AgentReady v1.0.0
Somebody wrote a standard. Here is where we stand against it.
AgentReady has 28 requirements across five sections, and seven of them are MUST. Five of those seven are conditional: they apply only if you expose the surface they are about, so a product with no agent-to-agent interface is not failing the agent card requirement, it simply has nothing to publish. Read from agentready.org on 18 August 2026.
We measure six of the seven. On four of those we ask a harder question than the spec does. One we do not measure at all, and the reason is below. There is no compliance score on this page, and there will not be one: the standard itself exists because every readiness score disagrees with every other.
The seven MUSTs against our card
| Requirement | What it asks | Our check |
|---|---|---|
| AR-DISC-01 | Declare AI crawler policies in robots.txt, telling named agents apart from training crawlers. | Retrieval bots allowed, no crawl delay, and the paths robots.txt points at actually answerWe follow the file rather than reading it: a robots.txt that names a path we then cannot fetch is a claim, and we check it. |
| AR-CAPA-01 | Expose tools over the Model Context Protocol. Conditional on having agent tools at all. | Live MCP endpointWe complete a JSON-RPC handshake instead of looking for a file, and we send one request to a path nobody registered, because an edge that answers everything with an empty 202 would otherwise score as a server. |
| AR-CAPA-04 | Publish an A2A agent card at /.well-known/agent-card.json. Conditional on an agent-to-agent surface. | Agent entry point |
| AR-CAPA-08 | Provide an OpenAPI 3.1 description of your HTTP API. Conditional on exposing one. | Machine-readable API descriptionFive paths, a declaration from your own documentation page, and content negotiation for markdown, because a spec we cannot find is a spec an agent cannot find. |
| AR-IDEN-02 | Implement OAuth 2.0 for delegated, scoped access. Conditional on user-owned resources. | OAuth dynamic client registrationWe look for the metadata across every host an authorization server plausibly lives on, not only the one you would guess. |
| AR-IDEN-03 | Expose OAuth authorization server metadata at the well-known address. Conditional on running one. | OAuth dynamic client registration |
| AR-IDEN-05 | Use PKCE with S256 for public OAuth clients. Conditional on accepting them. | not measured |
The one we refuse to add, and why
AR-IDEN-05 asks for PKCE with S256. We do not score it, and the reason is a number rather than an opinion: almost nobody in our corpus publishes the metadata that would let us check it without guessing, and a check measured on a handful of rows cannot tell a real absence from our own blind spot. Every check costs requests and a place on the card, and one that credits nothing certain while risking a wrong accusation is worse than the gap it closes. We already collect the evidence while checking OAuth, so the decision reverses itself the moment the number grows.
For the same reason we watch AR-CAPA-04 rather than celebrate it. On 18 August 2026 we asked 59 domains spread across this corpus for a card at the address the standard names. Fifty-two answered and none of them served one: most said 404 outright, and where a site answered 200 with something else we checked it against that site's own answer to a path nobody registered. The other seven refused us or answered with something we could not read either way, and they are counted in neither direction, because a host that will not answer is not a host without a card. We still probe that address, since a vendor who does publish one was reading as if they published nothing, and that was our error rather than theirs.
Half our card has no equivalent in the spec
8 of our 16 checks ask something AgentReady does not ask at all. They are the half about whether an agent can actually get in rather than whether the right files exist, which is the difference between a specification and a measurement.
- Signup reachable without a browser
- No CAPTCHA in the signup HTML
- Free tier or no-card trial stated in text
- Programmatic key provisioning
- Typed SDK on the registry
- Price or entry condition in the search snippet
- Docs readable without JavaScript
- Answers an agent user-agent
What we publish about ourselves
We serve an agent catalogue at /.well-known/ai-catalog.json, point at it from robots.txt, publish an OpenAPI description of our own API and run an MCP server. We do not publish an A2A agent card, because that requirement is conditional on exposing an agent-to-agent surface and we expose MCP and HTTP. Shipping a well-known file with nothing behind it is a claim we would then have to keep true.
Every check, with the rule that decides it · all 177 rows as data