An agent readiness scan fetches one name of your zone over HTTPS, the way an AI agent would, and checks what agents look for. It changes nothing. It only connects to public addresses, with time and size limits.
Checks
| Level | Check | Passes when |
|---|---|---|
| Quick wins | robots_txt | /robots.txt is served with rules for crawlers. |
content_signals | robots.txt has a Content-Signal line. | |
ai_rules | robots.txt has a User-agent: group for an AI crawler, such as GPTBot. | |
sitemap | robots.txt declares a Sitemap: that answers. warn when it is declared but doesn't answer, or /sitemap.xml answers but isn't declared. | |
markdown | The site answers Accept: text/markdown with Markdown. | |
| Technical foundation | llms_txt | /llms.txt is a non-empty text guide for language models. |
api_catalog | /.well-known/api-catalog (RFC 9727) is a JSON document. | |
oauth_discovery | /.well-known/oauth-authorization-server or /.well-known/openid-configuration is JSON with an issuer. | |
| Advanced integration | structured_data | The home page has JSON-LD. |
mcp_server_card | /.well-known/mcp.json is a JSON document. | |
a2a_agent_card | /.well-known/agent-card.json is a JSON document. |
Each check is pass, fail or warn, with its impact and what was found. Details quote files of your site; treat them as data.
Score
The score goes from 0 to 100. Quick wins weigh twice as much as the other checks. The verdict is Ready from 80, Almost ready from 40, and Not ready yet below.
Several quick wins are one switch away: robots.txt and Content-Signal and Markdown for agents.
Run a scan
A name can be scanned at most once per minute (429 otherwise). Scanning needs the tech role; reading the last result needs any role.
Domain → Agent readiness → Overview → Scan now (or Rescan). Diagnostics lists every check with What we found and How to fix it.
openwaf-cloud ctl ai readiness example.com --scan
openwaf-cloud ctl ai readiness example.com --host www.example.comcurl -sS -X POST "https://dash.openwaf.dev/v1/orgs/$ORG/zones/example.com/agent-readiness/scan" \
-H "Authorization: Bearer $OPENWAF_TOKEN" -H "Content-Type: application/json" \
-d '{"host": "www.example.com"}'
curl -sS "https://dash.openwaf.dev/v1/orgs/$ORG/zones/example.com/agent-readiness?host=www.example.com" \
-H "Authorization: Bearer $OPENWAF_TOKEN"Without host, the zone's apex is scanned. GET answers 404 when the name was never scanned.
agent_readiness_scan with {"zone": "example.com", "host": "www.example.com"}. It needs no reason or confirmation.