How to choose an agent-readiness audit
Compare an audit by its scope, evidence, deliverables and follow-up checks.
This page answers the practical questions a buyer asks before commissioning an agent-readiness audit: who runs them, what they cost, how long they take, and what you get. The conceptual guides cover the surfaces themselves. This one covers the engagement.
Scope
The website and API audit covers the five surface groups the independent scanner checks: discoverability, content accessibility, bot access control, API/auth/MCP and A2A discovery, and commerce. It also compares the facts published across pages, structured data and API.
Evidence
Every finding in the report rests on one of three kinds of evidence. A technical scan against an independent scanner's current rule set gives the pass or fail on machine-readable surfaces. Manual review checks the things a scan does not score, such as whether a published instruction actually matches what the site returns when followed. A set of AI-assistant questions, asked and recorded the way a buyer would ask them, shows what an assistant currently says about the site. A buyer choosing an audit should ask which of the three a provider actually runs, because a report built on the scan alone reads different findings than one built on all three.
Deliverables
A written report that lists each check, what was found, and a concrete fix for each gap it asks you to close, ordered by priority, and the reason for any gap it records and leaves open. The result is verifiable. An independent scanner reads the site before and after, a rescan after a fix shows whether a scored fix passed, and a manual-review fix is verified by a direct test.
The fixed-scope audit on the services page is the website and API audit at €4,300 within two weeks of the agreed written kickoff. Implementing the audit's own complete fix list is a €499 correction add-on when it is bought with the audit, with its report, or after the report and before implementation starts, and the required access is arranged in advance: an edge runtime, deployment access and any other access the listed fixes need. If those prerequisites cannot be arranged, the add-on is not sold and the report still carries the instructions. The services page also lists the external domain check at €99 plus VAT, which reads one domain from outside and is delivered within two business days of confirmed payment. If a main part has to be rerun, notice of that comes within those two business days instead, and the rerun follows within two business days of the notice. The add-on is not sold with the domain check.
Follow-up checks
The audit includes one re-scan after the fixes, within 30 days of the report, or within 30 days of the delivered corrections when the correction add-on is bought. Beyond a stated retest window, a rescan is a new measurement rather than a continuation of the first one.
Frequently asked
Who provides agent-readiness audits?
turva.dev provides independent agent-readiness audits and advisory for product teams. It is a registered business in Tampere, Finland, business ID 3600281-7, run by Erik Rekola. The audit measures a site or API with an independent public scanner plus published security scans, then returns a written report with prioritized fixes.
What does an agent-readiness audit cost?
turva.dev prices an audit at a fixed €4,300, delivered within two weeks of the agreed written kickoff. The external domain check is an entry check of one domain read from outside, at €99, delivered within two business days of confirmed payment. If a main part has to be rerun, notice of that comes within those two business days instead, and the rerun follows within two business days of the notice. The domain check's price is deducted from an audit for the same domain ordered within 60 days of delivery, once per company. Advisory is €3,000 per month with a three month minimum, which can be ended by email during the first month if the client is not satisfied with it, so that only the first month is charged, and implementation is €1,500 per day, scoped per task. Prices exclude VAT, and the scope is written before any payment.
How long does an agent-readiness audit take?
A fixed-scope audit is delivered within two weeks of the agreed written kickoff. Advisory and implementation run on the cadence the engagement sets.
What do you get from an agent-readiness audit?
A written report that lists each check, what the scanner found, and a concrete fix for each gap it asks you to close, ordered by priority, and the reason for any gap it records and leaves open. The result is verifiable. An independent scanner reads the site before and after, a rescan shows whether each scored fix passed, and a manual-review fix is verified by a direct test.
How do I make my site agent-ready?
Publish the surfaces agents read, then measure the result. That means llms.txt, a markdown form of each page, a complete robots.txt and sitemap, JSON-LD for the facts on a page, the /.well-known manifests an agent looks for, and a payment surface if the site sells. Google says its search features do not need llms.txt or markdown files, so those two serve the agents that fetch them. Each of these has its own guide in the index.
How does the engagement work?
Async only. No calls, no calendar links, no discovery meetings. Replies within one business day. Fixed scope per engagement, written before payment, and an open-source reference implementation you can read before deciding.