What a website and API agent-readiness audit covers

A technical scan, manual review and observed AI answers reveal different problems. This guide explains what an audit should record and how a team can use the findings.

Most sites are built for human readers and search crawlers. Some AI agents read differently. They use machine-readable entry points such as llms.txt, a sitemap, response headers, structured data and well-known manifests. Which of them a client reads varies. When those are missing, an agent that cannot parse the page's rendered layout either guesses at the fact or gives up on the page, while an agent built with a fallback, such as a search result or a cached summary, may still complete the task another way.

Technical checks

The audit checks the parts an agent reaches first. Discoverability covers robots.txt, the sitemap, the response headers, and the DNS records that let an agent find resources without parsing a full HTML page. Content accessibility covers llms.txt, markdown content negotiation, and whether the site can return a clean text version that saves an agent most of the tokens an HTML page would cost. Bot access control covers the AI-bot rules, the content signals, and the bot-authentication directory that tell an agent how it is allowed to behave. API, auth, MCP and A2A discovery covers an MCP server card, an agent card, an OpenAPI description, an API catalog, and OAuth discovery, so an agent can enumerate what the site offers and authenticate safely. Commerce covers payment surfaces such as x402 and structured pricing, so an agent can transact.

The scanner's checks run against its current rule set, and what it does not score, such as llms.txt, is tested directly. That rule set moves, so a scan run today is a new measurement rather than a repeat of an earlier one.

The table below records each surface's current status, drawn from the reference file this site maintains in its repository. Pilot means an early-stage mechanism with no ratifying body yet. It names the ratification state and does not rate adoption or production maturity. Accepted extension means the protocol's own proposal process has marked the extension Final, while the extension's reference repository can still be labelled experimental.

The full citation behind each status lives in the repository's reference file.

Manual review

A technical scan reads what a page serves. It does not read what a person notices when following the same path an agent would. Manual review checks whether the instructions a site publishes, such as an llms.txt entry or a registration step in auth.md, match what the site actually returns when followed. It checks whether structured data on a page agrees with the prose beside it, whether an error page reveals more than it should, and whether an edge case the scanner does not test, such as a redirect chain or a stale sitemap entry, breaks a path an agent would take. The finding here is usually a contradiction between two places, not a missing file.

AI-answer observations

A separate question from both of the above is what an AI assistant actually says when a buyer asks it something. Observed AI answers means asking ChatGPT, Perplexity, Claude, and similar assistants the questions a buyer would ask, and recording which sources they name and what they get wrong. This does not test the site directly. It records what selected assistants answer on the test date and which sources they cite. It does not establish which site changes caused the answer, and it can surface an assistant repeating outdated information that a scan of the current site would not catch.

Findings and verification

The result of an audit is a list. Each check passes or fails, and each failure comes with a concrete fix instruction or the reason the gap is left open, and with a link to the guide on this site for that surface where there is one. The report is written so your own team can do the work, which means implementation is something you buy if you want it rather than something the report forces on you.

turva.dev applies the same standard to its own site. Measured by an independent scanner, turva.dev reaches 100/100 and Level 5, Agent-Native, on isitagentready.com. Measured 2026-10-29. The scanner's public link opens its start page, where anyone can run a new check. That page does not keep the result recorded here. That is one scan on one day against one named scanner, and it does not stand in for manual review or for how an assistant answers a buyer's question, so it counts as one input among the three above rather than a summary of all of them. A rescan after a fix shows whether that specific fix passed. The audit a client receives runs the same three kinds of check against their site.

Sources

• isitagentready.com, the scanner the audit reads
• Well-known URIs, RFC 8615
• API catalog, RFC 9727

Related

• How to choose an agent-readiness audit
• Measure agent-readiness with evidence
• Common agent-readiness gaps in a measured sample