What the agent readiness checker tests
The checks are grouped by the question an agent has when it arrives at a site. Twelve of them count for every site. The rest count only when they apply to yours.
- Can agents find your pages? A valid
robots.txt, an XML sitemap listed in it,Linkheaders on the homepage that point to a machine-readable version or to an API catalog, and DNS-AID records: SVCB entries under_agents, in a zone signed with DNSSEC. - Can agents read them? Whether the homepage answers a request for
Accept: text/markdownwith Markdown, and whether a cache in front of the site hands agents the cached HTML instead. - Do you tell AI crawlers what they may do? Rules for AI crawlers in
robots.txt, by name or through the*group, and aContent-Signalline that says whether your content may be used for search, AI answers and training. Web Bot Auth keys, if you run a bot of your own. - Can agents discover what your site offers? An API catalog at
/.well-known/api-catalog, an MCP server card, an Agent Skills index, tools the page registers with WebMCP, and an AI catalog (ARD). An A2A agent card and a personal agent manifest are shown as optional. - Can agents sign in? OAuth or OpenID discovery, OAuth protected resource metadata and
auth.md. They count for every site, but they only matter if agents sign in to yours. - Can agents buy? x402, MPP, UCP, ACP and AP2. They are checked only when the homepage looks like a store, and they are never part of the score.
How the agent readiness score works
The score is the share of counted checks that pass, from 0 to 100. Fifteen checks always count: twelve that any public site can build and publish honestly, from a sitemap to an MCP server, and the three sign-in checks. In detail:
- Sign-in checks count even on a site without a login. Their rows say they only matter if agents sign in, and the next section explains why.
- Web Bot Auth adds to the score when the site publishes it, and is never held against a site that does not run its own bots. The A2A agent card is shown but not scored.
- The personal agent manifest and the commerce checks never count.
- A check that could not run is left out and flagged, so a timeout never reads as a failure.
| Score | What it says |
|---|---|
| 90 to 100 | Ready for agents |
| 60 to 89 | Mostly ready |
| 30 to 59 | Partly ready |
| 0 to 29 | Not ready yet |
Sign-in checks on a site without a login
OAuth metadata, protected resource metadata and auth.md tell an agent where to sign in. They count for every site, and a public site without a login fails them, because an agent cannot sign in there. That caps such a site at about 80, which still reads “Mostly ready”. Do not publish metadata for a login that does not exist just to pass: it sends agents to a dead end. Each of the three rows says it only matters if agents sign in, and the summary keeps them apart from the checks worth fixing.
The checks, one by one
| Check | What passes | Standard |
|---|---|---|
| robots.txt | /robots.txt answers 200 with a text file, not an HTML page, and has at least one User-agent group. | RFC 9309 |
| XML sitemap | A Sitemap: line in robots.txt that returns a sitemap or a sitemap index. Without one, /sitemap.xml and /sitemap_index.xml are tried. | sitemaps.org |
| Link headers | The homepage sends a Link header with alternate, api-catalog, service-desc, service-doc, service-meta or describedby. | RFC 8288 |
| DNS-AID records | An SVCB or HTTPS record in service mode under _index._agents, _a2a._agents or _mcp._agents, in an answer the resolver validated with DNSSEC. | IETF draft |
| Markdown for agents | A request for the homepage with Accept: text/markdown gets Content-Type: text/markdown. | Content negotiation |
| AI crawler rules | robots.txt has a group that names an AI crawler, or a * group that applies to them all. | RFC 9309 |
| Content-Signal | robots.txt has at least one Content-Signal line. | contentsignals.org |
| Web Bot Auth | A key directory at /.well-known/http-message-signatures-directory. Optional. | IETF draft |
| API catalog | /.well-known/api-catalog returns a linkset with at least one entry. | RFC 9727 |
| MCP server card | /.well-known/mcp/server-card.json, or one of two older addresses, names the server, its version and its endpoint. | MCP |
| Agent Skills index | /.well-known/agent-skills/index.json lists at least one skill. | agentskills.io |
| WebMCP tools | The homepage or its scripts register tools with document.modelContext.registerTool(), or a form declares WebMCP tool attributes. | W3C community draft |
| AI catalog (ARD) | /.well-known/ai-catalog.json has a specVersion and at least one valid entry: an identifier, a display name, a type, and exactly one of url or data. | ARD |
| A2A agent card | /.well-known/agent-card.json names the agent, its interface and its skills. Optional. | A2A |
| OAuth / OpenID discovery | /.well-known/oauth-authorization-server or /.well-known/openid-configuration returns metadata with an issuer. | RFC 8414 |
| OAuth protected resource | /.well-known/oauth-protected-resource names this site as the resource, and its authorization servers. | RFC 9728 |
| auth.md | /auth.md is Markdown with an auth.md heading, backed by valid protected resource metadata or saying itself where agents register. | auth.md |
What the agent readiness checker cannot see
- Tools registered by code it does not read. WebMCP tools are found by reading the homepage HTML, its inline scripts and the script files it loads from the same site or its subdomains, up to 48 files or 8 MB. The checker does not run JavaScript, so tools added only after a click or a sign-in, or in code past those limits, may not show.
- What your firewall does to real crawlers. The scan comes from a datacenter in the United States. If the homepage answers with a bot challenge, the result says so, because agents may be getting the same page. What a firewall does to a crawler’s own IP range is something no outside scanner can see.
- Anything beyond the homepage. Markdown, Link headers and WebMCP are checked on the homepage only.
- Whether AI assistants will cite you. Ready means agents can find the site, read it and see what it offers. Nobody controls which pages an AI assistant cites, and no score here predicts it.
How the scan is made
From this site’s server, with the user agent visibleorigin-check/0.3 and the rules on How I measure. A scan makes about 20 requests to the site, plus the script files its homepage loads (48 at most), most of them in parallel, and follows up to three redirects on each. DNS lookups go over HTTPS to Cloudflare’s public resolver, 1.1.1.1, or to Google’s, 8.8.8.8, if that one does not answer. Most scans take a few seconds.
Nothing is stored: not the domain and not the result. Your IP address only enters a counter, as a keyed hash that expires after ten minutes, to allow three scans every ten minutes. The Privacy Policy has the details.
Agent readiness checker: frequently asked questions
What is agent readiness?
How well an AI agent, working for someone, can use a site: find its pages, read them without guessing at the layout, tell what it may do with the content and discover what the site offers, such as an API, an MCP server or tools in the page. An agent ready website publishes all of that in standard places, so an agent does not have to guess. A crawler only collects pages; an agent tries to use the site. Answer engine optimization (AEO) is about being quoted in AI answers. Agent readiness is about being usable.
Is my website ready for AI agents?
Scan it above. A score of 90 or more means it passes nearly every check, sign-in included; a public site without a login tops out at about 80, which reads “Mostly ready”. Below 60, agents will have to guess at least some of what a few small files could tell them. The failed checks are listed with what is missing and how to fix it, so you can see what stands between your site and the next band.
How do I make my website ready for AI agents?
Start with what costs least: a valid robots.txt with a Content-Signal line, a sitemap listed in it, a Markdown version of each page served when an agent asks for text/markdown, and a Link header that points to it. Then add the discovery files that describe what you really have: an API catalog, an Agent Skills index, an AI catalog and, if you build one, an MCP server and its card. Run the checker after each change. Every failed check says what is missing and how to fix it.
What is an MCP server card?
A small JSON file, usually at /.well-known/mcp/server-card.json, that describes a site’s MCP server before an agent connects to it: its name, its version, its endpoint and transport, and what it offers. MCP, the Model Context Protocol, is how AI assistants call tools on other servers. The card lets an agent find the server at a known address instead of being told where it is.
Do I need an MCP server to score 100?
Yes. The MCP server card is one of the checks that always count, and a card only makes sense with a server behind it. A read-only server that answers questions about your public pages is enough. It is also the largest piece of work on the list, so do the cheaper fixes first. A full 100 also takes the three sign-in checks, which only make sense if agents sign in; without a login, about 80 is the top.
What is WebMCP?
A draft browser API from a W3C community group. A page calls document.modelContext.registerTool() to offer actions, such as search or a contact form, to an agent working inside the browser, so the agent does not have to guess from the HTML. It is a community draft, not a W3C standard.
What is DNS-AID?
DNS for AI Discovery, an IETF draft. A site publishes SVCB records under _agents in its DNS, such as _index._agents.example.com, so agents can find its endpoints before they load a page. The checker only passes records in a zone signed with DNSSEC, because an unsigned record can be forged on the way.
Does a high agent readiness score mean ChatGPT or Google will cite my site?
No. A high score means agents can find, read and use the site. Which pages an AI assistant cites is decided by each assistant, and nobody outside controls it.
Why is my score different on another agent readiness scanner?
It should rarely be. In tests on 30 sites in November 2026, the score here matched another public agent readiness scanner on 26 of the 27 sites both could scan. A difference usually comes from one of three things: a site that blocks one scanner and not the other, since each scans from its own network; a check that could not run, which is left out and flagged here and may count as a failure elsewhere; or WebMCP, which is read here from the page’s code without running it.
Further reading
- An agent readiness score gave my site Level 5 for failing its only check: what a readiness score can hide.
- Two ways to serve Markdown to agents, and how each one fails quietly.
- Passing the DNS-AID check with an SVCB record, and the two records I rejected.
- Who asks for .well-known files: six of them, measured in my server logs.
- robots.txt checker for AI crawlers: every line of the file, and any URL tested for 15 bots.
- AI visibility checker: which AI crawlers a site lets in for search, on-demand fetches and training.
- llms.txt checker and validator: a site’s llms.txt against the format published at llmstxt.org.
If you want the rest of your site read the same way, check by check, that is what the free check is for, and the crawler and AI readiness audit goes further.