The full checklist
67 checks.
Zero mystery.
This is the complete free diagnostic. Every check below appears in the result with its outcome and evidence or a clear reason it could not be assessed. Paid plans add deeper sampling, exact page-level findings, and a fix roadmap, not more checks.
Assessment uses bounded, public, read-only observation. A few checks are reserved and remain not assessed; the scanner never logs in, touches carts, or probes protected actions. Agent Card checks are not assessed for sites without an agent.
Checks are weighted by site type — a storefront, a SaaS site, an API, and a brochure site are scored on what actually matters for each.
The core diagnostic
48 readiness checks
Discoverability · 8 checks
Can agents find your site and its key pages in the first place?
A secure, working front door
Looks at: whether your main address loads securely without redirect loops. Why it matters: an agent stuck at a broken or insecure redirect never reaches your business information.
Crawler rules on file
Looks at: your robots.txt policy as our documented scanner identity sees it. Why it matters: unclear crawler rules make agents skip useful pages or fetch them inconsistently.
Sitemap health
Looks at: whether a sitemap exists, parses, and lists representative usable pages. Why it matters: a broken or thin sitemap means agents miss pages — and the products on them.
Key pages are reachable
Looks at: whether representative offering, content, documentation, or product pages are reachable through stable links. Why it matters: if an agent can't follow the path a person would take, it can't find what you sell.
Same story, every visit
Looks at: whether core facts survive both simple and fuller ways of reading a page. Why it matters: if your business name, offer, or main action change depending on how the page is read, agents report the wrong version.
Clear bot policies
Looks at: whether policies for search, AI training, and user-directed agents are distinguished from each other. Why it matters: muddled policies get agents blocked — or allowed — in ways you didn't intend.
Your agent's business card
Looks at: whether your site publishes an A2A Agent Card at /.well-known/agent-card.json so other agents can discover your agent. Why it matters: without a discoverable Agent Card, other agents can't find or delegate work to your agent. Sites with no agent show this as "not assessed" — never a failure.
Your agent guide is discoverable and usable
Looks at the captured canonical agents.md shape and actually captured required links. Experimental and non-scoring; absence is not assessed and incomplete retrieval is inconclusive.
Comprehension · 9 checks
Can agents understand what you offer, or will they guess?
Who are you?
Looks at: whether your business identity, purpose, contact or support path, and location are explicit and consistent. Why it matters: an agent that can't identify your business can't recommend it — or get help when stuck.
What do you offer, and to whom?
Looks at: whether representative pages state the offer, the audience, material constraints, and the next step in plain text. Why it matters: vague offers get skipped; the agent simply moves on to a competitor it understands.
The facts that decide
Looks at: whether price, currency, availability, eligibility, limits, policies, and timing are unambiguous. Why it matters: fuzzy facts get misquoted to your potential customers.
Pages that make sense
Looks at: whether titles, headings, lists, tables, links, and image descriptions preserve meaning. Why it matters: sloppy structure loses relationships — like which price belongs to which product.
Honest structured data
Looks at: whether your structured data is valid and free of unsupported claims. Why it matters: agents lean on this data heavily; wrong data means wrong answers about your business.
One story everywhere
Looks at: whether visible text, structured data, feeds, and policies agree on material facts. Why it matters: contradictions — different prices in different places — make agents distrust or misreport your site.
Fresh, not stale
Looks at: whether time-sensitive facts carry update signals, and old content isn't dressed up as current. Why it matters: an agent quoting last year's prices or hours embarrasses you in front of customers.
Agent Card that parses
Looks at: whether your Agent Card is valid JSON with the required fields and a non-empty skill list. Why it matters: a malformed card is worse than none — agents that find it can't understand what your agent does.
Agent Card endpoints that respond
Looks at: whether the listed interface URLs use HTTPS and answer a bounded read-only HEAD request when safely reachable. Why it matters: a missing public endpoint can prevent discovery. The scan does not invoke an agent method or prove live delegation.
Interaction · 7 checks
Can agents actually use your site's controls?
Buttons that say what they do
Looks at: whether critical controls expose clear names, roles, and states. Why it matters: a button an agent can't understand is a button it won't press.
Forms that explain themselves
Looks at: whether fields have labels, sensible types, and clear submit controls. Why it matters: unlabeled fields lead to incomplete or invalid submissions.
It tells you what's happening
Looks at: whether loading, validation, availability, errors, and recovery states are visible. Why it matters: an agent that can't tell "loading" from "broken" gives up — or reports failure.
Links with a destination
Looks at: whether important links and controls expose where they lead. Why it matters: mystery links are dead ends for agents.
No ambush popups
Looks at: whether overlays, gates, challenges, or login walls make the public task impossible. Why it matters: a popup you'd dismiss in half a second can be a brick wall for an agent.
Search and filters that work
Looks at: whether search, filtering, and selection expose enough state. Why it matters: if an agent can't narrow options or see what's selected, it can't find the right product.
Knows when to ask a human
Looks at: whether confirmation, handoff, and support points are signaled before consequential actions. Why it matters: agents should know where the safe zone ends and a human needs to step in.
Protocols · 12 checks
The optional machine-readable extras — checked only where they exist.
llms.txt, if you have one
Looks at: whether the file is accurate, canonical, and links to live content. Why it matters: a stale pointer file sends agents to dead ends. Experimental.
A lighter-weight version
Looks at: whether a documented plain-text or Markdown version preserves the key facts with less parsing. Why it matters: some agents work better with a simple text version of your key pages. Experimental.
Machine surfaces are findable
Looks at: whether public feeds, APIs, or catalogs can be discovered. Why it matters: if you built a machine-friendly door, agents should be able to find it.
Machine surfaces are usable
Looks at: whether those feeds or APIs are parseable, scoped, and documented. Why it matters: a machine interface nobody can understand is decoration.
MCP presence
Looks at: whether a public MCP surface is discoverable with clear version behavior. Why it matters: lets MCP-compatible agents know you speak their protocol. Mostly relevant for API-style sites.
MCP auth clarity
Looks at: whether public authorization metadata is coherent without logging in. Why it matters: agents can see how auth works before attempting anything protected.
Agent Card
Looks at: whether an advertised agent has a valid card with identity, interfaces, and skills. Why it matters: other agents need to know who your agent is and what it can do.
A2A live behavior · reserved
Looks at: registry identity only in this release. Why it matters: live agent-to-agent behavior is only assessed with the owner's explicit authorization.
Shopping profile discovery
Looks at: whether a public commerce profile is coherent and versioned. Why it matters: helps shopping agents discover your commerce services. E-commerce sites.
Catalog completeness
Looks at: whether product, variant, price, availability, media, seller, and policy fields are consistent. Why it matters: thin catalogs get your products misquoted. E-commerce sites.
Cart & checkout · reserved
Looks at: registry identity only in this release. Why it matters: we never touch carts — that's a promise, not a gap.
Your agent discovery document has a valid supported shape
Looks at complete /.well-known/agent.json JSON with name, description and safe HTTPS endpoint declarations. Endpoints are never invoked. Experimental and non-scoring.
Trust · 6 checks
Can agents trust what they find — and know who's accountable?
Everything traces back to you
Looks at: whether public machine surfaces, schemas, and links are secure and attributable. Why it matters: agents need to connect what they read to the business responsible for it.
Policies and a way to reach you
Looks at: whether privacy, terms, support, and commercial policies name the responsible business. Why it matters: no accountable business, no trust — for agents or customers.
Authorization boundaries · reserved
Looks at: registry identity only in this release. Why it matters: we don't poke at your locks; protected enforcement is out of scope for a public scan.
No secrets lying around
Looks at: whether public documents expose secrets, and whether consequential actions state their boundaries. Why it matters: a leaked key or an unclear boundary is a bad day for everyone.
Someone to call
Looks at: whether provider identity, escalation, and human handoff are attributable. Why it matters: when something goes wrong, everyone needs to know who can fix it.
The money fine print
Looks at: whether returns, shipping, taxes, renewals, and cancellation are findable and consistent. Why it matters: agents that can't find your return policy won't invent one — they'll just leave. E-commerce sites.
Tasks · 6 checks
Can an agent complete a safe, useful journey end to end?
Finds your main thing
Looks at: whether a primary offering is supported by navigation and page evidence. Why it matters: the most basic job — can an agent find what you're known for?
Pulls out the key facts
Looks at: whether at least three relevant facts are extracted, cited, and cross-checked. Why it matters: finding a page isn't enough; the agent has to get the details right.
Walks the safe path
Looks at: whether public navigation and selection work without any state-changing action. Why it matters: proves an agent can browse usefully without touching anything consequential.
Verified journey · reserved
Looks at: registry identity only in this release. Why it matters: deeper verification needs your explicit go-ahead.
Hands off cleanly
Looks at: whether there's a clear next step — human, support, signup, or checkout — with a visible destination. Why it matters: every agent journey should end with a safe, obvious "what next."
Authenticated tasks · reserved
Looks at: excluded in this release. Why it matters: we never log in as anyone — that's a hard boundary, not a missing feature.
Agent compatibility in the same result
19 compatibility checks
These checks cover the conventions that decide whether automated visitors are welcomed, tolerated, or turned away. Applicable scored checks contribute to the single profile-aware result; neutral and optional entries remain visible without moving the score.
Discoverability · 4 checks
The signposts that tell crawlers and agents where things are.
Robots policy
Looks at: whether /robots.txt returns a parseable policy. Why it matters: no readable policy, no predictable crawler behavior.
Sitemap discovery
Looks at: whether a valid canonical sitemap can be found. Why it matters: the canonical "here's everything" document for machines.
Agent-useful link relation
Looks at: whether the homepage declares a machine surface via link headers. Why it matters: a declared machine surface is an invitation; an undeclared one is a rumor.
DNS-based agent discovery
Looks at: whether an attributable agent service is advertised via DNS. Why it matters: an emerging standard for "yes, we have an agent service, and here's proof." Experimental.
Content · 1 check
A lighter way to read the essentials.
Markdown representation
Looks at: whether a clean text/Markdown version of key content exists. Why it matters: some agents parse plain text far better than designed pages.
Bot access · 3 checks
Explicit rules for AI crawlers — no guessing.
Recognized AI crawler policy
Looks at: whether there's an explicit policy for known AI crawler identities. Why it matters: "we never said" is how you end up training someone's model by accident.
Content-signal preferences
Looks at: whether search, AI-input, and AI-training preferences are stated explicitly. Why it matters: fine-grained control beats a single blunt allow/deny. Experimental.
Message signatures directory
Looks at: the emerging signatures directory — reported, never scored. Why it matters: we watch emerging standards so you don't have to; this one can't hurt your score.
API, auth & skills · 7 checks
The machine-readable handshakes.
API catalog
Looks at: whether a public, attributable API catalog exists. Why it matters: capable agents prefer a catalog over scraping.
OAuth discovery
Looks at: whether OAuth/OIDC discovery metadata is coherent. Why it matters: agents need to find the front door of your auth before they can knock.
Protected-resource metadata
Looks at: whether protected resources declare their authorization servers. Why it matters: "ask here for permission" should be public knowledge.
Auth guidance document
Looks at: whether public auth discovery, credential-use, and revocation guidance exists. Why it matters: documented auth is usable auth. Experimental.
MCP server card
Looks at: whether a public MCP server card is declared without needing initialization. Why it matters: MCP agents can size you up before saying hello. Draft standard.
Agent skills index
Looks at: whether discoverable, attributable agent skills are listed. Why it matters: a skills index is a menu of what your agent offerings can do. Experimental.
WebMCP registration
Looks at: whether inspectable tool metadata is exposed without calling tools. Why it matters: lets agents see available tools without invoking them. Experimental.
Commerce · 4 checks
Standard ways to declare how payments and commerce work — described, never exercised. E-commerce sites.
x402 declaration
Looks at: whether a parseable x402 commerce capability is declared in static metadata. Why it matters: declares machine-payable commerce without anyone paying anything. Experimental, optional.
Payment declaration
Looks at: whether a parseable payment capability is declared. Why it matters: same idea, alternate standard — declared, never transacted. Experimental, optional.
Commerce profile
Looks at: whether a released, coherent commerce profile is published. Why it matters: the standard "here's how our commerce works" document for shopping agents. Optional.
Agent commerce declaration
Looks at: whether a released agent-commerce version and schema are advertised. Why it matters: declares which agent-commerce standard you follow. Beta, optional.
Experimental, draft, and beta checks are labeled as such in your report — adopting an emerging standard early is noted, never punished. Reserved checks are named for transparency and never run without your explicit permission.
Now you know the questions
Get the answers for your site.
The free scan shows all 67 checks for your public website, including explicit not-assessed and inconclusive states — read-only, private results, no account required. Meet the scanner →