See what AI agents can discover, understand and access.

Can AI systems find and access the information you want them to see?

• Your site loads for AI systemsThe homepage returns a successful (2xx-3xx) HTTP response.Maturity: CORE
• You have a crawl policy/robots.txt returns a successful HTTP response.Maturity: CORE
• Your site isn't hidden from every crawlerrobots.txt does not contain a blanket Disallow: / for User-agent: *.Maturity: CORE
• AI crawlers specifically aren't blockedrobots.txt does not disallow any of the named AI crawlers this check recognizes (GPTBot, ClaudeBot, Google-Extended, CCBot, PerplexityBot, Amazonbot, Applebot-Extended).Maturity: CORE
• Your site doesn't bounce crawlers aroundThe homepage URL resolves in a small number of redirect hops to a single stable final host, with no redirect loop.Maturity: CORE
• You publish a sitemap/sitemap.xml (or the Sitemap: URL declared in robots.txt) returns a successful response.Maturity: CORE
• Your sitemap is well-formedThe fetched sitemap parses as well-formed XML matching the sitemap namespace, with at least one <url> entry.Maturity: CORE
• Indexing restrictions are shown, not hiddenRecords any noindex, nofollow, nosnippet, or X-Robots-Tag directive found on the homepage, and whether it blocks AI-search visibility.Maturity: CORE
• Bot protection isn't blocking AI crawlers tooThe homepage response is not a bot-challenge/interstitial page (e.g. a JS-challenge or CAPTCHA wall) to a plain, well-identified HTTP request.Maturity: CONDITIONAL
• Your key content is readable without running JavaScriptCompares statically-fetched homepage content against a headless-render pass (where available); flags when meaningful content only appears after JS execution.Maturity: CORE
• Explicit AI-training opt-out (if set)Records whether a non-standard meta directive such as noai/noimageai is present. Informational only (scoring_weight 0): it moves no score in either direction, since this is not an established standard.Maturity: EMERGING_INFORMATIONAL

Can machines reliably read and interpret the important content on your site?

• You publish an llms.txt summary/llms.txt is fetchable and looks like the llms.txt convention (Markdown with at least one heading).Maturity: EMERGING_INFORMATIONAL
• You publish an expanded llms-full.txt/llms-full.txt is fetchable and non-trivial in length.Maturity: EMERGING_INFORMATIONAL
• You offer a Markdown version of your pagesRequesting the homepage with Accept: text/markdown returns Markdown, or an /index.md fallback exists.Maturity: EMERGING_INFORMATIONAL
• Your homepage has a clear titleThe homepage's <title> element is at least 10 characters long.Maturity: CORE
• Your homepage has a summary descriptionA meta or og:description tag with non-empty content is present.Maturity: CORE
• Your preferred page URL is declaredThe homepage declares a <link rel="canonical"> pointing to an absolute URL.Maturity: CONDITIONAL
• Your site has machine-readable structured dataAt least one schema.org @type is present in a JSON-LD block on the homepage (including client-rendered content where a render fallback succeeded).Maturity: CORE
• Your structured data matches your business typeWhere an entity/commercial schema type is present, checks it against an expected type family (e.g. LocalBusiness for a storefront, Organization generically) rather than crediting any JSON-LD at all.Maturity: CONDITIONAL
• Your offerings are marked up in structured dataJSON-LD includes at least one of Service, Product, Offer, or FAQPage.Maturity: CONDITIONAL
• Your structured data matches what's on the pageWhere both JSON-LD and visible text state a comparable fact (e.g. a price), checks they do not directly contradict each other.Maturity: CONDITIONAL
• Your site isn't creating duplicate-content confusionFlags when sampled pages appear to duplicate the homepage content without a canonical tag resolving the ambiguity.Maturity: CONDITIONAL
• Time-sensitive content shows a dateWhere a datePublished/dateModified schema field or a visible last-updated date is expected (e.g. pricing, offers), checks one is present.Maturity: CONDITIONAL
• You show at least one emerging AI-agent conventionDetects any publicly linked llms.txt, OpenAPI spec, or MCP-manifest-looking resource as a bundle of emerging-convention signals. Informational only (scoring_weight 0) as of 2.2.0: a count of conventions is not readiness, so presence adds nothing and absence costs nothing. The individual checks (llms.txt, OpenAPI, MCP) remain.Maturity: EMERGING_INFORMATIONAL

Can AI correctly explain what your business offers and answer the questions customers actually ask?

• You have enough real content to be quotedThe homepage's visible text is at least 150 words (partial credit at 50+).Maturity: CORE
• It's clear who you areThe homepage has a non-empty <title>. This checks only for a page-title identity signal, not a verified business-registry identity.Maturity: CORE
• Your business identity is machine-readableJSON-LD includes an Organization, LocalBusiness, Corporation, Person, or ProfessionalService type.Maturity: CONDITIONAL
• Customers (and AI) can see how to reach youThe homepage's text or links contain a contact/email/phone/address signal word.Maturity: CORE
• You show proof and policy informationThe homepage's text contains about/privacy/terms/testimonial/case-study/review language.Maturity: CONDITIONAL
• AI can find answers to the questions buyers actually askFor each applicable buyer question (what/who/where/cost/how-to-buy/terms/cancellation/contact/differentiation), checks whether retrieved page content contains extractable supporting text, and records the answer, evidence URL, and confidence. Never fabricates an answer when no supporting text was found. This measures whether information is present, clear, and extractable — it is not a live test of whether an AI answer engine actually answers correctly; that is assessed separately during managed paid fulfilment.Maturity: CORE

Does your business appear when customers use AI to research and compare providers?

• Do AI systems mention and recommend you?Benchmarks realistic non-branded buyer-intent prompts for this business's category against major AI answer engines (ChatGPT/OpenAI, Gemini, Claude, Grok, Perplexity where appropriate), recording brand mention rate, citation rate, prominence, category recommendation presence, and competitor share of voice. Performed manually by Hoshiro during paid-report fulfilment for this launch phase — not scanner-automated. Scored Not verified until a ManualAuditFinding is recorded for the audit.Maturity: CONDITIONAL

Does your site expose reliable ways for AI agents to use its functions instead of guessing through the UI?

• There's a working way to reach youThe homepage contains an HTML <form>, or /contact returns a successful HTTP response.Maturity: CORE
• Your API is documented in a machine-readable wayA probed OpenAPI/Swagger document is served and actually parses as a valid OpenAPI/Swagger document (not merely a 200 response from an SPA catch-all). NOT APPLICABLE when no API surface is indicated by independent evidence; NOT VERIFIED when a developer/API surface is indicated (e.g. a link to API docs) but no machine-readable description was found at the probed locations.Maturity: CONDITIONAL
• Your APIs are listed in a standard catalog/.well-known/api-catalog is fetchable and parses per RFC 9727.Maturity: EMERGING_INFORMATIONAL
• AI agents can discover your MCP toolsA documented/well-known MCP endpoint or server manifest is publicly discoverable and its manifest parses as valid JSON with the expected MCP shape. This checks discoverability only — a real MCP handshake and tool-quality review is performed manually during paid fulfilment and recorded separately, never assumed from descriptor presence alone.Maturity: CONDITIONAL
• Your MCP server actually worksA real MCP connection is attempted (initialize + tools/list JSON-RPC over the Streamable HTTP transport) against the referenced manifest's endpoint, and returned tool names/descriptions/input schemas are checked for clarity and non-overlap. No tool is ever invoked. Scanner-executed as of methodology 2.1.0 whenever a manifest reference exists; Not verified only when no manifest reference was discoverable at all (see mcp_descriptor_discoverable).Maturity: CONDITIONAL
• Your agent skills are published correctlyWhere an Agent Skills manifest is published at its documented location, checks it parses and includes usable capability descriptions.Maturity: EMERGING_INFORMATIONAL
• Your agent-to-agent identity card is correct/.well-known/agent-card.json is fetchable and validates against the expected A2A shape (identity, endpoints, skills, security metadata). Only applicable where an agent-to-agent service surface exists; absent for an ordinary business site, this is Not applicable, never a failure.Maturity: EMERGING_INFORMATIONAL
• Your agent-to-agent service actually responds correctlyWhere a valid agent card's `url` is present, a real A2A `message/send` task exchange is attempted with a short, generic capability-discovery message (never a transactional one). Scanner-executed as of methodology 2.1.0; Not verified only when no agent card with a usable endpoint URL was found.Maturity: EMERGING_INFORMATIONAL
• Your in-page AI tools actually workWhere WebMCP tool registration is detected on the page, real tool registration, naming, schema usability, and a safe task execution are verified manually during paid fulfilment. Scored Not verified until a ManualAuditFinding is recorded.Maturity: EMERGING_INFORMATIONAL
• Your transaction API is documentedSame OpenAPI/API-docs signal as openapi_documentation_valid, presented as a transaction-readiness signal. Evaluated only where the business intends agent-executed transactions (declared policy) or already publishes an interface; a commerce site with no declared intent is NOT VERIFIED and one that declared agents must not transact is NOT APPLICABLE. Having a transaction API is never assumed to be the goal.Maturity: CONDITIONAL

Can legitimate agents identify themselves and securely access the capabilities they are authorised to use?

• Delegated agent access is discoverable/.well-known/oauth-authorization-server is fetchable and validates per RFC 8414. Whether it is expected is decided from the business surface and declared agent policy, not from the file's presence: NOT APPLICABLE when the established surface is public/enquiry-only or the business declared agents may not act; NOT VERIFIED when the surface or intent cannot be established; evaluated when an authenticated/agent-facing surface or declared agent intent exists.Maturity: EMERGING_INFORMATIONAL
• Protected agent resources are discoverable/.well-known/oauth-protected-resource is fetchable and validates per RFC 9728. Applicability follows the business surface and declared intent (see oauth_authorization_server_metadata). A FAIL requires proof: an agent-facing endpoint that demonstrably answered HTTP 401 while advertising no discovery path.Maturity: EMERGING_INFORMATIONAL
• Agent sign-in actually works as documentedWhere OAuth/agent-login metadata is published, a real authenticated flow (PKCE S256 support, usable scopes, agreement between advertised metadata and the actual protected service) is verified manually during paid fulfilment. Never attempted automatically without credentials.Maturity: CONDITIONAL
• What an AI agent may do on your behalf is discoverableWhere an agent-facing or consequential surface exists, checks whether anything machine-readable states what an agent may do and where its authority ends: OAuth scopes, MCP tool read-only/destructive annotations, an agent-card security requirement. It does not reward having a protocol -- an interface that publishes no limits is NEEDS ATTENTION, a business that declared agents must not act is NOT APPLICABLE, and an unestablished surface is NOT VERIFIED.Maturity: CONDITIONAL
• Your controls stop agents doing what you don't want them to doCompares the business's declared agent policy with an independently observed agent attempt. A refusal is a PASS when the policy required it; a FAIL requires proof that a declared control was bypassed; a self-reported or unattributable result stays NOT VERIFIED. ARC Scan never attempts a consequential action, and operator-recorded control verification is outside the ARC Report product scope. Behaviour remains NOT VERIFIED without independent evidence and is never blended into the technical score.Maturity: CORE

Can an AI agent progress toward a real business outcome such as an enquiry, booking, signup or purchase?

• It's obvious what to do nextThe homepage's text or links contain contact/book/buy/order/quote/signup/schedule language.Maturity: CORE
• Pricing or offer information is visibleThe homepage's text contains 'pricing', 'price', or 'offer' language.Maturity: CONDITIONAL
• Emerging agent-payment protocols (if relevant)Detects publicly documented support for x402, Universal Commerce Protocol, Agentic Commerce Protocol, AP2, or Machine Payments Protocol. Informational only (scoring_weight 0): it moves no score in either direction -- support for a payment protocol is evidence of a channel, not of readiness.Maturity: EMERGING_INFORMATIONAL
• An AI agent can actually complete your primary actionA safe, non-destructive attempt to progress through the site's actual primary conversion action (enquiry/booking/signup/purchase) as an agent would, capturing where the task succeeds or breaks. Performed manually during paid fulfilment; never submits a destructive or chargeable action during an ordinary scan.Maturity: CORE