Open methodology · v1.1
The scan asks one question five ways: when an AI agent lands on your site, what happens? Can it find you, read you, understand you — and can it act? Every check is pass/fail, every weight is public, and the same engine scores every site. No black box.
Checks are aligned with the W3C WebMCP draft, Chrome's WebMCP guidance, and llmstxt.org — not invented in-house.
The formula
Each category scores 0–100 from the share of check weight passed. The final score is the weighted sum across categories:
score = 0.30 × capabilities + 0.20 × discoverability + 0.20 × content
+ 0.20 × comprehension + 0.10 × trust
Two analysis modes exist: static (raw HTML, script bundles, and
well-known files) and headless (a real rendered page, queried for
actually-registered document.modelContext tools). Every result page states which mode ran.
Can an agent act on your site — not just read it?
Reading is table stakes. The sites that win agentic traffic expose typed tools an agent can call directly instead of guessing at the UI. This is the heart of WebMCP, and the reason this category carries the most weight.
| Check | Weight | What it tests | How to pass |
|---|---|---|---|
| WebMCP tools registered | 45 | Tools registered via document.modelContext.registerTool() — detected in the rendered page (headless mode), page HTML, script bundles, or via platform-native support (e.g. Shopify storefronts). | Register at least one real tool wrapping a core site action: search, availability, pricing, booking. |
| Declarative form tools | 15 | Forms annotated with toolname / tooldescription / toolaction attributes — the zero-JavaScript path defined in the WebMCP draft. | Annotate key forms so agents can invoke them as structured tools. |
| MCP server card | 15 | Valid JSON at /.well-known/mcp/server-card.json advertising a backend MCP server. | If you run an MCP server, publish the card so agents can discover it. |
| Actionable HTML | 15 | Semantic forms with bound labels on the homepage — the fallback surface agents use when no tools exist. | Use real <form> elements with <label> bound to every input. |
| Chrome origin-trial token | 10 | A WebMCP origin-trial token served via meta tag or header (Chrome 149–156 gates the API behind the trial). | Register at developer.chrome.com/origintrials and serve the token on pages that register tools. |
Can agents and AI crawlers find you at all?
If AI crawlers are blocked or can’t enumerate your pages, agents can’t recommend you — they pick a competitor they can see.
| Check | Weight | What it tests | How to pass |
|---|---|---|---|
| AI crawlers allowed | 35 | robots.txt checked for blanket blocks on GPTBot, ClaudeBot, Claude-User, Google-Extended, and PerplexityBot. | Allow AI crawlers, or scope any Disallow rules to genuinely private paths. |
| robots.txt present | 25 | A robots.txt is served — the first file every agent requests. | Serve one, and reference your sitemap from it. |
| XML sitemap | 25 | A sitemap.xml exists or is referenced from robots.txt. | Publish a sitemap with lastmod dates. |
| Canonical URL | 15 | A rel="canonical" link tag on the homepage. | Add canonical tags so machines resolve one authoritative URL per page. |
Can an agent read your content without executing JavaScript?
Most crawlers and many agents never run your client-side JS. A JS-only page is a blank page to them.
| Check | Weight | What it tests | How to pass |
|---|---|---|---|
| llms.txt | 35 | A curated markdown map at /llms.txt telling LLMs what the site is and where key content lives (llmstxt.org). | Publish one: name, summary, links to key pages with one-line descriptions. |
| Content readable without JS | 35 | Substantive text (400+ chars) present in the raw HTML response. | Server-render or pre-render your primary content. |
| Semantic structure | 20 | A <main> or <article> landmark plus an <h1>. | Use landmarks and one clear h1 per page so machines can segment content. |
| llms-full.txt | 10 | The companion file with full flattened content for LLM ingestion. | Generate it at build time from your key pages. |
Does a machine understand what you are and what you offer?
Structured data is how agents build a correct model of your business — without it they hallucinate your positioning, pricing, and offering.
| Check | Weight | What it tests | How to pass |
|---|---|---|---|
| Schema.org JSON-LD | 45 | Parseable JSON-LD structured data (Organization, Product, FAQ…). | Add JSON-LD for your core entities and validate it at validator.schema.org. |
| OpenGraph metadata | 25 | og:title and og:description present. | Add OG tags so shared and quoted pages carry their meaning. |
| Meta description | 15 | A substantive (40+ char) meta description. | Write 120–160 chars stating what the page does. |
| Descriptive title | 15 | A specific <title> of 10+ characters. | Unique, descriptive titles per page. |
Can an agent trust the connection?
WebMCP and every agent API require a secure context. Insecure sites are excluded from agent workflows outright.
| Check | Weight | What it tests | How to pass |
|---|---|---|---|
| HTTPS | 50 | The site resolves to https:// after redirects. | TLS everywhere with a 301 from http. |
| No mixed content | 25 | No http:// subresources on the page. | Serve all subresources over HTTPS. |
| Permissions-Policy | 25 | A Permissions-Policy header is declared (WebMCP tool exposure is governed by its "tools" directive). | Declare the policy at your server or CDN layer. |
The 0–100 score maps to a letter grade so results are comparable at a glance — on score pages, badges, and the leaderboard.
Free, 15 seconds, no signup — and every failing check comes with a copy-paste fix prompt for your coding agent.