---
name: agent-readiness-audit
description: Audit any website for AI-agent readiness — discoverability, content accessibility, bot access control, and API/MCP/auth discovery — and produce a prioritized fix list.
license: CC-BY-4.0
homepage: https://agenticplug.ai
---

# Agent Readiness Audit

Audit a website's readiness for autonomous AI agents and answer engines, then
return a prioritized, standards-grounded remediation plan. Published by
[agenticplug.ai](https://agenticplug.ai), an AEO / agentic-commerce consultancy.

## When to use

Use this skill when asked to evaluate whether a site is "agent-ready", "AI-ready",
or discoverable/usable by AI shopping agents and answer engines, or to explain how
to improve an agent-readiness / AEO score.

## What to check

Fetch the site root and the well-known paths below, then grade each dimension.

### 1. Discoverability
- `GET /robots.txt` — exists, valid, lists `Sitemap:` directives.
- `GET /sitemap.xml` — valid XML sitemap.
- `Link:` response headers on the homepage (RFC 8288) advertising machine-readable
  resources via `rel="api-catalog"`, `service-desc`, `service-doc`, `describedby`.
- DNS-AID records under `_*._agents.<domain>` (SVCB/HTTPS), DNSSEC-signed.

### 2. Content accessibility
- Markdown content negotiation: request a page with `Accept: text/markdown` (or a
  `/md` twin). Clean Markdown lets agents ingest content without parsing HTML.
- `GET /llms.txt` — concise, link-rich overview for LLMs.

### 3. Bot access control
- AI-bot rules in `robots.txt` (GPTBot, ClaudeBot, PerplexityBot, Google-Extended…).
- `Content-Signal:` directives (contentsignals.org) declaring `search`, `ai-input`,
  and `ai-train` preferences.

### 4. API / Auth / MCP / Skill discovery
- `GET /.well-known/api-catalog` — RFC 9727 linkset of API endpoints.
- `GET /.well-known/mcp/server-card.json` — MCP server card (SEP-2127).
- `GET /.well-known/agent-skills/index.json` — Agent Skills Discovery index (v0.2.0).
- WebMCP tools exposed via `document.modelContext` (`navigator.modelContext` in older Chrome builds).
- OAuth discovery: `/.well-known/oauth-authorization-server` (RFC 8414),
  `/.well-known/oauth-protected-resource` (RFC 9728), and `/auth.md`. Where AS
  metadata exists, the auth.md check also needs an `agent_auth` block in it
  (`skill`, `register_uri`, and one complete method; anonymous needs
  `anonymous.credential_types_supported` and a working `claim_uri`).

### 5. Commerce (only if the site transacts)
- `x402` (HTTP 402 payments), `MPP` (OpenAPI `x-payment-info`), `UCP`
  (`/.well-known/ucp`), `ACP` (`/.well-known/acp.json`).

## Output format

Return, per dimension: pass/fail per check, the exact missing file/header/record,
and the standard that governs it. Then a prioritized fix list ordered by
(points unlocked ÷ effort). Flag any check that would require advertising a
capability the site does not actually have (e.g. OAuth metadata pointing at a
non-existent token endpoint) and mark it "do not fake".

## Integrity rule

Never recommend publishing a discovery document for a capability that does not
work. A 404'd or dead endpoint advertised in a manifest is worse than an absent
one: agents will attempt it and fail.