" ] }, { "name": "llms-txt", "title": "Publish llms.txt", "standards": [ "llmstxt.org" ], "checks": [ "llms-txt" ] }, { "name": "link-headers", "title": "Advertise discovery through Link headers", "standards": [ "RFC 8288" ], "checks": [ "link-headers" ] }, { "name": "dns-aid", "title": "Publish a DNS-AID discovery record", "standards": [], "checks": [ "dns-aid" ] }, { "name": "canonical", "title": "Establish canonical and hreflang discipline", "standards": [], "checks": [ "canonical" ] }, { "name": "llms-full-txt", "title": "Publish llms-full.txt", "standards": [], "checks": [ "llms-full" ] }, { "name": "agents-md", "title": "Publish AGENTS.md", "standards": [], "checks": [ "agents-md" ] }, { "name": "sitemap-md", "title": "Publish a markdown sitemap", "standards": [], "checks": [ "sitemap-md" ] }, { "name": "markdown-negotiation", "title": "Serve markdown on Accept: text/markdown", "standards": [ "RFC 9110" ], "checks": [ "markdown-negotiation" ] }, { "name": "semantic-headings", "title": "Build a semantic heading structure", "standards": [ "WCAG 2.2" ], "checks": [ "headings" ] }, { "name": "page-metadata", "title": "Add a title and meta description", "standards": [], "checks": [ "meta" ] }, { "name": "structured-data", "title": "Add JSON-LD structured data", "standards": [ "schema.org" ], "checks": [ "jsonld" ] }, { "name": "faq-schema", "title": "Add FAQ schema", "standards": [ "schema.org/FAQPage" ], "checks": [ "faq-schema" ] }, { "name": "breadcrumb-schema", "title": "Add breadcrumb schema", "standards": [ "schema.org/BreadcrumbList" ], "checks": [ "breadcrumb" ] }, { "name": "page-summary", "title": "Add a summary block", "standards": [], "checks": [ "summary" ] }, { "name": "language-declaration", "title": "Add a language declaration and hreflang", "standards": [], "checks": [ "lang" ] }, { "name": "server-rendering", "title": "Serve content that needs no JavaScript", "standards": [], "checks": [ "no-js-fallback", "spa-fallback" ] }, { "name": "token-efficiency", "title": "Improve the content-to-markup ratio", "standards": [], "checks": [ "token-efficiency" ] }, { "name": "responsive-markup", "title": "Add responsive markup", "standards": [], "checks": [ "viewport" ] }, { "name": "web-bot-auth", "title": "Publish a Web Bot Auth key directory", "standards": [ "RFC 9421" ], "checks": [ "webbotauth" ] }, { "name": "agent-permissions", "title": "Publish an agent permission model", "standards": [], "checks": [ "agent-permissions" ] }, { "name": "ai-rules", "title": "Add named AI bot rules to robots.txt", "standards": [ "RFC 9309" ], "checks": [ "ai-rules" ] }, { "name": "content-signals", "title": "Declare Content-Signal usage preferences", "standards": [ "contentsignals.org" ], "checks": [ "content-signal" ] }, { "name": "ai-policy", "title": "Publish an AI usage policy", "standards": [], "checks": [ "ai-policy" ] }, { "name": "bot-policy", "title": "Publish a crawler and agent policy page", "standards": [], "checks": [ "bot-page" ] }, { "name": "security-txt", "title": "Publish security.txt", "standards": [ "RFC 9116" ], "checks": [ "security-txt" ] }, { "name": "crawl-delay", "title": "Declare a crawl rate", "standards": [], "checks": [ "crawl-delay" ] }, { "name": "ai-txt", "title": "Publish an /ai.txt access declaration", "standards": [], "checks": [ "ai-txt" ] }, { "name": "mcp-server-card", "title": "Publish an MCP server card", "standards": [ "MCP 2026-07-28" ], "checks": [ "mcp-card" ] }, { "name": "openapi", "title": "Publish an OpenAPI definition", "standards": [ "OpenAPI 3.x" ], "checks": [ "openapi" ] }, { "name": "oauth-discovery", "title": "Publish OAuth discovery documents", "standards": [ "RFC 8414", "RFC 9728" ], "checks": [ "oauth-discovery" ] }, { "name": "api-catalog", "title": "Publish an API catalog", "standards": [ "RFC 9727" ], "checks": [ "api-catalog" ] }, { "name": "agent-skills", "title": "Publish an agent skills index", "standards": [], "checks": [ "agent-skills" ] }, { "name": "a2a-agent-card", "title": "Publish an A2A agent card", "standards": [ "A2A v1.0" ], "checks": [ "a2a-card" ] }, { "name": "a2a-card-signing", "title": "Sign the agent card", "standards": [ "RFC 7515" ], "checks": [ "a2a-signed" ] }, { "name": "auth-md", "title": "Publish an auth.md guide", "standards": [], "checks": [ "auth-md" ] }, { "name": "webmcp", "title": "Declare WebMCP tools", "standards": [ "W3C WebMCP" ], "checks": [ "webmcp" ] }, { "name": "ard", "title": "Publish an ARD resource manifest", "standards": [ "ard-spec" ], "checks": [ "ard-manifest" ] }, { "name": "documentation", "title": "Publish machine-readable documentation", "standards": [], "checks": [ "docs" ] }, { "name": "pricing-schema", "title": "Publish pricing as structured data", "standards": [ "schema.org/Offer" ], "checks": [ "pricing-structured" ] }, { "name": "service-schema", "title": "Add a service scope schema", "standards": [], "checks": [ "service-schema" ] }, { "name": "contact-schema", "title": "Add structured contact information", "standards": [ "schema.org/Organization" ], "checks": [ "contact" ] }, { "name": "status-changelog", "title": "Publish a status and changelog feed", "standards": [], "checks": [ "status-page" ] }, { "name": "product-schema", "title": "Add product schema", "standards": [ "schema.org/Product" ], "checks": [ "product-schema" ] }, { "name": "agent-payments", "title": "Declare agent payment standard support", "standards": [ "AP2", "ACP", "x402", "UCP" ], "checks": [ "payment-protocols" ] }, { "name": "agent-purchase-policy", "title": "Publish an agent purchase policy", "standards": [], "checks": [ "agent-purchase" ] }, { "name": "ucp", "title": "Publish a UCP manifest", "standards": [], "checks": [ "ucp-manifest" ] }, { "name": "return-policy-schema", "title": "Add return and shipping schema", "standards": [ "schema.org/MerchantReturnPolicy" ], "checks": [ "returns" ] }, { "name": "agent-analytics", "title": "Measure agent traffic separately", "standards": [], "checks": [ "agent-analytics" ] }, { "name": "inventory-freshness", "title": "Declare availability and price validity", "standards": [ "schema.org/Offer" ], "checks": [ "inventory-freshness" ] }, { "name": "seller-identity", "title": "Identify the seller and the merchant of record", "standards": [ "schema.org/Organization" ], "checks": [ "seller-identity" ] }, { "name": "shipping-costs", "title": "Publish shipping cost and delivery estimates", "standards": [ "schema.org/OfferShippingDetails" ], "checks": [ "shipping-costs" ] }, { "name": "sandbox-environment", "title": "Publish a sandbox environment", "standards": [], "checks": [ "sandbox-environment" ] }, { "name": "rate-limits", "title": "Document rate limits and quotas", "standards": [ "RFC 9110" ], "checks": [ "rate-limits-declared" ] }, { "name": "licensing", "title": "Declare reuse and licensing terms", "standards": [ "TDM Reservation Protocol" ], "checks": [ "licensing-terms" ] }, { "name": "provenance", "title": "Declare author, publication and update dates", "standards": [ "schema.org/author", "C2PA" ], "checks": [ "provenance-declared" ] }, { "name": "booking-action", "title": "Declare a bookable action", "standards": [ "schema.org/ReserveAction" ], "checks": [ "booking-action" ] }, { "name": "document-formats", "title": "Publish documents in machine-readable formats", "standards": [ "PDF/UA" ], "checks": [ "document-formats" ] } ], "checks": [ { "id": "reachable", "category": "discoverability", "tier": "essential", "weight": 3, "impact": "critical", "maturity": "adopted", "conditional": false, "label": "Homepage open to agent access", "why": "If an agent cannot read your site, every other check is moot. Cloudflare began blocking AI crawlers by default in 2025, with signed agents routed separately.", "skill": "agent-access", "skillTitle": "Open agent access (clear the 403/429 block)", "standards": [], "profile": false, "applicability": { "scope": "universal" }, "paths": [], "sources": [ "$home" ], "measures": "The scanner sends one GET to https:/// - the homepage is the only source for this check - using a non-browser agent user agent, and records the status code, Content-Type and body size. Pass = a 2xx HTML response with a real body. Partial = a 2xx response that is not HTML, a body smaller than roughly 1 KB or with almost no visible text, or a redirect chain that leaves the host before reaching content. Not measured = 401, 402, 403, 406, 429 or 503, no response, a JavaScript-only shell, or a scan cut at the whole-scan deadline: the whole scan is then reported as not measured, with no score. A refusal is a fact about the scanner's vantage point, not about the site. Fail = any other non-2xx status, such as 404, 451 or another 5xx.", "verify": "DOMAIN=example.com\ncurl -sS -o /dev/null -w 'status=%{http_code} type=%{content_type} bytes=%{size_download} redirect=%{redirect_url}\\n' -A 'AgenticWebScore/0.3 (+https://agenticwebscore.com/bot)' \"https://$DOMAIN/\"", "fix": "# nginx: clear the 403/429 that agent user agents hit on the homepage.\n# $bot_block and the rate limit come from your existing config; the allow-list\n# below is evaluated first so agents are never sent down the block path.\nmap $http_user_agent $agent_allow {\n default 0;\n \"~*(GPTBot|OAI-SearchBot|ChatGPT-User|ClaudeBot|PerplexityBot)\" 1;\n \"~*(Google-Extended|Applebot-Extended|CCBot|Amazonbot)\" 1;\n}\n\nserver {\n listen 443 ssl;\n server_name example.com;\n\n location = / {\n if ($agent_allow) { set $bot_block 0; }\n if ($bot_block) { return 403; }\n try_files /index.html =404;\n }\n}", "fixLang": "text", "fixNote": "If a CDN or WAF sits in front of nginx - for example Cloudflare's default AI-crawler block - the allow decision must be made there too, because nginx never sees a request the edge rejects." }, { "id": "robots-txt", "category": "discoverability", "tier": "essential", "weight": 2, "impact": "high", "maturity": "adopted", "conditional": false, "label": "robots.txt with agent directives", "why": "The front door for agent traffic (RFC 9309).", "skill": "robots-txt", "skillTitle": "Publish a valid robots.txt", "standards": [ "RFC 9309" ], "profile": false, "applicability": { "scope": "universal" }, "paths": [], "sources": [ "$robots" ], "measures": "The scanner fetches https:///robots.txt ($robots in the probe map) and parses it per RFC 9309, where a group is a User-agent line followed by its Allow/Disallow rules. Pass = HTTP 200 with a parseable file that names at least one agent crawler as its own group and declares a Sitemap. Partial = the file parses but contains only a blanket User-agent: * group, or places rules before any User-agent line. Fail = 404 or 5xx, a non-text response, or HTML returned for the path by a catch-all route.", "verify": "DOMAIN=example.com\ncurl -sSi \"https://$DOMAIN/robots.txt\" | sed -n '1,40p'", "fix": "# https://example.com/robots.txt\n# RFC 9309: a group is a User-agent line followed by its rules.\n\nUser-agent: *\nAllow: /\nDisallow: /admin/\nDisallow: /cart/\nDisallow: /search?\n\n# Name the agent crawlers you welcome, so agent traffic is routed deliberately.\nUser-agent: GPTBot\nAllow: /\n\nUser-agent: OAI-SearchBot\nAllow: /\n\nUser-agent: ClaudeBot\nAllow: /\n\nUser-agent: PerplexityBot\nAllow: /\n\nSitemap: https://example.com/sitemap.xml", "fixLang": "text", "fixNote": "Rules must follow their own User-agent line - a Disallow placed before any User-agent is ignored - and robots.txt is only read at the root of the host, never at a subpath." }, { "id": "sitemap-xml", "category": "discoverability", "tier": "essential", "weight": 2, "impact": "high", "maturity": "adopted", "conditional": false, "label": "sitemap.xml valid and current", "why": "The primary URL discovery source for agent crawlers.", "skill": "sitemap", "skillTitle": "Publish a sitemap with lastmod", "standards": [], "profile": false, "applicability": { "scope": "universal" }, "paths": [], "sources": [ "$sitemap" ], "measures": "The scanner fetches https:///sitemap.xml ($sitemap in the probe map) and parses it as XML. Pass = a urlset (or a sitemapindex) whose entries carry absolute loc URLs and a lastmod timestamp. Partial = valid XML with loc entries but no lastmod anywhere, or a sitemapindex that only points at child sitemaps. Fail = 404, an HTML page returned with a 200 by a catch-all route, or XML that does not parse.", "verify": "DOMAIN=example.com\ncurl -sS \"https://$DOMAIN/sitemap.xml\" | grep -E '|' | head -20", "fix": "\n\n \n https://example.com/\n 2026-10-08\n weekly\n 1.0\n \n \n https://example.com/docs/quickstart\n 2026-10-08\n monthly\n 0.8\n \n \n https://example.com/pricing\n 2026-09-30\n monthly\n 0.6\n \n", "fixLang": "xml", "fixNote": "lastmod must be a real modification date in W3C datetime form and must actually change when the page changes, otherwise the whole file reads as stale." }, { "id": "llms-txt", "category": "discoverability", "tier": "essential", "weight": 3, "impact": "critical", "maturity": "draft", "conditional": false, "label": "/llms.txt published and well-structured", "why": "The most widely adopted contract for making a site legible to agents. In the curated corpus we measured, 46% of sites published one and the average quality score was 37 out of 100 — adoption is not the same as usefulness.", "skill": "llms-txt", "skillTitle": "Publish llms.txt", "standards": [ "llmstxt.org" ], "profile": false, "applicability": { "scope": "universal" }, "paths": [ "/llms.txt" ], "sources": [], "measures": "The scanner fetches https:///llms.txt (the exact path this check probes) and parses the markdown against the llmstxt.org contract. It then requests up to 6 same-origin links the file names, beyond the paths the scan already requests. A link on another origin is not requested, and a link that gets no answer is not measured. Pass = a 2xx response served as text/plain or text/markdown, opening with an H1, followed by a blockquote summary and at least one H2 section listing markdown links written as [name](url). No requested same-origin link may answer a status other than 2xx, and the pass states how many links were requested. Partial = the file is served with another content type, has no H1, has an H1 after other lines, has no H2 link list, has no blockquote, or names a requested same-origin link that answered a status other than 2xx. Fail = a non-2xx status for the file, or an HTML document returned for the path. A request for the file that gets no answer is not measured.", "verify": "DOMAIN=example.com\ncurl -sS \"https://$DOMAIN/llms.txt\" | head -25", "fix": "# Example Inc\n\n> Example Inc runs a payments API for marketplaces. This file lists the pages an agent needs, with a short note on each.\n\nExample Inc is US-based; support is at support@example.com.\nAPI access uses OAuth 2.0 tokens, see the authentication guide below.\n\n## Docs\n\n- [Quickstart](https://example.com/docs/quickstart.md): Install the CLI and make a first API call\n- [API reference](https://example.com/docs/api.md): Every endpoint, with request and response examples\n- [Authentication](https://example.com/docs/auth.md): OAuth 2.0 flows and token lifetimes\n\n## Company\n\n- [Pricing](https://example.com/pricing.md): Plans, limits and overage rates\n- [Status](https://example.com/status): Live service status and incident history\n\n## Optional\n\n- [Changelog](https://example.com/changelog.md): Release notes since 2024", "fixLang": "markdown", "fixNote": "The links should point at markdown versions of the pages, and the file must be served raw - an SPA catch-all that returns index.html for this path scores as a fail." }, { "id": "link-headers", "category": "discoverability", "tier": "emerging", "weight": 2, "impact": "medium", "maturity": "adopted", "conditional": false, "label": "Discovery via Link response headers", "why": "RFC 8288 Link headers let an agent find your discovery resources without parsing HTML.", "skill": "link-headers", "skillTitle": "Advertise discovery through Link headers", "standards": [ "RFC 8288" ], "profile": false, "applicability": { "scope": "universal" }, "paths": [], "sources": [ "$home" ], "measures": "The scanner reads the Link response headers on https:/// ($home in the probe map) and parses them per RFC 8288: an angle-bracketed URI-reference followed by semicolon-separated parameters. Pass = at least one Link header that advertises a discovery resource with a registered relation, such as rel=describedby pointing at /llms.txt or rel=alternate with type=text/markdown. Partial = a Link header is present but carries no discovery relation (only preload or preconnect, for example). Fail = the homepage response carries no Link header at all.", "verify": "DOMAIN=example.com\ncurl -sS -D - -o /dev/null \"https://$DOMAIN/\" | grep -i '^link:'", "fix": "Link: ; rel=\"describedby\"; type=\"text/plain\", ; rel=\"alternate\"; type=\"application/xml\", ; rel=\"alternate\"; type=\"text/markdown\"\n\n# nginx equivalent\nadd_header Link '; rel=\"describedby\"; type=\"text/plain\", ; rel=\"alternate\"; type=\"application/xml\"' always;", "fixLang": "text", "fixNote": "Multiple links belong in one comma-separated Link header; relative targets are legal under RFC 8288 because they resolve against the request URI, but absolute URLs are safer for agents that do not track context." }, { "id": "dns-aid", "category": "discoverability", "tier": "emerging", "weight": 2, "impact": "medium", "maturity": "experimental", "conditional": false, "label": "DNS-AID discovery record", "why": "Lets agents read discovery information over DNS without an HTTP round trip. Cloudflare added it to its readiness checklist.", "skill": "dns-aid", "skillTitle": "Publish a DNS-AID discovery record", "standards": [], "profile": false, "applicability": { "scope": "universal" }, "paths": [], "sources": [], "measures": "The scanner queries DNS-AID records over DNS: SVCB records (RR type 64) at the organization entry point _index._agents., as defined by DNS-AID (draft-mozleywilliams-dnsop-dnsaid), and at _agent., the older single-record form. It does not query the agent names an index advertises. Pass = at least one SVCB record resolves with a TargetName and at least one SvcParamKey such as well-known, alpn, port or cap. Partial = only the TXT fallback form is published, or a record exists but carries no SvcParamKeys. Fail = NXDOMAIN, or no SVCB and no TXT record at those names. Not measured = the DNS-over-HTTPS resolver answers none of the DNS-AID questions.", "verify": "DOMAIN=example.com\ndig +short TYPE64 _index._agents.$DOMAIN; dig +short TYPE64 assistant.$DOMAIN", "fix": "; DNS-AID records for example.com (draft-mozleywilliams-dnsop-dnsaid)\n\n; Organization index entry point: the agents this domain advertises.\n_index._agents.example.com. 3600 IN SVCB 1 agent-index.example.com (\n alpn=\"h2\"\n port=443\n well-known=agent-card.json\n)\n\n; One SVCB record per advertised agent.\nassistant.example.com. 3600 IN SVCB 1 . (\n alpn=\"mcp,h2\"\n port=443\n ipv4hint=192.0.2.1\n ipv6hint=2001:db8::1\n well-known=agent-card.json\n cap=https://example.com/.well-known/agent-card.json\n)", "fixLang": "text", "fixNote": "TYPE64 is the SVCB record type by number, which also answers on older dig builds where the SVCB mnemonic silently returns nothing; publish on the authoritative nameservers for the apex domain, not on www." }, { "id": "canonical", "category": "discoverability", "tier": "recommended", "weight": 2, "impact": "medium", "maturity": "adopted", "conditional": false, "label": "Canonical and hreflang discipline", "why": "An agent needs one consistent URL per important page.", "skill": "canonical", "skillTitle": "Establish canonical and hreflang discipline", "standards": [], "profile": false, "applicability": { "scope": "universal" }, "paths": [], "sources": [ "$home" ], "measures": "The scanner extracts the link rel=canonical element and every link rel=alternate hreflang element from https:/// ($home in the probe map). Pass = exactly one absolute, self-referential canonical on https with no tracking parameters, plus, when translations exist, reciprocal hreflang alternates that include an x-default. Partial = a canonical that is relative to another host or points at a different URL, or hreflang values that no other language version links back to. Fail = no canonical element on the page.", "verify": "DOMAIN=example.com\ncurl -sS \"https://$DOMAIN/\" | grep -Eio ']+rel=\"(canonical|alternate)\"[^>]*>'", "fix": "\n\n\n", "fixLang": "html", "fixNote": "The canonical must be absolute and must repeat the exact URL an agent reached; hreflang only works when every language version lists all the others, including itself." }, { "id": "llms-full", "category": "discoverability", "tier": "recommended", "weight": 1, "impact": "low", "maturity": "draft", "conditional": false, "label": "/llms-full.txt expanded context", "why": "Lets an agent take in the full context in a single request instead of walking the site step by step.", "skill": "llms-full-txt", "skillTitle": "Publish llms-full.txt", "standards": [], "profile": false, "applicability": { "scope": "universal" }, "paths": [ "/llms-full.txt", "/llms.txt" ], "sources": [], "measures": "The scanner requests https:///llms-full.txt and also reads /llms.txt to see whether that file is advertised. Pass = /llms-full.txt returns 200 markdown containing the expanded text of the site's key pages, and /llms.txt links to it. Partial = the URL is linked from /llms.txt but 404s, or the file returns only a list of links instead of page text. Fail = neither file offers expanded context, or both paths return HTML.", "verify": "DOMAIN=example.com\ncurl -sS -o /dev/null -w 'llms-full.txt status=%{http_code} bytes=%{size_download}\\n' \"https://$DOMAIN/llms-full.txt\"; curl -sS \"https://$DOMAIN/llms.txt\" | grep -i 'llms-full'", "fix": "# llms.txt - add this line to the Docs section\n- [Full context](https://example.com/llms-full.txt): Every page below as one document\n\n# llms-full.txt\n# Example Inc - full context\n\n> Complete text of the pages an agent needs, in a single request. Regenerated on every deploy.\n\n## https://example.com/ (Home)\n\nExample Inc runs a payments API for marketplaces. Founded 2019, 40 staff, US-based. Production traffic is served from three regions.\n\n## https://example.com/docs/quickstart (Quickstart)\n\nInstall the CLI with `npm i -g example-cli`, authenticate with `example login`, then create a charge with `example charges create --amount 1000 --currency usd`.\n\n## https://example.com/pricing (Pricing)\n\nStarter is $0 for 1,000 calls per month. Growth is $99 for 100,000 calls, then $0.001 per call. Enterprise is quoted annually.", "fixLang": "markdown", "fixNote": "This file is the whole site minus navigation, so cap it at a few hundred KB and generate it from the same source as your pages or it will drift out of date." }, { "id": "agents-md", "category": "discoverability", "tier": "recommended", "weight": 2, "impact": "high", "maturity": "draft", "conditional": false, "label": "AGENTS.md with the required sections", "why": "The instruction file for coding and operations agents. It fails more often than any other check in the curated corpus we measured, and the usual reason is not a missing file but a file without the sections an agent needs.", "skill": "agents-md", "skillTitle": "Publish AGENTS.md", "standards": [], "profile": false, "applicability": { "scope": "universal" }, "paths": [ "/AGENTS.md" ], "sources": [], "measures": "The scanner fetches https:///AGENTS.md (the path this check probes) and reads it as markdown. Pass = 200 served as text/markdown or text/plain, with an H1 and the sections an agent needs to act: what the project or service is, setup or build commands, how to run tests, code or API conventions, and security or contact rules. Partial = the file is served but omits one or more of those sections, or is returned as text/html. Fail = 404 or an HTML page for the path.", "verify": "DOMAIN=example.com\ncurl -sS \"https://$DOMAIN/AGENTS.md\" | head -30", "fix": "# AGENTS.md\n\n## Project overview\n\nExample Inc is a payments API for marketplaces. Public docs: https://example.com/docs\n\n## Setup and build\n\n- Install dependencies: `pnpm install`\n- Dev server: `pnpm dev` (http://localhost:3000)\n- Production build: `pnpm build`\n\n## Testing\n\n- Tests: `pnpm test`; lint and types: `pnpm lint && pnpm typecheck`\n\n## Conventions\n\n- TypeScript strict mode; no `any` in exported signatures.\n- Public API routes live in `src/routes/api/` and must be documented in the OpenAPI file.\n\n## Security and contact\n\n- Never commit secrets; use `.env.local`.\n- Report vulnerabilities to security@example.com.", "fixLang": "markdown", "fixNote": "AGENTS.md is plain markdown with no mandated fields, so the headings above are the sections this audit looks for - and in a monorepo the file nearest the edited code wins." }, { "id": "sitemap-md", "category": "discoverability", "tier": "emerging", "weight": 1, "impact": "low", "maturity": "draft", "conditional": false, "label": "/sitemap.md markdown site map", "why": "Lets an agent read your site structure as markdown in a single file. Adoption is still very low, so this is an early-mover advantage.", "skill": "sitemap-md", "skillTitle": "Publish a markdown sitemap", "standards": [], "profile": false, "applicability": { "scope": "universal" }, "paths": [ "/sitemap.md" ], "sources": [], "measures": "The scanner fetches https:///sitemap.md (the exact path this check probes) and parses it as markdown. Pass = 200 markdown whose body is an H1 plus markdown links to the site's key pages written as absolute URLs. Partial = markdown is served but the links are relative, are not a list, or cover only a couple of top-level pages. Fail = 404, or an HTML document returned for the path.", "verify": "DOMAIN=example.com\ncurl -sS \"https://$DOMAIN/sitemap.md\" | head -30", "fix": "# Sitemap\n\n- [Home](https://example.com/): What Example Inc does and who it is for\n- [Quickstart](https://example.com/docs/quickstart): First API call in five minutes\n- [API reference](https://example.com/docs/api): Every endpoint and response field\n- [Authentication](https://example.com/docs/auth): OAuth 2.0 flows and token lifetimes\n- [Pricing](https://example.com/pricing): Plans, limits and overage rates\n- [Status](https://example.com/status): Live service status and incident history\n- [Contact](https://example.com/contact): Sales and support routes", "fixLang": "markdown", "fixNote": "Keep it to the pages an agent should actually read and regenerate it whenever sitemap.xml changes, since the two drifting apart is the usual failure." }, { "id": "markdown-negotiation", "category": "content", "tier": "recommended", "weight": 3, "impact": "critical", "maturity": "adopted", "conditional": false, "label": "Markdown content negotiation", "why": "Agents can request a markup-free version with \"Accept: text/markdown\", which cuts token cost.", "skill": "markdown-negotiation", "skillTitle": "Serve markdown on Accept: text/markdown", "standards": [ "RFC 9110" ], "profile": false, "applicability": { "scope": "universal" }, "paths": [], "sources": [ "$home" ], "measures": "The scanner re-requests the homepage `/` with `Accept: text/markdown` and inspects the response headers and body. Pass when the response carries `Content-Type: text/markdown`, the body is markdown rather than HTML (no ``, no `
` scaffolding) and it is materially shorter than the HTML page; partial when markdown is returned under another type such as `text/plain`, or when the response omits `Vary: Accept` so a shared cache can serve the markdown body to a browser; fail when the request still returns `text/html`. RFC 9110 proactive negotiation, one URL with two representations.", "verify": "DOMAIN=\"https://example.com\"\ncurl -sSL -D /tmp/md.h -o /tmp/md.body -H 'Accept: text/markdown' \"$DOMAIN/\"; grep -iE '^(HTTP/|content-type|vary)' /tmp/md.h; head -3 /tmp/md.body", "fix": "// server.js — serve a prebuilt markdown twin on Accept: text/markdown (RFC 9110).\nimport express from 'express';\nimport { readFile } from 'node:fs/promises';\n\nconst app = express();\n\napp.use(async (req, res, next) => {\n if (req.method !== 'GET') return next();\n res.vary('Accept'); // both representations share one URL, so caches must key on Accept\n if (req.accepts(['text/html', 'text/markdown']) !== 'text/markdown') return next();\n const file = `./public${req.path.replace(/\\/$/, '/index')}.md`;\n try {\n res.type('text/markdown').send(await readFile(file, 'utf8'));\n } catch {\n next(); // no markdown twin for this path: fall back to the HTML document\n }\n});\n\napp.use(express.static('public'));\napp.listen(3000);", "fixLang": "javascript", "fixNote": "Generate the `.md` twin at build time — converting HTML to markdown on every request is slower and lossy — and keep `Vary: Accept` on the HTML response too." }, { "id": "headings", "category": "content", "tier": "essential", "weight": 2, "impact": "high", "maturity": "adopted", "conditional": false, "label": "Semantic heading structure", "why": "A single H1 and a consistent H2 structure let the content be split correctly.", "skill": "semantic-headings", "skillTitle": "Build a semantic heading structure", "standards": [ "WCAG 2.2" ], "profile": false, "applicability": { "scope": "universal" }, "paths": [], "sources": [ "$home" ], "measures": "The scanner parses the headings in the homepage `/` HTML and rebuilds the outline. Pass when the page has exactly one `

` and no heading is more than one level deeper than the one before it (an `

` may be followed by `

`, never by `

`); partial when there is exactly one `

` but the outline skips a level, or when the page repeats `

` while the rest of the outline is well formed; fail when the page has no `

` at all. This is the WCAG 2.2 heading structure (1.3.1 Info and Relationships, 2.4.6 Headings and Labels).", "verify": "DOMAIN=\"https://example.com\"\ncurl -sL \"$DOMAIN/\" | perl -0777 -ne 'while (m{<(h[1-6])\\b[^>]*>(.*?)}gsi) { my ($l,$t)=(lc($1),$2); $t=~s/<[^>]*>//g; $t=~s/\\s+/ /g; print \"$l \",substr($t,0,60),\"\\n\" }'", "fix": "
\n

Agent readiness for e-commerce teams

\n

A 5-dimension audit of how well your store serves autonomous AI agents.

\n\n
\n

What we measure

\n

Discovery, content, bot access, protocol and commerce signals.

\n\n
\n

Structured data

\n

Entity types an agent can quote without having to guess.

\n
\n
\n\n
\n

How the score works

\n

61 weighted checks, graded from C to AAA.

\n
\n
", "fixLang": "html", "fixNote": "Never pick a heading tag for its font size: if a block has no heading, style a `

` instead and keep `

` for the page title only." }, { "id": "meta", "category": "content", "tier": "essential", "weight": 2, "impact": "high", "maturity": "adopted", "conditional": false, "label": "Title and summary metadata", "why": "This is how an agent learns what a page is about without opening it.", "skill": "page-metadata", "skillTitle": "Add a title and meta description", "standards": [], "profile": false, "applicability": { "scope": "universal" }, "paths": [], "sources": [ "$home" ], "measures": "The scanner reads the `` text and the `content` of `<meta name=\"description\">` in the homepage `/` HTML and measures their length. Pass when the title is 50-60 characters and the description 120-160 characters, both non-empty; partial when both are present but one or both fall outside that window (too short to be informative, or long enough to be truncated), or when only one of the two exists; fail when the page has neither a title nor a description.", "verify": "DOMAIN=\"https://example.com\"\ncurl -sL \"$DOMAIN/\" | perl -0777 -ne 'm{<title[^>]*>(.*?)}si and do { my $t=$1; $t=~s/\\s+/ /g; print \"title(\", length($t), \"): $t\\n\" }; m{]*\\bname=[\"\\x27]?description[\"\\x27]?[^>]*>}i and print \"description: \", $&, \"\\n\"'", "fix": "\n \n Agent readiness audit for e-commerce teams | Acme Inc\n \n", "fixLang": "html", "fixNote": "Write a distinct description per page: one templated string reused across 500 URLs tells an agent nothing about which page it is reading." }, { "id": "jsonld", "category": "content", "tier": "essential", "weight": 3, "impact": "critical", "maturity": "adopted", "conditional": false, "label": "JSON-LD structured data", "why": "The entity type becomes unambiguous to a machine. Without authoritative data, an agent answers from whatever it can scrape.", "skill": "structured-data", "skillTitle": "Add JSON-LD structured data", "standards": [ "schema.org" ], "profile": false, "applicability": { "scope": "universal" }, "paths": [], "sources": [ "$home" ], "measures": "The scanner extracts every `}gsi) { print \"$1\\n\" }' | jq -r '[(.\"@context\"? // empty | tostring)] + [.. | objects | select(has(\"@type\")) | .\"@type\" | tostring] | unique | @tsv'", "fix": "", "fixLang": "html", "fixNote": "One valid block beats five broken ones: JSON-LD is parsed, not scraped, so a single trailing comma makes the whole entity invisible." }, { "id": "faq-schema", "category": "content", "tier": "recommended", "weight": 2, "impact": "high", "maturity": "draft", "conditional": false, "label": "FAQ / question-answer schema", "why": "Question-and-answer content is the type agents quote most.", "skill": "faq-schema", "skillTitle": "Add FAQ schema", "standards": [ "schema.org/FAQPage" ], "profile": false, "applicability": { "scope": "universal" }, "paths": [], "sources": [], "measures": "This check declares no probe path, so the scanner works from the JSON-LD of the already fetched homepage `/` and looks for a `FAQPage` entity anywhere in the graph. Pass when `FAQPage` is present and `mainEntity` is a non-empty array of objects typed `Question` that each carry a `name` and an `acceptedAnswer` typed `Answer` with non-empty `text`; partial when `FAQPage` exists but `mainEntity` is empty, when an entry is not typed `Question`, or when a question lacks a typed, non-empty `acceptedAnswer`; fail when no `FAQPage` type appears.", "verify": "DOMAIN=\"https://example.com\"\ncurl -sL \"$DOMAIN/\" | perl -0777 -ne 'while (m{]*application/ld\\+json[^>]*>(.*?)}gsi) { print \"$1\\n\" }' | jq -r '.. | objects | select((.\"@type\"? | if type == \"array\" then .[] else . end) == \"FAQPage\") | .mainEntity[] | [.name, (.acceptedAnswer.text // \"NO ANSWER\")] | @tsv'", "fix": "", "fixLang": "html", "fixNote": "The same questions must be visible as text on the page — structured data that does not match rendered content is treated as spam." }, { "id": "breadcrumb", "category": "content", "tier": "emerging", "weight": 1, "impact": "low", "maturity": "draft", "conditional": false, "label": "Breadcrumb / navigation schema", "why": "Helps an agent make sense of where a page sits in your site.", "skill": "breadcrumb-schema", "skillTitle": "Add breadcrumb schema", "standards": [ "schema.org/BreadcrumbList" ], "profile": false, "applicability": { "scope": "universal" }, "paths": [], "sources": [], "measures": "This check declares no probe path, so the scanner walks the JSON-LD of the fetched homepage `/` for a `BreadcrumbList` and inspects `itemListElement`. Pass when the list has at least two entries typed `ListItem` whose `position` values start at 1 and increase by one, each with a `name` and an `item` that is a resolvable URL (an absolute http(s) URL or a host-relative path — a bare string such as `garbage` is not an item URL). The last entry may omit `item` entirely, as Google's breadcrumb guidance allows, because it stands for the current page. Partial when `BreadcrumbList` is present but an entry is not typed `ListItem`, a position is missing or out of order, an entry before the last has no resolvable `item` URL, or any entry carries an `item` that is not one; fail when no `BreadcrumbList` appears.", "verify": "DOMAIN=\"https://example.com\"\ncurl -sL \"$DOMAIN/\" | perl -0777 -ne 'while (m{]*application/ld\\+json[^>]*>(.*?)}gsi) { print \"$1\\n\" }' | jq -r '.. | objects | select((.\"@type\"? | if type == \"array\" then .[] else . end) == \"BreadcrumbList\") | .itemListElement[] | [(.position|tostring), .name, ((.item.\"@id\" // .item) // \"NO URL\")] | @tsv'", "fix": "", "fixLang": "html", "fixNote": "Mirror the same trail as visible links in a `