> ## Documentation Index
> Fetch the complete documentation index at: https://agentrail.co/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Agent readiness

> Scan your public website, documentation and API to see whether AI agents can find, get into, read and use them, and what to fix when they can't.

Agent readiness scans your public website, and any documentation and application addresses you add, the way AI agents meet them. Each finished scan gets a score from 0 to 100, a grade, and a list of every check it ran, with the evidence behind each result and the steps to fix what failed.

## What it's for

* **Finding what stops agents.** A scan shows where an agent can't find your site, gets blocked, can't read a page or can't use your API.
* **Fixing it.** Every check explains what it looked at and how to fix it. You can copy a fix prompt for the findings you pick and hand it to the coding agent that works on your site.
* **Tracking progress.** Scans run again on a schedule, and you can compare any two finished scans to see what changed.

Open **Agent readiness** in the sidebar. The page shows your **Latest score**, the **Active scan** and the **History** of every scan.

## What a scan covers

Every scan covers your workspace's **Website**, the one you gave in [Setup](/docs/guides/setup). An Admin can add documentation and application addresses in **Settings**; each is scanned together with the website.

A scan looks at four layers:

| Layer | The question it answers |
| - | - |
| **Discovery** | Can agents find you: in search, in agent catalogs and registries, and through your `robots.txt`? |
| **Access** | Can agents get into and read your pages: sitemaps, `llms.txt`, Markdown copies, structured data and pages that load without JavaScript? |
| **Usability** | Can agents use your product: your MCP server, your API, sign-in for agents, and pages they can operate? |
| **Payments** | Can agents pay you, through the agent payment protocols? |

Every check in each layer is listed in [The four layers and their checks](#the-four-layers-and-their-checks).

## Run a scan

<Steps>
  <Step title="Start the scan">
    On **Agent readiness**, select **Scan now**. You see **The scan is shown under Active scan.**
  </Step>

  <Step title="Follow it">
    **Active scan** shows its **State**: **Waiting**, then **Running**, then **Scoring**. Select **Open** to watch it from its own page.
  </Step>

  <Step title="Read the result">
    When it ends, the scan moves to **History**. A finished scan updates **Latest score**. Select **Open scan**, or select the scan's row in **History**.
  </Step>
</Steps>

A workspace runs one scan at a time. If a scan is already waiting, running or scoring, **Scan now** starts no new one and you see the active scan instead.

<Tip>
  After you fix something, select **Scan now** to check the fix right away instead of waiting for the next scheduled scan.
</Tip>

## Scan on a schedule

Your first scan starts when someone selects **Scan now** or an Admin saves the settings with readiness on. After that, a new scan starts on its own once the number of days in **Scan every** has passed since the last scan started. With nothing changed, readiness is on and scans every 7 days.

An Admin changes the schedule and the addresses on **Agent readiness settings**:

<Steps>
  <Step title="Open the settings">
    On **Agent readiness**, select **Settings**.
  </Step>

  <Step title="Choose what to scan and how often">
    * **Readiness**: **On** or **Off**. When it is off, no scan starts, by schedule or by hand.
    * **Scan every**: a whole number of days, 1 or more.
    * **Website**: your workspace's website. It is always scanned and is not entered again here.
    * **Documentation and application URLs**: select **Add URL**, choose **Docs** or **App**, and enter the address. Remove one with the cross at the end of its row.
  </Step>

  <Step title="Save">
    Select **Save**. You see **Settings saved**. Saving with readiness on starts a scan, unless one is already running.
  </Step>
</Steps>

Each added address must be a public `http` or `https` URL of at most 2,048 characters, with no user name, password, `#fragment` or credential in it. You can't list the same address twice, or add your website again.

Members can open **Settings** and read the same values, but only Admins can change them.

<Warning>
  When **Readiness** is off, **Scan now** is turned off too, and **Agent readiness** shows **Readiness is off for this workspace**.
</Warning>

## Read the overview

**Latest score** shows the score and grade of the latest finished scan, when it finished and **How started**. If a newer scan failed or was interrupted, the last finished score stays and the newer scan's cause shows under it.

**History** lists every scan, newest first:

| Column | What it shows |
| - | - |
| **Started** | How long ago the scan started. |
| **How started** | **Scheduled**, **Scan now** or **Settings saved**, with the email of the person who started it, if a person did. |
| **Ending** | **Finished**, **Failed**, **Interrupted** or **Sign-in required**, with the cause when it didn't finish. A scan still going shows its state. |
| **Score** | The score of a finished scan. |
| **Coverage** | **Covered its scope**, **Time budget ran out** or **Stopped**. |

**Sign-in required** means the address scanned asked for sign-in before it answered, so nothing could be read. **Time budget ran out** means the scan stopped before it read everything it found; its results cover what it read.

## Read a scan

A scan's page is titled **Scan of** and the time it started. At the top it shows its **State**, **How started**, **Coverage**, how long it **Took** and the addresses **Scanned**. A scan that hasn't ended says so; its score and findings appear once it finishes. Only a finished scan has a score.

### Score and grade

The score is a whole number out of 100. The grade names it:

| Grade | Name |
| - | - |
| **A+** | Leading |
| **A** | Agent-Ready |
| **B** | Competitive |
| **C** | Needs Work |
| **D** | At Risk |
| **F** | Unusable |

Under the score you find:

* **Summary**: one line on the result, when one is available.
* **Layers**: each layer's points out of what it can add to the score, or **N/A** when nothing in that layer counted, such as **Payments** for a product you don't sell.
* **Pages**: how many pages the scan captured, and how many it read completely.
* **Left out of the score**: the checks that were **Not applicable** and those it **Couldn't check**, each with its reason.

### Checks

**Checks** lists every check, layer by layer. Each row shows the check's **Tier**, its **Result** and its **Points**.

| Result | What it means |
| - | - |
| **Passed** | The check found what it looks for. It earns its full points. |
| **Warning** | Partly there. It earns part of its points. |
| **Failed** | Missing or broken. It earns nothing. |
| **Not applicable** | The check doesn't apply to your site, for example a pricing check when you sell nothing. It is left out of the score. |
| **Couldn't check** | The scan couldn't decide. It is left out of the score. |

The **Tier** is **Required**, **Recommended** or **Emerging**. Some checks also carry a badge:

* **Emerging** and **Beta** checks run and show, but never count. Their **Points** read **Not counted**.
* A **Bonus** check adds what it earns and never lowers the score.

A check that counts and fell short shows how many points the score would gain if it passed, such as **+2 points if fixed**. Start with the biggest gains.

Open a check with the arrow at the start of its row to see:

* what it found on your site;
* **What we checked**;
* **How to fix**: the steps, what to watch out for, and a **Reference** link to the standard it follows;
* **Findings**: each thing it checked, with its result.

**Other checks**, below the checks, holds checks from before the current scoring method. They still run on every scan and show their findings, but never count toward the score.

### Findings and evidence

A finding is one result of one check, usually for one address. Findings tables show the **Check**, the **URL**, the **Result**, a **Reason** code and the check's **Points**.

Under **Other checks**, **Show findings** filters by result: **Failed**, **Couldn't check**, **Not applicable**, **Passed** or **All**. It opens on **Failed**, and the filter you pick stays in the page's address, so you can share a view of one result.

Open a finding to see:

* **Parts**: each part of the check, with its own result and reason;
* **How to fix**: the check's fix steps;
* **Evidence**: one button per piece of evidence the finding rests on.

Select an **Evidence** button to open what the scan requested and what came back: the address requested and where it **Landed on**, the response **Status**, the **Headers** and the **Body** as it was kept, shown as text.

## Copy a fix prompt

A fix prompt gathers the findings you pick, their evidence and the fix steps into one prompt for a coding agent.

<Steps>
  <Step title="Pick findings">
    On a finished scan, tick the findings you want fixed. Tick the box in a table's header to pick every finding it shows. You can pick findings from any check, in **Checks** and in **Other checks**.
  </Step>

  <Step title="Copy the prompt">
    The bar at the foot of the page shows how many are selected. Select **Copy fix prompt**. You see **Fix prompt copied**.
  </Step>

  <Step title="Hand it to your coding agent">
    Paste the prompt into the coding agent that works on your site, and review its changes as you would any other.
  </Step>
</Steps>

The prompt is built from what the scan recorded. Copying it doesn't scan your site again. To clear what you picked, select the cross at the end of the bar.

## See what the scan found

On a finished scan, select **Resource map**. It lists the pages the scan found, whether each was **Fetched**, and how many **Links** it has. Open a page to see what it links to; each link is marked **Link**, **Sitemap** or **Reference**.

If the scan didn't reach or read everything it found, the map says so, and pages or links may be missing.

## Compare two scans

<Steps>
  <Step title="Pick two finished scans">
    In **History**, tick two finished scans.
  </Step>

  <Step title="Open the comparison">
    Select **Compare selected (2)**.
  </Step>

  <Step title="Read what changed">
    **Compare scans** shows the **Earlier score** and the **Later score**, then **Checks that changed**, with each check's result and points in both scans.
  </Step>
</Steps>

Below, **Findings** sorts every finding into four tabs:

* **Appeared**: in the later scan only.
* **Disappeared**: in the earlier scan only, often because you fixed it.
* **Changed**: in both, with a different result.
* **Not compared**: the check's logic changed between the scans, so its results are not compared.

Select **Open earlier scan** or **Open later scan** to go to either scan.

<Note>
  If the two scans were given different websites, the comparison warns that their findings may not line up. If they were scored by different methods, their scores and checks don't compare, and only the findings of the checks both scans ran are compared.
</Note>

## Delete a scan

An Admin can delete a scan that has ended. Open it, select **Delete scan**, then confirm with **Delete scan**. You see **Scan deleted**.

A deleted scan disappears from every view, comparison and fix prompt. It still counts as the last scan when deciding whether the next scheduled one is due.

## The four layers and their checks

Not every check applies to every site. A check about your API applies only if you have an API, a payment check only if you sell something, and an MCP check only if you have an MCP server. A check that doesn't apply shows **Not applicable** and is left out of the score. When the scan can't tell whether a check applies, it shows **Couldn't check**.

Checks in the **Emerging** tier, and the one **Beta** check, run and show but never count toward the score. Checks marked **Bonus** add what they earn and never lower the score.

### Discovery

Whether agents can find you.

<AccordionGroup>
  <Accordion title="Agent catalogs">
    | Check | Tier | What it looks for |
    | - | - | - |
    | **ARD discovery** | Required | An Agentic Resource Discovery catalog at `/.well-known/ard.json`, or its older address `/.well-known/ai-catalog.json`. |
    | **AI Catalog discovery** · Bonus | Recommended | An AI catalog your site publishes for agents, at its well-known address or linked from your pages. |
    | **ARD entry validity** · Bonus | Recommended | Each catalog entry has an identifier, a display name, a media type and a target that answers. |
    | **ARD trust manifest** · Bonus | Recommended | A trust manifest that ties the catalog to your site, such as a `did:web` identity for your own host. |
  </Accordion>

  <Accordion title="Search and reference sites">
    | Check | Tier | What it looks for |
    | - | - | - |
    | **Brand name discoverability** | Required | A search for your company's name leads to your own site. |
    | **Developer resource discoverability** | Recommended | Searches for your developer resources (API reference, SDKs, docs) bring up your own pages. Only if you serve developers. |
    | **Category share of voice** · Beta | Recommended | How often your company is named when buyers in your category search. Never counts. |
    | **Wikipedia / Wikidata entity presence** · Bonus | Recommended | Your company has an entry on Wikipedia and Wikidata. |
  </Accordion>

  <Accordion title="Crawler rules">
    | Check | Tier | What it looks for |
    | - | - | - |
    | **robots.txt AI crawler policy** | Required | What your `robots.txt` allows AI training and search crawlers on the pages the scan read. |
  </Accordion>

  <Accordion title="Registries and directories">
    | Check | Tier | What it looks for |
    | - | - | - |
    | **Listed in MCP registries** | Recommended | Your MCP server is listed in the public MCP registries. Only if you have an MCP server. |
    | **NPM/PyPI SDK package** | Recommended | Your SDK package on npm and PyPI. Only if you serve developers. |
    | **ChatGPT app listed** · Bonus | Recommended | Your company in the ChatGPT app directory. |
    | **Agent platform configs** | Emerging | Agent configuration files, such as `AGENTS.md`, in your public code repositories. |
    | **Agent Plugins manifest** · Bonus | Emerging | An agent plugin manifest in your public code repositories. |
    | **Registry branding** | Emerging | A display name, an icon and a description in your MCP server card at `/.well-known/mcp/server-card.json`. Only if you have an MCP server. |
  </Accordion>
</AccordionGroup>

### Access

Whether agents can get into your pages and read them.

<AccordionGroup>
  <Accordion title="Reaching your pages">
    | Check | Tier | What it looks for |
    | - | - | - |
    | **Sitemap exists** | Required | A sitemap, named in `robots.txt` or at `/sitemap.xml`, that lists your pages. |
    | **Sitemap freshness (lastmod)** · Bonus | Recommended | `lastmod` dates in your sitemap that are present and recent. |
    | **Content without JavaScript** | Required | Readable text and headings on your entry page without running JavaScript. |
    | **Not blocked by bot detection** | Required | AI agents that ask for your entry page don't get a block or challenge page. |
    | **Agent crawler reachability** | Recommended | Your entry page answers AI agents the way it answers a regular visitor. |
    | **robots.txt agent-user policy** | Required | What your `robots.txt` allows, on your entry page, the agents that fetch a page because a person asked them to. |
    | **HTTP Link headers (RFC 8288)** · Bonus | Required | HTTP `Link` headers on your entry page that point to your sitemap, API catalog or docs. |
    | **Redirect hygiene** | Recommended | Pages that reach their content without meta-refresh stubs, script-only redirects or hops to another site. |
    | **Content behind auth** | Recommended | Documentation that can be read without signing in. |
  </Accordion>

  <Accordion title="llms.txt and files for agents">
    | Check | Tier | What it looks for |
    | - | - | - |
    | **Agent discovery file** | Required | A file that tells agents what your site offers, such as `llms.txt` or an agent manifest. |
    | **llms.txt exists** | Required | An `/llms.txt` file. |
    | **llms.txt formatting** | Recommended | An `/llms.txt` that follows the llms.txt format: a title, a summary and sections of links. |
    | **llms.txt links resolve** | Recommended | Links in `/llms.txt` that answer. |
    | **Agent instruction / when-to-use** | Required | Guidance written for agents on when to use your product, in `llms.txt` or an agent skills file. |
    | **A2A / agent-card** · Bonus | Recommended | An A2A agent card at `/.well-known/agent-card.json` with its required fields. |
    | **MCP well-known discovery** · Bonus | Recommended | Your MCP server at its well-known discovery address. |
    | **API catalog (RFC 9727)** · Bonus | Required | An RFC 9727 linkset at `/.well-known/api-catalog` that lists your APIs. |
    | **Modular llms.txt per product area** · Bonus | Emerging | A separate `llms.txt` for each product area. |
    | **Agent Skills index conformance (v0.2.0)** · Bonus | Emerging | A `/.well-known/agent-skills/index.json` that follows the Agent Skills index format (v0.2.0). |
    | **Listed on skills.sh** | Emerging | Your company on skills.sh. |
    | **Skills.sh skill quality** | Emerging | The descriptions and contents of your skills.sh listings. |
    | **NLWeb Schema Feeds** | Emerging | A `schemamap` line in `robots.txt` that points agents at structured data feeds. |
  </Accordion>

  <Accordion title="Markdown and page size">
    | Check | Tier | What it looks for |
    | - | - | - |
    | **Page token budget** | Recommended | Readable text on each page that fits what an agent can take in at once (about 25,000 tokens). |
    | **Markdown content negotiation (acceptmarkdown.com)** · Bonus | Recommended | A page served as Markdown on request that says so in its `Vary` header. |
    | **Markdown agent docs** | Emerging | Your entry page as Markdown when asked for it (`Accept: text/markdown`). |
    | **Markdown URL fallback** · Bonus | Emerging | A `.md` copy of the pages the scan read. |
    | **Markdown alternate link** · Bonus | Emerging | A link from your pages to a Markdown copy (`rel="alternate" type="text/markdown"`). |
    | **Markdown frontmatter metadata** | Emerging | A frontmatter block with a title and description in the Markdown you serve. |
    | **Code fence validity** | Emerging | Every code block closed in the Markdown you serve. |
    | **Bot-UA markdown serving** · Bonus | Emerging | Your entry page served as Markdown to AI agents. |
    | **Agent mode view** · Bonus | Emerging | Your entry page in agent mode (`?mode=agent`), compared with the normal page. |
  </Accordion>

  <Accordion title="Structured data and metadata">
    | Check | Tier | What it looks for |
    | - | - | - |
    | **JSON-LD structured data** | Required | JSON-LD on your pages that parses and names schema.org types. |
    | **Metadata completeness** | Required | Your entry page's canonical URL, language, and Open Graph image and type. |
    | **Trust anchor pages** | Required | About, contact and privacy pages. |
    | **JSON-LD entity linking (sameAs)** | Recommended | `sameAs` links from your JSON-LD Organization to your company's profiles elsewhere. |
    | **Organization schema completeness** | Recommended | A name, URL, logo and description in your JSON-LD Organization. |
    | **Schema type breadth** | Recommended | How many different schema.org types your pages publish. |
  </Accordion>

  <Accordion title="Pricing and developer resources">
    | Check | Tier | What it looks for |
    | - | - | - |
    | **Pricing info accessible** | Required | A pricing page, or prices, an agent can reach and read. Only if you sell something. |
    | **Public API/docs linked from homepage** | Required | A link from your entry page to your API reference or developer docs. Only if you serve developers. |
    | **OpenAPI spec published** | Required | Your API's OpenAPI description, at its usual addresses or linked from your site. Only if you have an API. |
    | **Developer portal** | Recommended | A developer portal: API reference, guides and a way to get keys. Only if you serve developers. |
    | **pricing.md exists** | Emerging | A `/pricing.md`, a plain Markdown copy of your prices. Only if you sell something. |
  </Accordion>
</AccordionGroup>

### Usability

Whether agents can use your product once they are in.

<AccordionGroup>
  <Accordion title="MCP server">
    Except for **MCP server / manifest** and **Product + docs MCP coverage**, these checks apply only if you have an MCP server.

    | Check | Tier | What it looks for |
    | - | - | - |
    | **MCP server / manifest** | Required | An MCP server or manifest for your product. Only if you have an API or an MCP server. |
    | **MCP tool listing** · Bonus | Recommended | Your MCP server lists its tools when asked. |
    | **MCP tool descriptions** · Bonus | Recommended | A description on each tool that an agent can choose by. |
    | **MCP parameter schemas** · Bonus | Recommended | Typed, described parameters in each tool's input schema. |
    | **MCP tool naming** · Bonus | Recommended | Tool names that are consistent and say what each tool does. |
    | **MCP tool annotations** · Bonus | Recommended | Tool annotations, such as read-only and destructive. |
    | **MCP server identity** · Bonus | Recommended | The name, version and instructions your server gives when an agent connects. |
    | **MCP server-card.json** · Bonus | Recommended | A server card for your MCP server. |
    | **MCP error handling** · Bonus | Recommended | A proper error in answer to one malformed request. |
    | **MCP modern transport** · Bonus | Recommended | Support for the streamable HTTP transport. |
    | **MCP auth mechanism** · Bonus | Recommended | How your server asks for sign-in, from its answers and its public metadata. |
    | **MCP OAuth metadata** · Bonus | Recommended | Your server's OAuth metadata. |
    | **MCP PKCE S256 support** · Bonus | Recommended | PKCE with S256 in your server's sign-in metadata. |
    | **MCP resources exposed** | Recommended | Your MCP server lists its resources when asked. |
    | **MCP resource quality** | Recommended | What a few of your server's resources hold. |
    | **Product + docs MCP coverage** · Bonus | Recommended | MCP that covers both your product and its documentation. |
  </Accordion>

  <Accordion title="MCP Apps and pages agents operate">
    | Check | Tier | What it looks for |
    | - | - | - |
    | **WebMCP support** | Required | WebMCP tools exposed by your pages. |
    | **MCP Apps support** | Recommended | MCP App interfaces offered by your MCP server. Only if you have an MCP App. |
    | **MCP Apps UI quality** · Bonus | Recommended | The fields the format asks for in your MCP App interfaces. Only if you have an MCP App. |
    | **MCP App view reachable** | Recommended | Your MCP App's view page answers. Only if you have an MCP App. |
    | **MCP App view CSP** | Recommended | The `Content-Security-Policy` header of your MCP App's view page. Only if you have an MCP App. |
    | **Agent-friendly 404s** | Recommended | An address that doesn't exist returns a 404 an agent can read. |
    | **Accessible document structure** · Bonus | Recommended | A main region, landmarks and headings in order on your pages. |
    | **Native interactive controls** · Bonus | Recommended | Controls that are native buttons, links and inputs. |
    | **Accessible names on controls** · Bonus | Recommended | A name an agent can read on every control. |
    | **Form control labeling** · Bonus | Recommended | A label on every form field. |
    | **Accessibility-tree injection safety (bonus)** · Bonus | Recommended | No hidden text aimed at agents in your pages' accessibility tree. |
    | **A2UI / generative UI support** | Emerging | Generative UI support (A2UI) for agents. |
  </Accordion>

  <Accordion title="Sign-in and getting started">
    | Check | Tier | What it looks for |
    | - | - | - |
    | **OAuth 2.0 support** | Required | OAuth 2.0 in your API's description and sign-in metadata. Only if you have an API. |
    | **OAuth Protected Resource metadata (RFC 9728)** · Bonus | Required | OAuth protected resource metadata (RFC 9728). |
    | **auth.md exists** · Bonus | Required | An `/auth.md` that tells agents how to sign in. |
    | **Scoped permissions** | Recommended | Scopes that limit what a token may do, in your API's description and sign-in metadata. Only if you have an API. |
    | **auth.md structure** · Bonus | Recommended | The sections the format asks for in `/auth.md`. |
    | **auth.md walkthrough simulation** · Bonus | Recommended | `/auth.md`'s steps, followed as far as they go without credentials. |
    | **Agent auth discovery metadata** · Bonus | Recommended | An `agent_auth` block in your protected resource and authorization server metadata that matches `/auth.md`. |
    | **Agent auth WWW-Authenticate hint** · Bonus | Recommended | A refused request that names where the sign-in metadata is, in its `WWW-Authenticate` header. |
    | **agent\_auth endpoints reachable** · Bonus | Recommended | The sign-in endpoints named in the `agent_auth` metadata answer. |
    | **Agent onboarding friction** | Recommended | Developer docs that show how an agent gets started: sign-up, keys and a first call. Only if you have an API. |
    | **Sandbox / test environment** · Bonus | Recommended | A sandbox or test mode in your developer docs. |
    | **Web Bot Auth directory** · Bonus | Emerging | A Web Bot Auth key directory at `/.well-known/http-message-signatures-directory`. |
  </Accordion>

  <Accordion title="Your API">
    | Check | Tier | What it looks for |
    | - | - | - |
    | **Public API with reachable endpoints** | Required | Your API's public endpoints answer without credentials. Only if you have an API. |
    | **JSON error responses** | Required | Errors that come back as JSON when your API is called without credentials. Only if you have an API. |
    | **Rate limit response headers** | Recommended | Rate-limit headers on your API's answers. Only if you have an API. |
    | **Idempotency-Key support** | Recommended | An `Idempotency-Key` header on writes, in your API's description. Only if you have an API. |
    | **API schema complexity analysis** | Recommended | How complex your API's schemas are for an agent to fill in. Only if you have an API. |
    | **Function calling compatibility** | Recommended | API operations that can be turned into function-calling tools. Only if you have an API. |
    | **REST typed error model** | Recommended | One typed error format in your REST API's description. Only if you have a REST API. |
    | **REST versioning / deprecation policy** | Recommended | A versioning and deprecation policy in your REST API's description. Only if you have a REST API. |
    | **REST pagination pattern** | Recommended | One consistent pagination pattern in your REST API's OpenAPI description. Only if you have a REST API with an OpenAPI description. |
    | **REST async-job pattern** | Recommended | Long-running jobs an agent can poll, in your REST API's description. Only if you have a REST API. |
    | **REST response schema coverage** | Recommended | A schema on each response in your REST API's OpenAPI description. Only if you have a REST API with an OpenAPI description. |
    | **REST batch / bulk endpoint** · Bonus | Recommended | Batch or bulk endpoints in your REST API's description. Only if you have a REST API. |
  </Accordion>

  <Accordion title="GraphQL">
    These checks apply only if you have a GraphQL API. Each reads your GraphQL schema.

    | Check | Tier | What it looks for |
    | - | - | - |
    | **GraphQL typed error model** | Recommended | Typed errors in the results. |
    | **GraphQL versioning / deprecation policy** | Recommended | Deprecations and a versioning policy. |
    | **GraphQL pagination pattern** | Recommended | One consistent pagination pattern. |
    | **GraphQL async-job pattern** | Recommended | Long-running jobs an agent can poll. |
    | **GraphQL schema description coverage** · Bonus | Recommended | How many types and fields have descriptions. |
    | **GraphQL batch mutations** · Bonus | Recommended | Mutations that act on many items at once. |
  </Accordion>

  <Accordion title="Tools and SDKs">
    | Check | Tier | What it looks for |
    | - | - | - |
    | **CLI tool available** | Recommended | A command-line tool among your npm packages, or one your `llms.txt` mentions. Only if you serve developers. |
    | **Multi-language SDK packages** | Recommended | Your SDKs in several languages' package registries. Only if you serve developers. |
    | **NLWeb /ask endpoint** | Emerging | An answer to one question from your NLWeb `/ask` endpoint. |
    | **NLWeb streaming support** | Emerging | A streamed answer from your NLWeb `/ask` endpoint. |
  </Accordion>
</AccordionGroup>

### Payments

Whether agents can pay you. These checks apply only if you sell something, and every one of them is a **Bonus** check.

<AccordionGroup>
  <Accordion title="Agent payment protocols">
    | Check | Tier | What it looks for |
    | - | - | - |
    | **MPP payment protocol** · Bonus | Required | The Machine Payments Protocol in your site's payment answers. |
    | **x402 payment protocol** · Bonus | Required | x402 payment answers: HTTP 402 with x402 terms. |
    | **UCP - Universal Commerce Protocol** · Bonus | Required | A Universal Commerce Protocol profile at `/.well-known/ucp`. |
    | **ACP - Agentic Commerce Protocol** · Bonus | Required | Agentic Commerce Protocol checkout endpoints that answer. The scan creates no checkout. |
    | **ACP delegate payment** · Bonus | Recommended | An Agentic Commerce Protocol delegate-payment endpoint that answers. The scan makes no payment. |
    | **AP2 - Agent Payments Protocol** · Bonus | Recommended | Agent Payments Protocol discovery. |
  </Accordion>
</AccordionGroup>

## Who can do what

| Action | Admin | Member |
| - | - | - |
| See the overview, scans, findings, evidence, resource maps and comparisons | Yes | Yes |
| Select **Scan now** | Yes | Yes |
| Copy a fix prompt | Yes | Yes |
| Read **Agent readiness settings** | Yes | Yes |
| Change **Agent readiness settings** | Yes | No |
| Delete a scan | Yes | No |

Roles are set per organization. See [People and roles](/docs/guides/people-and-roles).

## Limits

* One scan runs at a time in each workspace.
* Up to 20 documentation and application URLs, together, besides your website.
* **Scan every** takes a whole number of days, 1 or more.
* A scan has a time budget. When it runs out, **Coverage** shows **Time budget ran out** and the results cover what the scan read.
* Only finished scans have a score, a resource map, fix prompts and comparisons.
* Only an ended scan can be deleted, and a deleted scan still counts toward the schedule.

## Related

<CardGroup cols={2}>
  <Card title="Setup" href="/docs/guides/setup">
    Where your workspace's website comes from.
  </Card>

  <Card title="Feedback" href="/docs/guides/feedback">
    Let agents tell you where they got stuck on your product.
  </Card>

  <Card title="People and roles" href="/docs/guides/people-and-roles">
    Who is an Admin and who is a Member.
  </Card>

  <Card title="Concepts" href="/docs/concepts">
    The words Agentrail uses across the app.
  </Card>
</CardGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.