Agentic Readiness
What the Agentic Readiness audit checks on your website, how the level and score work, and how to allowlist our scanner.
AI agents do more than read a page. They look for machine-readable signals that tell them what a site allows, where its content lives in a clean format, and whether it offers tools or APIs they can call. The Agentic Readiness audit checks your website for those signals and tells you which ones are missing, in the order that matters.
Open Agentic Readiness in your project to run an audit. Each report gives you a level from 0 to 5, a score from 0 to 100, and a result for every check with guidance on how to fix what failed.
The audit looks at your website. To check how complete your product feed is for AI shopping agents, open the Catalog feed readiness for AI agents card on the Optimize page.
What the audit checks
Checks are grouped into five categories. Every check reports one of four results: pass, fail, not applicable (the check does not apply to your site), or could not check (we could not reach the resource, for example because a firewall blocked the request).
Discoverability
Can an agent find its way around your site?
| Check | What we look for |
|---|---|
| robots.txt | A valid robots.txt at the root of your domain. |
| Sitemap | An XML sitemap, either declared in robots.txt or at a standard location. |
| Link headers | HTTP Link headers on your homepage that point agents at related resources. |
| DNS for AI Discovery | _agents DNS records that advertise agent resources for your domain. |
Content
Can an agent read your content without parsing a full web page?
| Check | What we look for |
|---|---|
| Markdown negotiation | Your pages return Markdown when a request asks for text/markdown. |
| llms.txt | An /llms.txt file that summarises your site for language models. |
Bot access
Have you said what AI bots may do?
| Check | What we look for |
|---|---|
| AI bot rules | robots.txt rules that name AI crawlers and agents explicitly. |
| Content Signals | Content Signals in robots.txt stating how your content may be used, for example for search or for training. |
| Web Bot Auth | A key directory at /.well-known/http-message-signatures-directory that publishes the keys used to sign automated requests. |
API, auth and MCP
Can an agent do something on your site, not just read it?
| Check | What we look for |
|---|---|
| API Catalog | A /.well-known/api-catalog document listing your public APIs. |
| OAuth discovery | OAuth authorization server metadata. |
| OAuth Protected Resource | Protected resource metadata that tells agents how to authenticate. |
| auth.md | An /auth.md file describing how agents should authenticate. |
| MCP Server Card | A card describing your Model Context Protocol server. |
| A2A Agent Card | An Agent2Agent card describing an agent you host. |
| Agent Skills | A published index of skills agents can use with your site. |
| WebMCP | Tools your pages expose to agents running in the browser. |
| ARD manifest | An agent resource discovery manifest. |
Commerce
Can an agent buy from you? These checks cover agentic payment and checkout protocols: x402, MPP, UCP, ACP and AP2. They are reported separately and do not count toward your level, because many sites that are fully ready for agents do not sell anything.
Levels
The level tells you which rung of the ladder you are on. Each level needs everything the level below it needs, plus more.
| Level | Name | What it needs |
|---|---|---|
| 0 | Not Ready | Fewer than two of the level 1 signals. |
| 1 | Basic Web Presence | Two of: robots.txt, a sitemap, Link headers. |
| 2 | Bot-Aware | Level 1, plus AI bot rules and Content Signals in robots.txt. |
| 3 | Agent-Readable | Level 2, plus Markdown negotiation. |
| 4 | Agent-Integrated | Level 3, plus at least one of: MCP Server Card, A2A Agent Card, Agent Skills, API Catalog. |
| 5 | Agent-Native | Level 4, plus at least two of: Web Bot Auth; all four of the level 4 integrations; auth metadata (OAuth discovery, OAuth Protected Resource or auth.md). |
The report shows exactly which checks stand between you and the next level.
Score
The score, from 0 to 100, says how far along the whole ladder you are. Unlike the level, it also counts checks that no level requires, such as llms.txt, WebMCP, the ARD manifest and DNS for AI Discovery.
- A pass earns the check's weight. A fail earns nothing.
- Not applicable checks are left out entirely, so they never lower your score.
- Could not check results are also left out of the score, but they lower its coverage. When too little of your site could be checked, the score is marked provisional: it is based on what we could see, not a verdict on what we could not.
A site behind a strict firewall therefore gets a provisional score rather than a falsely low one. See Our scanner to let the audit through.
Weekly rescans and alerts
After your first audit, weekly scans are switched on, so your site is rescanned every week and the history shows how it changes over time. Turn them on or off with the Weekly scan switch at the top of the audit.
Weekly scans can also raise regression alerts: set up an alert under Alerts to hear when your level drops or a check that used to pass starts failing. That way a deploy that quietly removes your robots.txt rules or breaks your sitemap does not go unnoticed.
Competitor comparison
Add up to five competitor domains to see their level, score and check results next to yours. Competitors are scanned with the same checks and the same scanner as your own site.
Our scanner
The audit fetches your site with its own, clearly identified user agent:
Mozilla/5.0 (compatible; RezolveAi-AgentReadiness/1.0; +https://ace.authoritas.com/docs/guides/agent-readiness)What it does:
- Fetches a fixed set of public paths only. These are
/,/robots.txt, your sitemaps,/llms.txt,/llms-full.txt,/auth.md,/openapi.json,/api,/api/v1, and well-known files under/.well-known/such asapi-catalog,mcp/server-card.json,agent-card.json,oauth-authorization-serverandoauth-protected-resource. It does not crawl your site or follow links beyond these. - Looks up DNS over HTTPS for your
_agentsrecords. - Loads your homepage once in a headless browser to detect WebMCP tools.
- Never submits forms, never signs in, and never calls any tool or API it discovers. It only reads what is publicly served.
- Caps the number of requests per scan, so an audit is a small, short burst of traffic.
When a firewall blocks the scanner
If your firewall or bot protection blocks the scanner on your own site, the audit may retry the blocked request through a residential proxy so the rest of the report can still be completed. The block is still reported. Real AI agents are blocked the same way, so a firewall that stops our scanner is very likely stopping the agents you want to reach you. Checks that still cannot be completed show as could not check and lower the score's coverage.
Allowlist the scanner in Cloudflare
If your site is behind Cloudflare, add a custom rule that lets the scanner skip bot protection:
- In the Cloudflare dashboard, open your domain and go to Security rules.
- Select Create rule, then Custom rules.
- Set the expression to match the scanner's user agent, for example: Field
User Agent, Operatorcontains, ValueRezolveAi-AgentReadiness. - Set the action to Skip, and choose the protections to skip: Super Bot Fight Mode, and any other WAF features that were blocking the request.
- Deploy the rule and run the audit again.
Bot Fight Mode (as opposed to Super Bot Fight Mode) does not support skip rules. If it is blocking the scanner, the options are to turn Bot Fight Mode off or to move to a plan with Super Bot Fight Mode.
To confirm which Cloudflare feature blocked a request, open Analytics for your domain in the Security section, select the Events tab, find the request, and check its Service field.
Allowlist the scanner in other firewalls
Most web application firewalls and bot management tools support an allow or bypass rule based on the request's user agent. Create a rule that matches requests whose User-Agent header contains RezolveAi-AgentReadiness and exempts them from bot challenges, JavaScript challenges and rate limits. The scanner only reads the paths listed above, so you can scope the rule to those paths if your firewall supports it.
If you would rather not allowlist the scanner, the audit still runs: blocked checks are marked could not check, and the report tells you which ones.