How the Agent Readiness scan works

The Growth Saloon Agent Readiness scan includes a total of 23 checks performed across five categories. Each check below shows the request the scanner sends to your site and what it needs to find for the check to pass.

Discoverability

4 checks

Whether agents can find your content and the entrypoints you publish for them.

robots.txt

Request: GET/robots.txt
Passes when: The file returns HTTP 200 and declares at least one User-agent directive.

Sitemap

Request: GET/robots.txt/sitemap.xml/sitemap_index.xml/sitemap-index.xml/sitemap.xml.gz
Passes when: A Sitemap URL listed in robots.txt, or one of the fallback locations, returns a valid XML sitemap or sitemap index.

Link response headers

Request: GET/
Passes when: The homepage's HTTP Link header includes an agent-useful relation such as service-desc, service-doc, api-catalog or describedby.

DNS for AI Discovery (DNS-AID)

Request: DNS_index._agents.example.com_a2a._agents.example.com_mcp._agents.example.com
Passes when: A service-mode SVCB or HTTPS record is published at one of these names, queried over DNS-over-HTTPS for your domain.

Content Accessibility

1 check

Whether agents can read your pages in a format made for them.

Markdown content negotiation

Request: GET/Accept: text/markdown
Passes when: The homepage responds with Content-Type: text/markdown.

Bot Access Control

3 checks

Whether you tell AI crawlers what they may do, and whether your own bots can prove who they are.

AI bot rules in robots.txt

Request: GET/robots.txt
Passes when: User-agent rules cover 15 known AI crawlers, such as GPTBot and PerplexityBot, by name or through a User-agent: * group.

Content Signals in robots.txt

Request: GET/robots.txt
Passes when: At least one Content-Signal directive states your ai-train, search and ai-input preferences.

Web Bot Auth request signing

Request: GET/.well-known/http-message-signatures-directory
Passes when: The directory returns a key set (JWKS) with the public keys your bots use to sign requests.

API, Auth, MCP & Skill Discovery

10 checks

Whether agents can find your APIs and tools, and learn how to authenticate with them.

API Catalog

Request: GET/.well-known/api-catalogAccept: application/linkset+json
Passes when: The response is JSON with a linkset array that lists your APIs (RFC 9727).

OAuth / OIDC discovery

Request: GET/.well-known/openid-configuration/.well-known/oauth-authorization-server
Passes when: Either document is JSON with an issuer, authorization_endpoint and token_endpoint.

OAuth Protected Resource

Request: GET/.well-known/oauth-protected-resource
Passes when: The metadata names a resource and lists its authorization_servers (RFC 9728).

Auth.md agent registration

Request: GET/auth.md/.well-known/oauth-protected-resource
Passes when: A Markdown registration document is served, backed by a registration flow in the document or by OAuth Protected Resource metadata.

MCP Server Card

Request: GET/.well-known/mcp/server-card.json/.well-known/mcp.json/.well-known/mcp/server-cards.json
Passes when: One of these returns a valid MCP Server Card that names your server and how to connect to it.

A2A Agent Card

Off by default

Request: GET/.well-known/agent-card.json
Passes when: The card is JSON with a name, version and skills.

Agent Skills index

Request: GET/.well-known/agent-skills/index.json/.well-known/skills/index.json
Passes when: The index is JSON with a skills array describing what agents can do on your site.

WebMCP

Request: Browser/
Passes when: The page registers at least one tool through navigator.modelContext while it loads in a headless browser.

ARD (Agentic Resource Discovery)

Request: GET/.well-known/ai-catalog.json
Passes when: The manifest has a specVersion and at least one valid entry. A robots.txt Agentmap directive or a _catalog._agents DNS record can point to it instead.

Personal Agent Protocol (Poppy)

Informational

Request: GET/.well-known/poppy.json
Passes when: The declaration is valid for your domain, and any OAuth issuer it names publishes matching metadata.

Commerce

5 checksOptional

Whether agents can discover how to pay or check out. These checks are shown for information and do not count toward your score.

x402 Protocol

Request: GET//api/api/v1
Passes when: A response returns HTTP 402 Payment Required or carries x402 payment headers or metadata.

MPP (Machine Payment Protocol)

Request: GET/openapi.json
Passes when: The OpenAPI document has operations with x-payment-info pricing extensions.

Universal Commerce Protocol

Request: GET/.well-known/ucp
Passes when: The profile is JSON that declares a protocol version and services.

ACP (Agentic Commerce Protocol)

Request: GET/.well-known/acp.json
Passes when: The document declares protocol.name as acp and a protocol.version.

AP2 (Agent Payments Protocol)

Off by default

Request: GET/.well-known/agent-card.json
Passes when: Your A2A Agent Card lists an Agent Payments Protocol extension.