# What a website and API agent-readiness audit covers A technical scan, manual review and observed AI answers reveal different problems. This guide explains what an audit should record and how a team can use the findings. Most sites are built for human readers and search crawlers. AI agents read differently. They look for machine-readable entry points such as llms.txt, a sitemap, response headers, structured data, and well-known manifests, and when those are missing the agent either guesses or gives up. ## Technical checks The audit checks the parts an agent reaches first. Discoverability covers robots.txt, the sitemap, the response headers, and the DNS records that let an agent find resources without parsing a full HTML page. Content accessibility covers llms.txt, markdown content negotiation, and whether the site can return a clean text version that saves an agent most of the tokens an HTML page would cost. Bot access control covers the AI-bot rules, the content signals, and the bot-authentication directory that tell an agent how it is allowed to behave. API, auth, MCP and A2A discovery covers an MCP server card, an agent card, an OpenAPI description, an API catalog, and OAuth discovery, so an agent can enumerate what the site offers and authenticate safely. Commerce covers payment surfaces such as x402 and structured pricing, so an agent can transact. Each check runs against an independent scanner's current rule set. That rule set moves, so a scan run today is a new measurement rather than a repeat of an earlier one. ## Manual review A technical scan reads what a page serves. It does not read what a person notices when following the same path an agent would. Manual review checks whether the instructions a site publishes, such as an llms.txt entry or a registration step in auth.md, match what the site actually returns when followed. It checks whether structured data on a page agrees with the prose beside it, whether an error page reveals more than it should, and whether an edge case the scanner does not test, such as a redirect chain or a stale sitemap entry, breaks a path an agent would take. The finding here is usually a contradiction between two places, not a missing file. ## AI-answer observations A separate question from both of the above is what an AI assistant actually says when a buyer asks it something. Observed AI answers means asking ChatGPT, Perplexity, Claude, and similar assistants the questions a buyer would ask, and recording which sources they name and what they get wrong. This does not test the site directly. It tests whether the work already done on discoverability and content accessibility shows up in a real answer, and it can surface an assistant repeating outdated information that a scan of the current site would not catch. ## Findings and verification The result of an audit is a list. Each check passes or fails, and each failure comes with a concrete fix instruction and, where this site has a guide for that surface, a link to it. The report is written so your own team can do the work, which means implementation is something you buy if you want it rather than something the report forces on you. turva.dev applies the same standard to its own site. Measured by an independent scanner, turva.dev reaches 100/100 and Level 5, Agent-Native, on isitagentready.com. Measured 2026-09-14. That is one scan on one day against one named scanner, and it does not stand in for manual review or for how an assistant answers a buyer's question, so it counts as one input among the three above rather than a summary of all of them. A rescan after a fix shows whether that specific fix passed. The audit a client receives runs the same three kinds of check against their site. ## Frequently asked **What is an agent-readiness audit?** An agent-readiness audit measures how well an AI agent can discover, read, and act on a website or an API. It is a technical review of the surfaces automated clients use, scored against current standards rather than opinion. **What does an agent-readiness audit check?** It checks the surfaces an agent reaches first, covering discoverability, content accessibility, bot access control, API/auth/MCP and A2A discovery, and commerce. Each check passes or fails, and each failure comes with a concrete fix, verified by the scanner where the check is scored and by a direct test where it is not. **What does an agent-readiness audit produce?** A pass or fail on each check, and a concrete fix instruction for every failure, with a link to the guide on this site for that surface where there is one. Your own team can do the work from the report. Scored checks are verified by the scanner before and after, manual-review fixes by a direct test, and the scoring is against current standards rather than opinion. ## Sources - [isitagentready.com, the scanner the audit reads](https://isitagentready.com/) - [Well-known URIs, RFC 8615](https://www.rfc-editor.org/rfc/rfc8615.html) - [API catalog, RFC 9727](https://www.rfc-editor.org/rfc/rfc9727.html) ## Related - [How to choose an agent-readiness audit](/guides/choosing-an-agent-readiness-audit) - [Measure agent-readiness with evidence](/guides/measurement-led-agent-readiness) - [Common agent-readiness gaps in a measured sample](/guides/agent-readiness-gaps)