Let Agents In

Formula v9.2

The whole formula, published, so the number can be argued with.

Scanners in this category derive a score from a single call to a language model. That number does not reproduce, and asking a vendor to act on it is asking them to trust a coin flip. Every check below is an HTTP request with a fixed rule. 15 checks, 17 points. Every result we publish is downloadable at /corpus.json, because arguing with a formula is easier with the data than with the prose.

Checks

ADiscoveryCan an agent find and read you?6 pts

  • 1 pt
    Answers an agent user-agentAn agent sends HTTP with its own user-agent, not a browser fingerprint. A 403 here ends the funnel before any of it starts.answers_plain_request
  • 1 pt
    llms.txt publishedA curated map of your docs is the cheapest way to control what an agent reads first. Worth one point and not more: in eighteen isolated agent runs across four categories, not one cited llms.txt among its sources, and an independent ninety-day measurement published by Otterly in February 2026 found it served 84 requests against 62,100 AI-bot visits.llms_txt
  • 1 pt
    Docs readable without JavaScriptMost agents fetch HTML, they do not run your bundle. An empty shell reads as an empty product.docs_without_js
  • 1 pt
    On-demand agents not blockedChatGPT-User and Claude-User are not crawlers. They are your prospect, reading your docs mid-integration.user_agents_allowed
  • 1 pt
    Paths robots.txt points at answerAn Allow line is a claim that a path is worth fetching. An agent that follows it into a 404 has spent budget on your map being wrong.robots_paths_resolve
  • 1 pt
    No punishing crawl delayA polite agent honouring Crawl-delay: 10 spends 200 seconds to read 20 doc pages, then gives up.no_crawl_delay

BAgent entryIs there a door built for a machine?4 pts

  • 2 pt
    Agent entry pointA markdown file written for a machine turns a guessing game into a procedure it can follow.agent_entry_point
  • 1 pt
    OAuth dynamic client registrationRFC 7591 is the only standard path by which an agent can register itself without a human.oauth_dcr
  • 1 pt
    MCP surfaceAn MCP server turns your API from something an agent reads about into something it can call.mcp_present

CRegistrationCan an agent get an account?2 pts

  • 1 pt
    No CAPTCHA in the signup HTMLA CAPTCHA is a hard stop. Permissions after signup beat a gate before it.signup_no_captcha
  • 1 pt
    Signup reachable without a browserIf a bare HTTP request gets a 403, the agent never sees the form at all.signup_reachable

DProvisioningCan it get credentials without a human?3 pts

  • 2 pt
    Programmatic key provisioningDocumented key creation is the difference between a two-minute integration and a support ticket.programmatic_provisioning
  • 1 pt
    Free tier or no-card trial stated in textA free tier is what lets an agent finish the job in the same session it started. Usage-priced products with self-serve signup can fail this honestly, which is why it is one point and not a verdict.self_serve

EIntegrationCan it ship working code?2 pts

  • 1 pt
    Typed SDK on the registryTypes are how an agent checks its own work before you ever see the code.typed_package
  • 1 pt
    Machine-readable API descriptionAn OpenAPI file or markdown negotiation lets an agent read your API instead of guessing it.machine_readable_api

The three crawler classes

robots.txt names bots, and the names fall into three classes that cost you completely different things. Pasting an “AI bots” list off the internet blocks all three at once, which is how companies cut off their own prospects without noticing.

trainingBlocking it keeps you out of model weights.

GPTBot · ClaudeBot · anthropic-ai · Google-Extended · Bytespider · meta-externalagent · Applebot-Extended

searchBlocking it keeps you out of cited answers.

OAI-SearchBot · Claude-SearchBot · PerplexityBot

userBlocking it stops your customer’s agent from reading your docs mid-integration.

ChatGPT-User · Claude-User · Perplexity-User

Agent entry paths probed

None of these is a ratified standard yet. They are the paths that reference implementations actually publish, and a hit on any of them means someone wrote a procedure for a machine.

/agent-signup.md · /skill.md · /agents.md · /agent.md · /ai.txt · /.well-known/agent-access.json · /.well-known/mcp.json · /.well-known/agent.json · /.well-known/ai-plugin.json

Three verdict states, and what the score is out of

Sixteen points exist on paper. A domain is scored out of the points that both apply to it and we could evaluate, and the scorecard prints that denominator beside the number. Charging a vendor for our own blind spots would make a site we could not read look worse than one we could.

PASS and PART
Measured, and counted in both the score and the denominator.
UNMEASURED
We could not evaluate it: an edge that refused our requests, a form assembled by JavaScript, too few documentation pages to conclude anything. Out of the score and out of the denominator, and each of these lines says what would make it measurable.
N/A
The check does not apply to a product of this kind. A library with no accounts cannot fail a check about signup gates. Out of the score and out of the denominator.

Rankings and the industry report sort on the share of measurable points, which is why a smaller number can sit above a larger one: 6 of 9 is ahead of 8 of 14.

How much the corpus moves on its own

On 10 August 2026 we rescanned all 167 domains twice, with no rule changed between the two runs, and compared every verdict: 15 of 2,338 moved, which is 0.64 percent. A difference smaller than that, in our numbers or in yours, is the internet being the internet rather than something that changed.

Measured three more times on 12 August 2026, on 170 domains: 0.27 percent, then 0.39, then 0.20. The last of those is 5 verdicts of 2,550, same formula on both sides and nothing changed between the runs, and it is the number to use. The earlier ones are larger because a share of what they counted was ours.

How much of it was ours we found out by measuring rather than by assuming. The scanner gives itself 27 seconds per domain, and a scan that runs out publishes several verdicts as unmeasured, which is a fact about our clock and not about the vendor. One run published eleven such verdicts across two domains, and repeating those two scans by hand cut that run's movement from 23 rows to 12. Truncated scans are retried now. Two other repairs followed from reading what still moved: a vendor whose edge answers every one of our POSTs with an empty 202, ours included to a path nobody registered, is reported as unmeasured instead of as having no MCP server, and a product that publishes prices is no longer told it has no accounts merely because we could not find the link. The floor fell from 0.39 to 0.20 across those three.

What is left is five rows, and none of them is a verdict changing its mind about a vendor. Two are MCP endpoints that answer one pass and not the next, two are documentation pages that refuse us once and answer the second time, and one is a docs page that renders differently depending on which of a vendor's pages we land on. We ask a host for about nineteen documents inside that 27 second budget, which is itself a burst, so some of what remains is still ours.

It is not evenly spread. Nine of the fifteen sit in the three checks that depend on a host answering us at all, and the rest are single rows. We chased two of them rather than assume: name.com went from refusing us to answering, and answers a browser and both agent user-agents we asked as that day identically three times over, so the change was theirs and transient. froala.com answers 403, 200, 403 in the same alternating pattern to a browser as to us, so its row moving is froala being froala.

The uncomfortable consequence, printed because it is true: our own adversarial audits put the error rate in these verdicts at 0.39 percent, which is now the larger of the two. It sat below the floor until the floor moved, and the floor moved because we stopped counting our own truncated scans against the internet. They are different measurements, a wrong rule against an unstable network, and together they mean no single row is evidence on its own. Rescan before you act on one, and treat the checks above the fold as the durable part.

We are scored by this too

This site is in the scanner like anybody else, and it fails a check we publish. There is no OAuth metadata on any host we run, so an agent cannot register itself as a client with us. The reason is that our MCP server needs no account at all, which makes the check inapplicable in spirit and failing in fact, and we would rather show the failing row than write ourselves an exemption nobody else gets. Scan the domain in the box on any page and you will get the same card a vendor gets.

What the other scanners measure

agent-ready.dev runs 70 checks against the Vercel Agent Readability Spec, llmstxt.org and a dozen protocol manifests, plus 23 accessibility checks. On discovery and parsing it is more thorough than we are and we would send you there for that: if you want to know whether your markdown mirrors, canonical tags and structured data are right, they will tell you and we will not.

Their published specification contains the words signup, provisioning and CAPTCHA zero times. Their own summary is discovery, structure, context: can an agent find your pages, parse them, understand them. That is the stage this corpus measures as 91 percent solved. Ours starts at the next one, where the same corpus measures 26 percent, and the difference is not a disagreement about scoring: they answer whether an agent can read you, we answer whether one can join you.

Two of their checks were better than ours and are now in the scanner: whether the links inside llms.txt still answer, and whether a site serves an agent user-agent less than it serves a browser. We took neither of their per-page SEO checks, because a check nearly everybody passes moves a score without deciding anything. kodustech/agent-readiness is a different axis again: it grades your own repository for whether a coding agent can work inside it, which is a question about your codebase rather than about your funnel.

Known limits

  1. 01llms.txt does two different jobs and the evidence on them points opposite ways, so here is both halves. As a thing crawlers pull, it is close to dead: Ahrefs looked at 137,210 domains in June 2026 and found 97 per cent of published files served no traffic at all, Otterly measured 84 requests to it against 62,100 AI-bot visits over ninety days, and John Mueller said in June 2025 that no AI system uses it. As a map an agent working on a task reads, it earns its point: Mintlify ran 2,400 agent tasks across twenty documentation sites in July 2026 and averaged 2.23 wrong URLs per task on HTML, 1.42 on plain markdown, and 0.11 when an llms.txt pointed the way. We score the second job, because that is the one that ends in somebody using your API. Our own eighteen runs never cited the file, which is weaker evidence than it sounds, since a run can read a file without naming it. One point, and if you are choosing what to do first, this is not it.
  2. 02We ask as ourselves and as the two on-demand fetchers an edge is most likely to have a rule for, ChatGPT-User and Claude-User, and only at the documentation page we picked. amplitude.com answers a named agent 404 at one documentation URL and 200 at another, so a pass here means the page we read was served, not that every page is. Training crawlers are deliberately not part of this: refusing the crawler that builds a training set is a different decision from refusing the agent a customer sent, and this check only measures the second.
  3. 03A 429 is never a finding about you. If a host rate limits us, the checks that depended on reading it come back unmeasured and say so, because reporting our own traffic as your refusal would be an accusation. The door test also spaces its three tries, so we are not manufacturing the limit we would then have to explain.
  4. 04Pricing pages are read twice and the self-serve wording is the union of both reads. One vendor answered the same URL with and without its free-tier sentence forty minutes apart, which moved a scored point; the scorecard says when the two reads disagreed.
  5. 05The client registration check follows more than the apex: the signup origin, any MCP host, and the subdomains an authorization or resource server conventionally lives on. It also follows the pointer rather than stopping at the host: a protected-resource document names the authorization servers that guard it, and we read those too, in both of the well-known layouts deployments use, with the issuer path before or after the well-known segment. Finding nothing across all of them is a measurement, and the scorecard names the origins we probed so you can rerun exactly what we ran.
  6. 06Bot gates are not deterministic. The same signup endpoint answered 200 once and 403 four times during research, so gated checks run three times and the scorecard says when the tries disagreed.
  7. 07A passing file is not a passing experience. Publishing llms.txt scores a point here and still tells you nothing about whether an agent chose you. That is what the paid audit measures.
  8. 08Discovery can be wrong. Docs, pricing, signup and the npm package are inferred from your own links. The scorecard shows exactly what it found so you can see when it guessed badly.
  9. 09A soft 404 is treated as absence. Sites that answer 200 with an app shell for unknown paths are read as not having the file, which is also how an agent reads them.
  10. 10The provisioning check reads the documentation landing page, at most three more chosen by how directly a path promises credentials, and any llms.txt files you publish, which is why the scorecard often says more than four documents. It looks for these seven phrases and names the ones it found: management api; provisioning api; account api; create an api key (or api token, access token, personal access token, service account, auth token, secret key), next to something programmatic; programmatically create, in either word order; service account; a documented path like /v1/api_keys or /v2/access-tokens. The creation phrase counts only with something programmatic in the same sentence, because "click Generate key. This creates an API key" is documented key creation and is not a path an agent can take. A sample of a large documentation set is still a sample, so a vendor whose credential page was not among them can tell us and we will rescan.
  11. 11A control probe runs before the agent-entry checks: we ask for a nonsense path first, and if the site answers it with a real document, every hit in that namespace is suppressed and the check is marked unmeasurable. Sentry answers any .md path with the same 976-byte page, which would otherwise have scored full marks on nine files that do not exist. The MCP check runs the same control, because almost every site answers 405 to a POST at a path it does not route: an address only counts when it answers the handshake differently from an unrouted one, or challenges for OAuth with a WWW-Authenticate header.
  12. 12The door test sends LetAgentsIn/1.0 three times and reports what came back next to what a Chrome user-agent got, so a site that serves browsers and refuses agents shows both numbers. Every other request in the scan is sent as a browser, because we are measuring the content, not the gate.