▸ Free tool
Can agents find and read this site?
Paste a URL, pick the kind of site, and get a score for the checks that apply. Each row has the evidence and a fix you can hand to a coding agent.
This is the one tool here that leaves your browser. A Pages Function on this site fetches the public URL you enter. The report is not stored. A share link reruns the scan.
How the score works
The default site type is Content. A missing MCP card, A2A card, API catalog, OAuth file, Poppy file, or DNS-AID record does not lower that score. Those checks are still listed, with a line that says not to publish a file for a service you do not have. SaaS scores the API and agent checks. Store scores the commerce checks. Everything scores all of them. The tool does not decide you are a store because the page mentions one.
High impact, always scored: HTTPS, a real robots.txt, an XML sitemap, access for search and user-triggered AI crawlers, a Content-Signal line, and main text that is already in the HTML. Blocking a training crawler, or setting ai-train to no, is a preference, not a failure.
Medium impact, always scored: llms.txt against the llmstxt.org v2 shape,
the optional llms-full.txt companion (missing is a warning, not a
failure), Markdown on Accept: text/markdown with no redirect,
a stable .md URL, HTTP Link headers, and sane JSON-LD.
Low impact: protocol files and, for a store, UCP, x402, ACP, MPP, and AP2. Agent Skills, Web Bot Auth, WebMCP, and security headers are shown and never scored. WebMCP needs a browser, so this scan marks it as not verified.
Each row is labeled stable, emerging, or experimental, with a link to the spec when there is one. DNS-AID and several commerce files are drafts. A pass there is not a claim that the standard is finished.
Limits
The function accepts only http and https, on ports 80 and 443. It resolves the host with DNS-over-HTTPS and refuses private, loopback, link-local, and metadata addresses, including after a redirect. It does not forward cookies or a request body. There is a small per-IP limit so it cannot be used as an open proxy.
Specs: RFC 9309 (robots.txt) , Sitemap protocol , Content Signals , llmstxt.org , RFC 8288 (Link headers) , RFC 9727 (API catalog) , RFC 9728 (OAuth resource) , RFC 8414 (OAuth server) , A2A discovery , MCP server cards , Personal Agent Protocol , DNS-AID draft .
Questions, answered
Does this run in my browser?
No. A browser cannot fetch someone else's site. The scan runs on a Pages Function on this site. It requests the URL you enter, plus robots.txt, the sitemap, llms.txt, a Markdown copy, and a short list of well-known paths on that same host. The report is not stored.
What does the score mean?
It is 0 to 100, from the checks that apply to the site type you picked. A pass earns full weight, a warn earns half, and a fail earns zero. High impact checks weigh more than low ones. A skipped check is not a failure. 90 and above is excellent, 75 is good, 50 needs work, and below 50 means the basics are blocked. The number is not a certification and it does not predict traffic.
Will a missing MCP file fail my blog?
Not on the Content site type, which is the default. Protocol files (MCP, A2A, OAuth, API catalogs, Poppy, DNS-AID) and store payment files are shown, and they are scored only when you pick SaaS, Store, or Everything. Do not publish a file for a service you do not run.
What is not checked?
This version does not run JavaScript, so it cannot see a page that is drawn in the browser, and it cannot test WebMCP. It does not crawl the whole site. It fetches the one URL you entered and a fixed list of paths on that host.
Can I share a result?
Yes. The share link puts the URL and the site type in the query string. Opening it runs the scan again. Nothing is saved on the server.
▸ Last verified:
Need this in production?
Shipping AI features? I build RAG pipelines, MCP servers and agents that hold up in production.
AI & MCP Integration