Scoring formula and method

The file earns one point as a map of documentation. It does not establish agent selection. Our eighteen build runs never cited it; a run may read a file without citing it.

Ahrefs reported 137,210 domains in June 2026, with 97 percent of published files serving no traffic. Otterly reported 84 requests against 62,100 AI-bot visits over ninety days. John Mueller said in June 2025 that no AI system used it.

Mintlify tested 2,400 tasks across twenty documentation sites in July 2026. Wrong URLs averaged 2.23 per task on HTML, 1.42 on markdown and 0.11 with an llms.txt map. These studies measure different uses; none establishes a priority fix for a specific vendor.

The scanner requests the selected documentation page as itself, ChatGPT-User and Claude-User. A JavaScript challenge also triggers probes of the home page. Training crawlers are outside this check.

amplitude.com returned 404 for one documentation URL and 200 for another. bitmovin.com challenged our scanner but served Claude-User the page. A pass applies to the page tested.

A 429 is retried. If it persists, dependent checks are unmeasured. Signup probes are spaced apart.

A challenge marker is reported separately, with the host and request count. It still costs no points. A browser-capable agent may behave differently from this HTTP client.

Self-serve wording is the union of both reads. One vendor changed its free-tier sentence between reads forty minutes apart. The scorecard records disagreements.

The check follows the apex, signup origin, MCP host and conventional authorization or resource-server subdomains. Protected-resource metadata can lead to authorization servers. Both well-known layouts are tried, with the issuer path before or after the well-known segment.

The scorecard lists attempted origins. Since 9.33, requests skipped after an earlier connection failure or timeout do not count as attempts. If no request was sent, the check is unmeasured.

The check reads the pricing-page description tag, or opening text if the tag is absent. It does not use the rest of the page. An amount, rate or entry condition such as free, no card or no account passes. The check is worth one point.

Gated checks run up to three times. The scorecard records the number of attempts and any disagreement. During research, one endpoint returned 200 once and 403 four times.

The scan measures HTTP signals. Agent recommendations and task-based integration audits are separate measurements.

Documentation, pricing, signup and npm-package paths are inferred from links. The scorecard names the selected pages so you can identify a bad match.

Each response is capped at 400,000 bytes. Checks depending on a truncated document are unmeasured and name the cap. filestack.com returned 12,282 characters to a full quickstart read and 53 to ours.

Since 9.50, the ceiling stopped deciding which of your pages we read without a control comparison. A truncated guessed path is compared with an unregistered address. Matching oversized responses indicate a shared shell; if the control does not answer, we skip the path.

On 2026-08-20, 885 requests produced 114 responses above the cap. The old rule had excluded 16 paths on nine domains.

An application shell returned for an unknown path does not establish that the requested file exists.

The check reads the documentation landing page, at most three additional credential-related pages, and discovered llms.txt files. It tests 7 phrases: management api, beside a credential or something being created; provisioning api, beside a credential or something being created; account api, beside a credential or something being created; create an api key (or api token, access token, personal access token, service account, auth token, secret key, access key, service token, signing key, publishable key, client key, licence key, project token), next to something programmatic; programmatically create, in either word order; service account, in a sentence that creates one by program; a documented path like /v1/api_keys or /v2/access-tokens.

A creation phrase requires programmatic context in the same sentence. Since 9.32, three bare phrases also require a credential or creation context. A menu label alone does not count.

The repair followed a review where twenty-eight of eighty credited rows depended on bare wording. Examples included "Media management API integration", "Content Delivery API Management API Image Service" and "Important Change to the Twilio Phone Number Provisioning API".

The scorecard quotes the matching sentence. A missing credential page can change the conclusion; send its URL for a rescan.

An unregistered path is requested in the same namespace with the same Accept header. Each entry file is compared with that response. Per file, not per namespace.

sentry.io returned a 976-byte page for unknown .md paths and a real 106-byte descriptor. If the control times out, is rate limited or is refused, the check says it could not tell.

MCP uses the same control. A bare 405 can also be an unrouted POST response. An address can count through a handshake, WWW-Authenticate, an MCP-specific host, or a response differing from an unrouted path on the origin.

When the answer is one only a control can read, a missing control makes it unmeasured. This applies to refusals, empty 202s and bare 405s. A handshake, a JSON body or an OAuth challenge needs no control and still counts.

LetAgentsIn/1.0 is sent up to three times, stopping early if the scan budget is nearly exhausted. Results appear beside a Chrome user-agent response. Other requests use a browser user-agent, except the named-agent probes described above.

The W3C Web Machine Learning Community Group draft of 26 August 2026 registers tools through document.modelContext at runtime. Detecting them requires a browser and getTools(); this scanner executes no JavaScript.

Lighthouse included three WebMCP audits on 19 August 2026. This site registers its own scan tool on the home page. No WebMCP result is inferred for other sites from their HTML.