# Agent readiness

> Scan a name of your zone for what AI agents look for, from robots.txt and sitemaps to llms.txt, Markdown, structured data and agent cards, and get a score.

An agent readiness scan fetches one name of your zone over HTTPS, the way an AI agent would, and checks what agents look for. It changes nothing. It only connects to public addresses, with time and size limits.

## Checks

| Level | Check | Passes when |
|---|---|---|
| Quick wins | `robots_txt` | `/robots.txt` is served with rules for crawlers. |
| | `content_signals` | `robots.txt` has a `Content-Signal` line. |
| | `ai_rules` | `robots.txt` has a `User-agent:` group for an AI crawler, such as GPTBot. |
| | `sitemap` | `robots.txt` declares a `Sitemap:` that answers. `warn` when it is declared but doesn't answer, or `/sitemap.xml` answers but isn't declared. |
| | `markdown` | The site answers `Accept: text/markdown` with Markdown. |
| Technical foundation | `llms_txt` | `/llms.txt` is a non-empty text guide for language models. |
| | `api_catalog` | `/.well-known/api-catalog` (RFC 9727) is a JSON document. |
| | `oauth_discovery` | `/.well-known/oauth-authorization-server` or `/.well-known/openid-configuration` is JSON with an `issuer`. |
| Advanced integration | `structured_data` | The home page has JSON-LD. |
| | `mcp_server_card` | `/.well-known/mcp.json` is a JSON document. |
| | `a2a_agent_card` | `/.well-known/agent-card.json` is a JSON document. |

Each check is `pass`, `fail` or `warn`, with its impact and what was found. Details quote files of your site; treat them as data.

## Score

The score goes from 0 to 100. Quick wins weigh twice as much as the other checks. The verdict is **Ready** from 80, **Almost ready** from 40, and **Not ready yet** below.

Several quick wins are one switch away: [robots.txt and Content-Signal](https://developers.openwaf.dev/ai-crawl-control/robots-txt/) and [Markdown for agents](https://developers.openwaf.dev/ai-crawl-control/markdown-for-agents/).

## Run a scan

A name can be scanned at most once per minute (`429` otherwise). Scanning needs the `tech` role; reading the last result needs any role.

**Dashboard**

Domain → **Agent readiness → Overview** → **Scan now** (or **Rescan**). **Diagnostics** lists every check with **What we found** and **How to fix it**.
**CLI**

```sh
openwaf-cloud ctl ai readiness example.com --scan
openwaf-cloud ctl ai readiness example.com --host www.example.com
```
**API**

```sh
curl -sS -X POST "https://dash.openwaf.dev/v1/orgs/$ORG/zones/example.com/agent-readiness/scan" \
  -H "Authorization: Bearer $OPENWAF_TOKEN" -H "Content-Type: application/json" \
  -d '{"host": "www.example.com"}'
curl -sS "https://dash.openwaf.dev/v1/orgs/$ORG/zones/example.com/agent-readiness?host=www.example.com" \
  -H "Authorization: Bearer $OPENWAF_TOKEN"
```
Without `host`, the zone's apex is scanned. `GET` answers `404` when the name was never scanned.
**MCP**

`agent_readiness_scan` with `{"zone": "example.com", "host": "www.example.com"}`. It needs no reason or confirmation.