Paste a domain. We run twenty-one checks against the surfaces an autonomous agent depends on — discovery documents, machine-readable content, commerce records, security posture and access hygiene — and tell you exactly what fails and how to fix it. No account, no email address, no card.
Public URLs only, the same ones any crawler can request. Twelve scans an hour per IP.
For context: the median of a hundred widely used sites we scanned was 8 of 21.
Permanent link to this scan
Permanent link to this scan:
mdash; it previews with the score, so it reads properly when pasted into Slack or a message:Badge for your README or footer:
Failures first, because that is the work. Each one includes the fix.
Half of the failures above are a file that does not exist yet. Here are those files for this domain, filled in where we can, with the parts only you can answer written out as plain instructions rather than left blank. They are starting points, not finished work — read each one before you publish it, because a wrong agent card is worse than no agent card.
Every failure above is small on its own; together they are a week of unfamiliar work, and most of the shapes the scanners demand are not documented anywhere. We took moltlinestudio.com from failing to 21 out of 21 and wrote down all of it. The audit and implementation service is that work, done for you, and you verify the result with a scanner we do not control.
llms.txt, agent card, API catalogue, OpenAPI description, sitemap, and whether robots.txt quietly bans every AI crawler. Six checks. If an agent cannot find you, nothing else matters.
JSON-LD structured data, a named organisation entity, a markdown twin of your pages, and sane title and description metadata. Four checks. This is the difference between being read and being skimmed.
A machine-readable catalogue, an x402 payment challenge, and discoverable pricing. Three checks. Crawlers whose only job is finding payable endpoints already exist — we see them in our own logs daily.
security.txt with a real contact, HTTPS enforcement, HSTS, and baseline response headers. Four checks. Agents treat sloppy transport as a reason not to transact.
CORS on discovery documents, correct JSON content types, no wall in front of non-browser clients, and a homepage that answers quickly. Four checks. This is where most otherwise-good sites lose points.
Entirely from the outside, over plain HTTP, exactly as an agent would see you. No access to your servers, no tag to install, nothing to sign. You can reproduce every check with curl.
We measured it: across a hundred of the web’s most-used sites the median is 8 of 21, not one scored above 15, and none earned an A or a B. Reaching 14 puts you ahead of 95 of those 100. 21 is achievable — we documented how.
Yes. No account, no email, no card. Twelve scans an hour per IP is the fair-use allowance. If you need to scan a large estate, say so.
We fetch public URLs only. We store the score and the check outcomes so the shareable link and the badge work. We do not store your page content.
Because we did the work on our own domain and found the checks were undocumented, inconsistent and irritating. This is the tool we wanted. It also happens to be an honest advertisement for the service.