robots.analysis
100.0% confidence- Allowed agent user count
- 3
- Allowed retrieval count
- 3
- Availability
- available
- Explicit agent user count
- 3
- Explicit ai crawler count
- 6
- Group count
- 12
- Known policy count
- 9
- Same origin schema map url count
- 0
Legacy site · Static audit
The static audit found gaps. Start with the fixes below.
Pass starts at 80 / 100. This scan does not prove that an agent can complete a purchase. Method and limits
70/ 100
NEEDS WORK
Readiness score
Scanned 2026-09-02 15:22:09 UTC
Start with these changes. Open a fix for the finding, example, and supporting evidence.
State whether access is public or needs credentials. Link the applicable authentication metadata.
# Authentication
Public report reads need no credentials.
Write requests require a bearer token.
Never put tokens in URLs.
Suggested location: /auth.md
Finding: The scan did not find OAuth protected resource metadata.
Change: Publish RFC 9728 metadata at /.well-known/oauth-protected-resource.
Open this check and its evidenceFinding: The fixed discovery paths did not provide a usable OAuth authorization-server signal.
Change: Publish RFC 9728 protected-resource metadata and RFC 8414 authorization-server metadata.
Open this check and its evidenceFinding: The discovered OAuth metadata does not declare supported scopes.
Change: Publish scopes_supported in protected-resource or authorization-server metadata.
Open this check and its evidenceFinding: The scan did not find authorization-server metadata at the fixed well-known path.
Change: Publish RFC 8414 metadata at /.well-known/oauth-authorization-server.
Open this check and its evidenceFinding: The scan did not find /auth.md.
Change: Publish a stable agent authentication walkthrough at /auth.md.
Open this check and its evidenceFinding: The fixed discovery documents do not publish an agent_auth chain.
Change: Publish protected-resource metadata and an agent_auth block that points to /auth.md.
Open this check and its evidence# Authentication
Public report reads need no credentials.
Write requests require a bearer token.
Never put tokens in URLs.
Adapt this example to the service. Apply every relevant change listed above, then confirm it with a new scan.
Link public API instructions and a valid OpenAPI document. Show request and response examples.
Suggested location: /docs
Finding: The API catalog is usable, but its media type or HEAD Link relation is incomplete.
Change: Serve Linkset JSON and include rel=api-catalog in the HEAD response.
Open this check and its evidenceFinding: No write operation declares an Idempotency-Key header.
Change: Add an Idempotency-Key header parameter to retryable POST, PUT, PATCH, and DELETE operations.
Open this check and its evidenceFinding: The server card has a complete identity and endpoint, but no complete tool preview list.
Change: Add tools with stable names and descriptions when the selected server-card schema supports previews.
Open this check and its evidenceFinding: Only some listed tools meet this requirement.
Change: Give each tool a typed object inputSchema and keep required names in properties.
Open this check and its evidenceFinding: The public MCP server does not advertise an MCP App resource.
Change: Link a ui:// resource from a tool with _meta.ui.resourceUri.
Open this check and its evidenceFinding: The bounded official MCP Registry search found no active matching listing.
Change: Publish the MCP server in the official MCP Registry and include a product domain or canonical repository.
Open this check and its evidence{
"info": {
"title": "Example API",
"version": "1.0.0"
},
"openapi": "3.1.0",
"paths": {
"/status": {
"get": {
"responses": {
"200": {
"description": "Service status"
}
}
}
}
}
}
Adapt this example to the service. Apply every relevant change listed above, then confirm it with a new scan.
Add named links to the site's public documentation and machine-readable resources.
<a href="/docs">Documentation</a><a href="/llms.txt">Content map for agents</a>
Suggested location: /
Finding: The scan did not find an A2A Agent Card.
Change: Publish a valid Agent Card at /.well-known/agent-card.json.
Open this check and its evidenceFinding: The scan did not find a UCP business profile.
Change: Publish a UCP business profile at /.well-known/ucp.
Open this check and its evidenceFinding: The OpenAPI document has a sandbox or test signal, but it does not clearly separate it from production.
Change: Declare distinct production and sandbox servers, or use a server variable with explicit production and test values.
Open this check and its evidenceFinding: The bounded Wikidata search found no entity with verified ownership of this domain.
Change: Add the official website to the correct Wikidata entity, or link the correct Wikidata or Wikipedia page from structured data.
Open this check and its evidence<a href="/docs">Documentation</a><a href="/llms.txt">Content map for agents</a>
Adapt this example to the service. Apply every relevant change listed above, then confirm it with a new scan.
Use one documented error format. Match the HTTP status to the error.
HTTP/1.1 404 Not Found
Content-Type: application/problem+json
{"type":"about:blank","title":"Not found","status":404}
Suggested location: /api
Finding: The missing-path response is not a structured JSON error.
Change: Return application/problem+json or a stable JSON error object for API errors.
Open this check and its evidenceHTTP/1.1 404 Not Found
Content-Type: application/problem+json
{"type":"about:blank","title":"Not found","status":404}
Adapt this example to the service. Apply every relevant change listed above, then confirm it with a new scan.
If batch access fits the service, document the actual array request and each item result. Do not claim support before it exists.
{
"items": {
"properties": {
"id": {"type": "string"},
"status": {"type": "string"}
},
"type": "object"
},
"type": "array"
}
Suggested location: OpenAPI batch operations
Finding: The contract has no batch path or array request operation.
Change: Add a bounded batch endpoint for repeated write operations.
Open this check and its evidence{
"info": {
"title": "Example API",
"version": "1.0.0"
},
"openapi": "3.1.0",
"paths": {
"/batch": {
"post": {
"description": "Process a list of items.",
"operationId": "processBatch",
"requestBody": {
"content": {
"application/json": {
"schema": {
"items": {
"properties": {
"id": {
"type": "string"
},
"status": {
"type": "string"
}
},
"type": "object"
},
"type": "array"
}
}
}
},
"responses": {
"200": {
"content": {
"application/json": {
"schema": {
"items": {
"properties": {
"id": {
"type": "string"
},
"status": {
"type": "string"
}
},
"type": "object"
},
"type": "array"
}
}
},
"description": "Successful response"
}
}
}
}
}
}
Adapt this example to the service. Apply every relevant change listed above, then confirm it with a new scan.
Estimated gains use this report's model. All checks listed in a fix must pass to earn its full estimated gain.
57 checks passed. 39 need attention. 5 could not be verified. Checks that do not apply stay out of the score.
Results that need attention are listed first. Open a row for its reason and recommended change.
The scan did not find an A2A Agent Card.
Publish a valid Agent Card at /.well-known/agent-card.json.
The public MCP server has no A2UI resource signal.
Publish an A2UI presentation resource and link it from the tool that produces its data.
The public repository root has no Agent Plugins plugin.json manifest.
Add root plugin.json with the canonical Agent Plugins schema identifier and a valid name.
The fixed discovery documents do not publish an agent_auth chain.
Publish protected-resource metadata and an agent_auth block that points to /auth.md.
The product page does not provide a usable public CLI path.
Publish a CLI, a copyable install command, and a stable public documentation or package link.
No write operation declares an Idempotency-Key header.
Add an Idempotency-Key header parameter to retryable POST, PUT, PATCH, and DELETE operations.
The identified bot request received text/html, not Markdown.
Optionally serve a Markdown representation to the truthful AgentReadinessBot identity.
The missing-path response is not a structured JSON error.
Return application/problem+json or a stable JSON error object for API errors.
The public MCP server does not advertise an MCP App resource.
Link a ui:// resource from a tool with _meta.ui.resourceUri.
The page does not declare a Markdown alternate.
Add a link rel=alternate with type=text/markdown and a stable URL.
No scoped llms.txt file was found at the bounded docs, API, or developers paths.
Publish /docs/llms.txt, /api/llms.txt, or /developers/llms.txt with a focused resource index.
The product page has no reachable multi-language SDK evidence.
Link stable public SDK pages or package pages and identify their programming languages.
OPTIONS did not advertise POST for /ask.
Publish POST /ask and advertise POST in the Allow or Access-Control-Allow-Methods header.
robots.txt does not publish a Schema Map directive.
Add schemamap: followed by the absolute URL of the structured feed map.
OPTIONS did not advertise the POST route required for NLWeb streaming.
Publish POST /ask before you enable the NLWeb event stream.
The fixed discovery paths did not provide a usable OAuth authorization-server signal.
Publish RFC 9728 protected-resource metadata and RFC 8414 authorization-server metadata.
The scan did not find authorization-server metadata at the fixed well-known path.
Publish RFC 8414 metadata at /.well-known/oauth-authorization-server.
The scan did not find OAuth protected resource metadata.
Publish RFC 9728 metadata at /.well-known/oauth-protected-resource.
The bounded official MCP Registry search found no active matching listing.
Publish the MCP server in the official MCP Registry and include a product domain or canonical repository.
The scan did not find /pricing.md.
Publish stable machine-readable pricing details at /pricing.md.
The contract has no batch path or array request operation.
Add a bounded batch endpoint for repeated write operations.
The discovered OAuth metadata does not declare supported scopes.
Publish scopes_supported in protected-resource or authorization-server metadata.
The scan did not find a UCP business profile.
Publish a UCP business profile at /.well-known/ucp.
The bounded Wikidata search found no entity with verified ownership of this domain.
Add the official website to the correct Wikidata entity, or link the correct Wikidata or Wikipedia page from structured data.
No Web Bot Auth key directory was found at the well-known path.
Publish an Ed25519 JWK keys array with kid, x, nbf, and exp fields.
No server-rendered or inline-script WebMCP declaration was found.
Add declarative form tools or register tools through document.modelContext.
The scan did not find /auth.md.
Publish a stable agent authentication walkthrough at /auth.md.
The API catalog is usable, but its media type or HEAD Link relation is incomplete.
Serve Linkset JSON and include rel=api-catalog in the HEAD response.
1 of 197 detected controls have no computed source name.
Add visible text, a label, aria-label, aria-labelledby, alt, or a suitable native value.
The public repository has a configuration file for one recognized agent platform.
Add repository instructions for another supported platform, such as AGENTS.md, Claude, Copilot, Cursor, or Gemini.
1 of 102 form fields do not have an explicit computed label.
Associate each field with label, aria-label, or aria-labelledby. Do not rely on a placeholder.
Only some listed tools meet this requirement.
Give each tool a typed object inputSchema and keep required names in properties.
The server card has a complete identity and endpoint, but no complete tool preview list.
Add tools with stable names and descriptions when the selected server-card schema supports previews.
A package page is linked, but the bounded descriptor does not identify it as an SDK.
Label the linked NPM or PyPI package as an SDK or API client.
The best Organization entity has 5 of 6 fields.
Add name, URL, logo, description, sameAs, and contactPoint fields.
The page has one pricing signal, but not both visible text and a pricing link.
Add a clear pricing link and plain-language pricing information.
The OpenAPI document has a sandbox or test signal, but it does not clearly separate it from production.
Declare distinct production and sandbox servers, or use a server variable with explicit production and test values.
The page links to only 3 trust-page category or categories.
Link to public about, contact, privacy, terms, and security pages.
The bounded sample resolved 8 of 20 advertised link(s).
Reduce the index size or validate links beyond the scanner sample limit.
The scan did not collect valid ranked web-search evidence for this query.
Configure the ranked search provider and run capture profile version 26 to collect new evidence.
The scan did not collect valid ranked web-search evidence for this query.
Configure the ranked search provider and run capture profile version 26 to collect new evidence.
The scan did not collect valid ranked web-search evidence for this query.
Configure the ranked search provider and run capture profile version 26 to collect new evidence.
The scan did not collect valid public skills.sh catalog evidence.
Run capture profile version 25 to collect skills.sh evidence.
The scan did not collect valid public skills.sh catalog evidence.
Run capture profile version 25 to collect skills.sh evidence.
A structured catalog is published at /.well-known/ai-catalog.json.
All operations have unique IDs and descriptions, all parameters are typed, and schema depth is 3.
No configured instruction-risk pattern was found in the evaluated hidden accessibility text.
The source document has one main region, navigation, an H1, and no skipped heading level.
All 1 skill entries have the v0.2.0 type, URL, and SHA-256 digest fields.
robots policy permits all 3 evaluated retrieval crawlers at the root path.
The Agent Skills index describes 1 skill(s).
The agent-mode response is machine-readable and has 2 integration signal categories.
The scan found public entry links and documentation plus 4 of five bounded onboarding signals.
The saved agent-facing Markdown has a specific when-to-use section with action guidance.
The probe returns 404 or 410 with concise discovery guidance.
A structured agentic resource catalog is available at /.well-known/ard.json.
The source HTML has 14912 visible text characters.
The page links to 2 developer target(s).
The operations have unique names, descriptions, typed inputs, and bounded schema depth.
The final response has 10 parsed Link header value(s) with relations.
JSON-LD has 2 unique sameAs link(s).
The page has 4 valid JSON-LD block(s).
All 8 sampled content page(s) were publicly readable.
The MCP server card declares a valid Streamable HTTP remote.
The server returns a structured error for a guaranteed unlisted tool name.
The MCP server card has a display name, description, and valid icon.
Every sampled resource returns non-empty content with a URI and media type.
All inspected resource descriptors have a name, URI, and media type.
The server returns a supported protocol version, name, version, and instructions.
The site exposes a static MCP endpoint or manifest signal.
Each listed tool declares read-only and destructive behavior hints.
Each listed tool has a useful description.
The server lists at least three tools in a valid response.
All inspected tool names are descriptive and use one consistent convention.
A bounded well-known MCP endpoint, server card, or manifest signal is available.
/index.md is a valid Markdown representation.
The canonical root returns valid Markdown when Accept prefers text/markdown.
All 3 served Markdown document(s) have balanced CommonMark fences.
All 2 served Markdown document(s) have title and supporting frontmatter metadata.
The negotiated Markdown response varies its cache key on Accept.
All 9 metadata fields are present.
All 197 detected controls use native HTML semantics.
The scanner received the target content without a bot block.
A valid OpenAPI document is available.
The estimated visible-text size is 3728 tokens.
The MCP server exposes both product operations and documentation-oriented tools or resources.
The page links to 2 API or documentation target(s).
A documented GET operation returned a successful machine-readable response.
All 4 GET operations declare pagination signals.
Typed success response schemas cover 100.0% of operations.
All 21 declared error responses have typed schemas.
The contract declares API versioning and a machine-readable deprecation signal.
The target uses 0 same-origin redirect(s) with no downgrade or redirect error.
All 3 catalog entries have a domain-bound urn:air identifier, display name, media type, and exactly one target.
The page declares 4 JSON-LD types.
A valid sitemap document is available at /sitemap.xml.
The sitemap has 14 valid lastmod value(s); the freshest is 1 days old.
A non-empty /llms.txt file is available.
llms.txt has one leading H1, section headings, and Markdown links.
robots.txt has explicit policies for 6 known AI crawler tokens.
robots.txt explicitly addresses 3 agent-user tokens and permits 3.
No commerce or payment protocol signal was found.
No commerce or payment protocol signal was found.
No commerce or payment protocol signal was found.
The primary public request did not return 401, so an authentication challenge hint was not required.
No identity, claim, or events endpoint was advertised.
No public GraphQL POST route was found at the bounded standard paths.
No public GraphQL POST route was found at the bounded standard paths.
No public GraphQL POST route was found at the bounded standard paths.
No public GraphQL POST route was found at the bounded standard paths.
No public GraphQL POST route was found at the bounded standard paths.
No public GraphQL POST route was found at the bounded standard paths.
No MCP App view was advertised.
No MCP App view was advertised.
No MCP App resource was advertised.
The MCP endpoint appears public and no OAuth metadata was published. A static HEAD probe cannot classify it as a docs or product server.
No OAuth authorization server was published for the public MCP signal.
No commerce or payment protocol signal was found.
The contract declares no 202 Accepted response.
The primary public response is not rate limited and exposes no API rate-limit contract.
The catalog has no optional trust manifests. Their absence does not reduce the score.
auth.md was not available, so its walkthrough structure cannot be evaluated.
No auth.md or agent authentication discovery signal was found.
No commerce or payment protocol signal was found.
Open a rule to inspect its HTTP and extracted evidence.
robots.analysis
100.0% confidencerobots.policy
100.0% confidencehttps://llmcatalog.dev/robots.txt
transport.fetch
100.0% confidencehttps://llmcatalog.dev/
discovery.a2a_agent_card
100.0% confidencediscovery.acp_checkout_options
100.0% confidencediscovery.acp_delegate_payment_options
100.0% confidencediscovery.agent_friendly_404
100.0% confidencediscovery.agent_instructions
100.0% confidencediscovery.agent_mode_view
100.0% confidencediscovery.agent_skills_index
100.0% confidencediscovery.ai_catalog
100.0% confidencediscovery.api_catalog
100.0% confidencediscovery.api_catalog_head
100.0% confidencediscovery.ard_catalog
100.0% confidencediscovery.auth_md
100.0% confidencediscovery.llms_txt
100.0% confidencediscovery.markdown_negotiation
100.0% confidencediscovery.markdown_url_fallback
100.0% confidencediscovery.mcp_endpoint
100.0% confidencediscovery.mcp_manifest
100.0% confidencediscovery.mcp_server_card
100.0% confidencediscovery.modular_llms_txt
100.0% confidencediscovery.oauth_authorization_server
100.0% confidencediscovery.oauth_protected_resource
100.0% confidencediscovery.openapi
100.0% confidencediscovery.pricing_markdown
100.0% confidencediscovery.sitemap
100.0% confidencediscovery.ucp
100.0% confidencediscovery.web_bot_auth_directory
100.0% confidencediscovery.x402
100.0% confidencehttps://llmcatalog.dev/sitemap.xml
https://llmcatalog.dev/llms.txt
https://llmcatalog.dev/pricing.md
https://llmcatalog.dev/.well-known/agent-card.json
https://llmcatalog.dev/.well-known/api-catalog
https://llmcatalog.dev/.well-known/api-catalog
https://llmcatalog.dev/.well-known/oauth-protected-resource
https://llmcatalog.dev/.well-known/ucp
https://llmcatalog.dev/openapi.json
https://llmcatalog.dev/auth.md
https://llmcatalog.dev/.well-known/oauth-authorization-server
https://llmcatalog.dev/index.md
https://llmcatalog.dev/
https://llmcatalog.dev/.well-known/agent-readiness-probe/not-found-7b91e8d4
https://llmcatalog.dev/.well-known/agent-skills/index.json
https://llmcatalog.dev/docs/llms.txt
https://llmcatalog.dev/api/llms.txt
https://llmcatalog.dev/developers/llms.txt
https://llmcatalog.dev/.well-known/agent-instructions.md
https://llmcatalog.dev/agent-instructions.md
https://llmcatalog.dev/.well-known/ard.json
https://llmcatalog.dev/.well-known/ai-catalog.json
https://llmcatalog.dev/.well-known/mcp
https://llmcatalog.dev/.well-known/mcp/server-card.json
https://llmcatalog.dev/.well-known/mcp/manifest.json
https://llmcatalog.dev/.well-known/http-message-signatures-directory
https://llmcatalog.dev/
https://llmcatalog.dev/checkout_sessions
https://llmcatalog.dev/agentic_commerce/delegate_payment
https://llmcatalog.dev/discovery/resources
links.agent_auth
100.0% confidencelinks.docs_access
100.0% confidencelinks.llms
100.0% confidencelinks.public_api
100.0% confidencehttps://llmcatalog.dev/
https://llmcatalog.dev/.well-known/ard.json
https://llmcatalog.dev/.well-known/mcp/server-card.json
https://llmcatalog.dev/about
https://llmcatalog.dev/api/v1/history/recent
https://llmcatalog.dev/contact
https://llmcatalog.dev/developers
https://llmcatalog.dev/history
https://llmcatalog.dev/api/history/recent
mcp.inspection
100.0% confidencehttps://llmcatalog.dev/api/mcp
https://llmcatalog.dev/api/mcp
https://llmcatalog.dev/api/mcp
https://llmcatalog.dev/api/mcp
https://llmcatalog.dev/api/mcp
https://llmcatalog.dev/api/mcp
https://llmcatalog.dev/api/mcp
https://llmcatalog.dev/api/mcp
https://llmcatalog.dev/api/mcp
nlweb.inspection
100.0% confidencehttps://llmcatalog.dev/ask
graphql.inspection
100.0% confidencehttps://llmcatalog.dev/graphql
https://llmcatalog.dev/api/graphql
https://llmcatalog.dev/v1/graphql
mcp_apps.inspection
100.0% confidencehttps://llmcatalog.dev/api/mcp
https://llmcatalog.dev/api/mcp
https://llmcatalog.dev/api/mcp
https://llmcatalog.dev/api/mcp
https://llmcatalog.dev/api/mcp
developer_tooling.inspection
100.0% confidencehttps://www.npmjs.com/robots.txt
https://www.npmjs.com/package/@agentjido/llmdb
repository.inspection
100.0% confidencehttps://api.github.com/robots.txt
https://api.github.com/repos/agentjido/llmdb/contents
https://api.github.com/repos/agentjido/llmdb/contents/.github
mcp_registry.inspection
100.0% confidencehttps://registry.modelcontextprotocol.io/robots.txt
https://registry.modelcontextprotocol.io/v0.1/servers
wikimedia.inspection
100.0% confidencehttps://api.wikimedia.org/robots.txt
https://api.wikimedia.org/core/v1/wikidata/search/page
skills_sh.inspection
100.0% confidencehttps://www.skills.sh/robots.txt
https://www.skills.sh/agentjido
ranked_search.inspection
100.0% confidencehttp.semantics
100.0% confidenceresponse.semantics
100.0% confidencehtml.accessibility
90.0% confidenceStructured evidence was stored. This view has no safe summary for it yet.
html.content
100.0% confidencehtml.discovery
100.0% confidenceStructured evidence was stored. This view has no safe summary for it yet.
html.forms
100.0% confidencehtml.images
100.0% confidencehtml.links
100.0% confidencehtml.metadata
100.0% confidencehtml.structure
100.0% confidencehtml.structured_data
100.0% confidencehtml.web_mcp
90.0% confidenceImmutable scan identity
Versioned evidence first
A later criteria version can evaluate this same stored scan without changing what the scanner observed.
Open this exact snapshotShare this report, apply the relevant changes, then scan again to check the result.
Connection lost
Reconnecting
Server error
Reconnecting