Access
93/100100.0% coverage
API site · Static audit
Core checks passed at a high rate. Read the scope and limits below.
Pass starts at 80 / 100. This scan does not prove that an agent can complete a purchase. Method and limits
81/ 100
PASS
Readiness score
Scanned 2026-09-30 19:00:37 UTC
Start with these changes. Open a fix for the finding, example, and supporting evidence.
Link public API instructions and a valid OpenAPI document. Show request and response examples.
Suggested location: /docs
Finding: The API catalog is usable, but its media type or HEAD Link relation is incomplete.
Change: Serve Linkset JSON and include rel=api-catalog in the HEAD response.
Open this check and its evidenceFinding: No write operation declares an Idempotency-Key header.
Change: Add an Idempotency-Key header parameter to retryable POST, PUT, PATCH, and DELETE operations.
Open this check and its evidenceFinding: The server card has a complete identity and endpoint, but no complete tool preview list.
Change: Add tools with stable names and descriptions when the selected server-card schema supports previews.
Open this check and its evidenceFinding: Only some listed tools meet this requirement.
Change: Give each tool a typed object inputSchema and keep required names in properties.
Open this check and its evidenceFinding: The public MCP server does not advertise an MCP App resource.
Change: Link a ui:// resource from a tool with _meta.ui.resourceUri.
Open this check and its evidence{
"info": {
"title": "Example API",
"version": "1.0.0"
},
"openapi": "3.1.0",
"paths": {
"/status": {
"get": {
"responses": {
"200": {
"description": "Service status"
}
}
}
}
}
}
Adapt this example to the service. Apply every relevant change listed above, then confirm it with a new scan.
State whether access is public or needs credentials. Link the applicable authentication metadata.
# Authentication
Public report reads need no credentials.
Write requests require a bearer token.
Never put tokens in URLs.
Suggested location: /auth.md
Finding: The scan did not find authorization-server metadata at the fixed well-known path.
Change: Publish RFC 8414 metadata at /.well-known/oauth-authorization-server.
Open this check and its evidenceFinding: The scan did not find /auth.md.
Change: Publish a stable agent authentication walkthrough at /auth.md.
Open this check and its evidence# Authentication
Public report reads need no credentials.
Write requests require a bearer token.
Never put tokens in URLs.
Adapt this example to the service. Apply every relevant change listed above, then confirm it with a new scan.
Use one documented error format. Match the HTTP status to the error.
HTTP/1.1 404 Not Found
Content-Type: application/problem+json
{"type":"about:blank","title":"Not found","status":404}
Suggested location: /api
Finding: The missing-path response is not a structured JSON error.
Change: Return application/problem+json or a stable JSON error object for API errors.
Open this check and its evidenceHTTP/1.1 404 Not Found
Content-Type: application/problem+json
{"type":"about:blank","title":"Not found","status":404}
Adapt this example to the service. Apply every relevant change listed above, then confirm it with a new scan.
If batch access fits the service, document the actual array request and each item result. Do not claim support before it exists.
{
"items": {
"properties": {
"id": {"type": "string"},
"status": {"type": "string"}
},
"type": "object"
},
"type": "array"
}
Suggested location: OpenAPI batch operations
Finding: The contract has no batch path or array request operation.
Change: Add a bounded batch endpoint for repeated write operations.
Open this check and its evidence{
"info": {
"title": "Example API",
"version": "1.0.0"
},
"openapi": "3.1.0",
"paths": {
"/batch": {
"post": {
"description": "Process a list of items.",
"operationId": "processBatch",
"requestBody": {
"content": {
"application/json": {
"schema": {
"items": {
"properties": {
"id": {
"type": "string"
},
"status": {
"type": "string"
}
},
"type": "object"
},
"type": "array"
}
}
}
},
"responses": {
"200": {
"content": {
"application/json": {
"schema": {
"items": {
"properties": {
"id": {
"type": "string"
},
"status": {
"type": "string"
}
},
"type": "object"
},
"type": "array"
}
}
},
"description": "Successful response"
}
}
}
}
}
}
Adapt this example to the service. Apply every relevant change listed above, then confirm it with a new scan.
Use headings, native controls, and visible labels. Review the recorded control findings.
<label for="site">Website URL</label><input id="site" name="url" type="url"><button type="submit">Check site</button>
Suggested location: /
Finding: 1 of 200 detected controls have no computed source name.
Change: Add visible text, a label, aria-label, aria-labelledby, alt, or a suitable native value.
Open this check and its evidenceFinding: 1 of 102 form fields do not have an explicit computed label.
Change: Associate each field with label, aria-label, or aria-labelledby. Do not rely on a placeholder.
Open this check and its evidence<label for="site">Website URL</label><input id="site" name="url" type="url"><button type="submit">Check site</button>
Adapt this example to the service. Apply every relevant change listed above, then confirm it with a new scan.
Estimated gains use this report's model. All checks listed in a fix must pass to earn its full estimated gain.
57 checks passed. 33 need attention. 4 could not be verified. Checks that do not apply stay out of the score.
Results that need attention are listed first. Open a row for its reason and recommended change.
The public MCP server has no A2UI resource signal.
Publish an A2UI presentation resource and link it from the tool that produces its data.
The public repository root has no Agent Plugins plugin.json manifest.
Add root plugin.json with the canonical Agent Plugins schema identifier and a valid name.
The product page does not provide a usable public CLI path.
Publish a CLI, a copyable install command, and a stable public documentation or package link.
No write operation declares an Idempotency-Key header.
Add an Idempotency-Key header parameter to retryable POST, PUT, PATCH, and DELETE operations.
The identified bot request received text/html, not Markdown.
Optionally serve a Markdown representation to the truthful AgentReadinessBot identity.
The missing-path response is not a structured JSON error.
Return application/problem+json or a stable JSON error object for API errors.
The public MCP server does not advertise an MCP App resource.
Link a ui:// resource from a tool with _meta.ui.resourceUri.
The page does not declare a Markdown alternate.
Add a link rel=alternate with type=text/markdown and a stable URL.
No scoped llms.txt file was found at the bounded docs, API, or developers paths.
Publish /docs/llms.txt, /api/llms.txt, or /developers/llms.txt with a focused resource index.
The product page has no reachable multi-language SDK evidence.
Link stable public SDK pages or package pages and identify their programming languages.
OPTIONS did not advertise POST for /ask.
Publish POST /ask and advertise POST in the Allow or Access-Control-Allow-Methods header.
robots.txt does not publish a Schema Map directive.
Add schemamap: followed by the absolute URL of the structured feed map.
OPTIONS did not advertise the POST route required for NLWeb streaming.
Publish POST /ask before you enable the NLWeb event stream.
The scan did not find authorization-server metadata at the fixed well-known path.
Publish RFC 8414 metadata at /.well-known/oauth-authorization-server.
The scan did not find /pricing.md.
Publish stable machine-readable pricing details at /pricing.md.
The contract has no batch path or array request operation.
Add a bounded batch endpoint for repeated write operations.
The bounded Wikidata search found no entity with verified ownership of this domain.
Add the official website to the correct Wikidata entity, or link the correct Wikidata or Wikipedia page from structured data.
No Web Bot Auth key directory was found at the well-known path.
Publish an Ed25519 JWK keys array with kid, x, nbf, and exp fields.
No server-rendered or inline-script WebMCP declaration was found.
Add declarative form tools or register tools through document.modelContext.
The scan did not find /auth.md.
Publish a stable agent authentication walkthrough at /auth.md.
The API catalog is usable, but its media type or HEAD Link relation is incomplete.
Serve Linkset JSON and include rel=api-catalog in the HEAD response.
1 of 200 detected controls have no computed source name.
Add visible text, a label, aria-label, aria-labelledby, alt, or a suitable native value.
The public repository has a configuration file for one recognized agent platform.
Add repository instructions for another supported platform, such as AGENTS.md, Claude, Copilot, Cursor, or Gemini.
1 of 102 form fields do not have an explicit computed label.
Associate each field with label, aria-label, or aria-labelledby. Do not rely on a placeholder.
Only some listed tools meet this requirement.
Give each tool a typed object inputSchema and keep required names in properties.
The server card has a complete identity and endpoint, but no complete tool preview list.
Add tools with stable names and descriptions when the selected server-card schema supports previews.
A package page is linked, but the bounded descriptor does not identify it as an SDK.
Label the linked NPM or PyPI package as an SDK or API client.
The best Organization entity has 5 of 6 fields.
Add name, URL, logo, description, sameAs, and contactPoint fields.
The page has one pricing signal, but not both visible text and a pricing link.
Add a clear pricing link and plain-language pricing information.
The OpenAPI document has a sandbox or test signal, but it does not clearly separate it from production.
Declare distinct production and sandbox servers, or use a server variable with explicit production and test values.
The selected skills.sh page is usable but has incomplete quality signals, a displayed failing security audit, or audit states that are not present in static HTML.
Complete the skill description, repository link, installation command, and structured instructions. Review all displayed security-audit findings and make their states available without client-side execution.
The page links to only 3 trust-page category or categories.
Link to public about, contact, privacy, terms, and security pages.
The bounded sample resolved 8 of 20 advertised link(s).
Reduce the index size or validate links beyond the scanner sample limit.
The scan did not collect valid ranked web-search evidence for this query.
Configure the ranked search provider and run capture profile version 26 to collect new evidence.
The scan did not collect valid ranked web-search evidence for this query.
Configure the ranked search provider and run capture profile version 26 to collect new evidence.
The scan did not collect valid ranked web-search evidence for this query.
Configure the ranked search provider and run capture profile version 26 to collect new evidence.
The scan did not collect valid official MCP Registry evidence.
Run capture profile version 23 to collect MCP Registry evidence.
A structured catalog is published at /.well-known/ai-catalog.json.
All operations have unique IDs and descriptions, all parameters are typed, and schema depth is 3.
No configured instruction-risk pattern was found in the evaluated hidden accessibility text.
The source document has one main region, navigation, an H1, and no skipped heading level.
All 1 skill entries have the v0.2.0 type, URL, and SHA-256 digest fields.
robots policy permits all 3 evaluated retrieval crawlers at the root path.
The Agent Skills index describes 1 skill(s).
The agent-mode response is machine-readable and has 2 integration signal categories.
The scan found public entry links and documentation plus 4 of five bounded onboarding signals.
The saved agent-facing Markdown has a specific when-to-use section with action guidance.
The probe returns 404 or 410 with concise discovery guidance.
A structured agentic resource catalog is available at /.well-known/ard.json.
The source HTML has 15013 visible text characters.
The page links to 2 developer target(s).
The operations have unique names, descriptions, typed inputs, and bounded schema depth.
The final response has 10 parsed Link header value(s) with relations.
JSON-LD has 2 unique sameAs link(s).
The page has 4 valid JSON-LD block(s).
All 8 sampled content page(s) were publicly readable.
The MCP server card declares a valid Streamable HTTP remote.
The server returns a structured error for a guaranteed unlisted tool name.
The MCP server card has a display name, description, and valid icon.
Every sampled resource returns non-empty content with a URI and media type.
All inspected resource descriptors have a name, URI, and media type.
The server returns a supported protocol version, name, version, and instructions.
The site exposes a static MCP endpoint or manifest signal.
Each listed tool declares read-only and destructive behavior hints.
Each listed tool has a useful description.
The server lists at least three tools in a valid response.
All inspected tool names are descriptive and use one consistent convention.
A bounded well-known MCP endpoint, server card, or manifest signal is available.
/index.md is a valid Markdown representation.
The canonical root returns valid Markdown when Accept prefers text/markdown.
All 3 served Markdown document(s) have balanced CommonMark fences.
All 2 served Markdown document(s) have title and supporting frontmatter metadata.
All 9 metadata fields are present.
All 200 detected controls use native HTML semantics.
The scanner received the target content without a bot block.
A valid OpenAPI document is available.
The estimated visible-text size is 3754 tokens.
The MCP server exposes both product operations and documentation-oriented tools or resources.
The page links to 2 API or documentation target(s).
A documented GET operation returned a successful machine-readable response.
All 4 GET operations declare pagination signals.
Typed success response schemas cover 100.0% of operations.
All 21 declared error responses have typed schemas.
The contract declares API versioning and a machine-readable deprecation signal.
The target uses 0 same-origin redirect(s) with no downgrade or redirect error.
All 3 catalog entries have a domain-bound urn:air identifier, display name, media type, and exactly one target.
The page declares 4 JSON-LD types.
A valid sitemap document is available at /sitemap.xml.
The sitemap has 16 valid lastmod value(s); the freshest is 1 days old.
The public skills.sh catalog has a listing with a verified product-to-GitHub-owner association.
A non-empty /llms.txt file is available.
llms.txt has one leading H1, section headings, and Markdown links.
robots.txt has explicit policies for 6 known AI crawler tokens.
robots.txt explicitly addresses 3 agent-user tokens and permits 3.
This check is outside the selected site type.
This check is outside the selected site type.
This check is outside the selected site type.
This check is outside the selected site type.
This check is outside the selected site type.
This check is outside the selected site type.
No identity, claim, or events endpoint was advertised.
No public GraphQL POST route was found at the bounded standard paths.
No public GraphQL POST route was found at the bounded standard paths.
No public GraphQL POST route was found at the bounded standard paths.
No public GraphQL POST route was found at the bounded standard paths.
No public GraphQL POST route was found at the bounded standard paths.
No public GraphQL POST route was found at the bounded standard paths.
No MCP App view was advertised.
No MCP App view was advertised.
No MCP App resource was advertised.
The MCP endpoint appears public and no OAuth metadata was published. A static HEAD probe cannot classify it as a docs or product server.
No OAuth authorization server was published for the public MCP signal.
This check is outside the selected site type.
This check is outside the selected site type.
This check is outside the selected site type.
This check is outside the selected site type.
The contract declares no 202 Accepted response.
The primary public response is not rate limited and exposes no API rate-limit contract.
The catalog has no optional trust manifests. Their absence does not reduce the score.
This check is outside the selected site type.
This check is outside the selected site type.
auth.md was not available, so its walkthrough structure cannot be evaluated.
This check is outside the selected site type.
This check is outside the selected site type.
LLM Catalog by Jidoka Labs · llmcatalog.dev · HTTP 200
122 of 122 links have names. 1 form controls have no name.
These initial HTML counts are separate from the final accessibility checks.
First result: 8.98 s · Queue: 7.33 s · Total: 22.79 s
3 of 3 selected pages were read. Maximum: five pages.
These pages add evidence. Model 27 uses main-page and protocol facts for its score.
100.0% coverage
100.0% coverage
55.2% coverage
100.0% coverage
Open a rule to inspect its HTTP and extracted evidence.
robots.analysis
100.0% confidencerobots.policy
100.0% confidencehttps://llmcatalog.dev/robots.txt
transport.fetch
100.0% confidencehttps://llmcatalog.dev/
html.accessibility
90.0% confidenceStructured evidence was stored. This view has no safe summary for it yet.
html.content
100.0% confidencehtml.discovery
100.0% confidenceStructured evidence was stored. This view has no safe summary for it yet.
html.forms
100.0% confidencehtml.images
100.0% confidencehtml.links
100.0% confidencehtml.metadata
100.0% confidencehtml.structure
100.0% confidencehtml.structured_data
100.0% confidencehtml.web_mcp
90.0% confidencehttp.semantics
100.0% confidenceresponse.semantics
100.0% confidencescan.core_preview
100.0% confidencelinked_pages.page
100.0% confidencelinked_pages.page
100.0% confidencelinked_pages.page
100.0% confidencelinked_pages.summary
100.0% confidencehttps://llmcatalog.dev/robots.txt
https://llmcatalog.dev/developers
https://llmcatalog.dev/robots.txt
https://llmcatalog.dev/privacy
https://llmcatalog.dev/robots.txt
https://llmcatalog.dev/about
discovery.a2a_agent_card
100.0% confidencediscovery.acp_checkout_options
100.0% confidencediscovery.acp_delegate_payment_options
100.0% confidencediscovery.agent_friendly_404
100.0% confidencediscovery.agent_instructions
100.0% confidencediscovery.agent_mode_view
100.0% confidencediscovery.agent_skills_index
100.0% confidencediscovery.ai_catalog
100.0% confidencediscovery.api_catalog
100.0% confidencediscovery.api_catalog_head
100.0% confidencediscovery.ard_catalog
100.0% confidencediscovery.auth_md
100.0% confidencediscovery.llms_txt
100.0% confidencediscovery.markdown_negotiation
100.0% confidencediscovery.markdown_url_fallback
100.0% confidencediscovery.mcp_endpoint
100.0% confidencediscovery.mcp_manifest
100.0% confidencediscovery.mcp_server_card
100.0% confidencediscovery.modular_llms_txt
100.0% confidencediscovery.oauth_authorization_server
100.0% confidencediscovery.oauth_protected_resource
100.0% confidencediscovery.openapi
100.0% confidencediscovery.pricing_markdown
100.0% confidencediscovery.sitemap
100.0% confidencediscovery.ucp
100.0% confidencediscovery.web_bot_auth_directory
100.0% confidencediscovery.x402
100.0% confidencehttps://llmcatalog.dev/sitemap.xml
https://llmcatalog.dev/llms.txt
https://llmcatalog.dev/pricing.md
https://llmcatalog.dev/.well-known/agent-card.json
https://llmcatalog.dev/.well-known/api-catalog
https://llmcatalog.dev/.well-known/api-catalog
https://llmcatalog.dev/.well-known/oauth-protected-resource
https://llmcatalog.dev/.well-known/ucp
https://llmcatalog.dev/openapi.json
https://llmcatalog.dev/auth.md
https://llmcatalog.dev/.well-known/oauth-authorization-server
https://llmcatalog.dev/index.md
https://llmcatalog.dev/
https://llmcatalog.dev/.well-known/agent-readiness-probe/not-found-7b91e8d4
https://llmcatalog.dev/.well-known/agent-skills/index.json
https://llmcatalog.dev/docs/llms.txt
https://llmcatalog.dev/api/llms.txt
https://llmcatalog.dev/developers/llms.txt
https://llmcatalog.dev/.well-known/agent-instructions.md
https://llmcatalog.dev/agent-instructions.md
https://llmcatalog.dev/.well-known/ard.json
https://llmcatalog.dev/.well-known/ai-catalog.json
https://llmcatalog.dev/.well-known/mcp
https://llmcatalog.dev/.well-known/mcp/server-card.json
https://llmcatalog.dev/.well-known/mcp/manifest.json
https://llmcatalog.dev/.well-known/http-message-signatures-directory
https://llmcatalog.dev/
https://llmcatalog.dev/checkout_sessions
https://llmcatalog.dev/agentic_commerce/delegate_payment
https://llmcatalog.dev/discovery/resources
links.agent_auth
100.0% confidencelinks.docs_access
100.0% confidencelinks.llms
100.0% confidencelinks.public_api
100.0% confidencehttps://llmcatalog.dev/
https://llmcatalog.dev/about
https://llmcatalog.dev/api/v1/history/recent
https://llmcatalog.dev/contact
https://llmcatalog.dev/developers
https://llmcatalog.dev/history
https://llmcatalog.dev/llm-models
https://llmcatalog.dev/models/evaluation
https://llmcatalog.dev/api/history/recent
mcp.inspection
100.0% confidencehttps://llmcatalog.dev/api/mcp
https://llmcatalog.dev/api/mcp
https://llmcatalog.dev/api/mcp
https://llmcatalog.dev/api/mcp
https://llmcatalog.dev/api/mcp
https://llmcatalog.dev/api/mcp
https://llmcatalog.dev/api/mcp
https://llmcatalog.dev/api/mcp
https://llmcatalog.dev/api/mcp
nlweb.inspection
100.0% confidencehttps://llmcatalog.dev/ask
graphql.inspection
100.0% confidencehttps://llmcatalog.dev/graphql
https://llmcatalog.dev/api/graphql
https://llmcatalog.dev/v1/graphql
mcp_apps.inspection
100.0% confidencehttps://llmcatalog.dev/api/mcp
https://llmcatalog.dev/api/mcp
https://llmcatalog.dev/api/mcp
https://llmcatalog.dev/api/mcp
https://llmcatalog.dev/api/mcp
developer_tooling.inspection
100.0% confidencehttps://www.npmjs.com/robots.txt
https://www.npmjs.com/package/@agentjido/llmdb
repository.inspection
100.0% confidencehttps://api.github.com/robots.txt
https://api.github.com/repos/agentjido/llmdb/contents
https://api.github.com/repos/agentjido/llmdb/contents/.github
mcp_registry.inspection
100.0% confidencehttps://registry.modelcontextprotocol.io/robots.txt
https://registry.modelcontextprotocol.io/v0.1/servers
wikimedia.inspection
100.0% confidencehttps://api.wikimedia.org/robots.txt
https://api.wikimedia.org/core/v1/wikidata/search/page
skills_sh.inspection
100.0% confidencehttps://www.skills.sh/robots.txt
https://www.skills.sh/agentjido
https://www.skills.sh/agentjido/jido-skills/jido-action
ranked_search.inspection
100.0% confidenceImmutable scan identity
Versioned evidence first
A later criteria version can evaluate this same stored scan without changing what the scanner observed.
Open this exact snapshotShare this report, apply the relevant changes, then scan again to check the result.
Connection lost
Reconnecting
Server error
Reconnecting