Run the readiness checks in your CI

Everything this scanner checks about a host, as a command you can run against a preview build before it ships. No account, no key, and no build failed for a technology you chose not to publish.

Install

There is nothing to install and nothing to configure. It is on npmjs, so npx fetches and runs it in one line, and every dependency it needs comes from there too.

npx agentic-readiness example.com

It will not fail your build because you did not adopt something

Missing is not the same as broken. If you do not publish an MCP server card, nothing is reported. If you publish one and its endpoint answers nothing, that is a defect and the build fails.

It also will not fail a build for a check it could not finish. A timeout, a blocked request or a spent budget is us failing to look, not you failing to publish, so those are reported as partly assessed and exit clean. A checker that goes red for its own network trouble is a checker teams learn to ignore.

In CI

One step. Point it at the preview deployment for the branch, so a broken implementation is caught on the pull request rather than after release.

- name: Agent readiness
  run: npx agentic-readiness ${{ env.PREVIEW_HOST }}

With --json, checked is every technology the tool can check and adopted is how many the host publishes, so adopted / checked is the same fraction this site shows for that host. requests lists every request each check made, so any verdict can be repeated with curl.

Options

--json: machine-readable output on stdout, for a later step to read
--fail-on <what>: defect (default), security, or never. security fails only on findings with security impact. Governs defects only: a site that refused us still exits 2, because no report was produced
--user-agent <ua>: who to identify as; the default is this tool, and it is always traceable
--header <k:v>: an extra request header, repeatable, for an edge that needs a bypass token
--timeout <ms>: the budget for the whole host, default 60000. Checks that run out of it are reported as partly assessed rather than as failures
--allow-private: permit localhost and private addresses, which is how you scan your own preview build
--no-color: plain text, for a log that will be read later
--version, --help: print and exit

Exit codes

0: No defects. A site that publishes none of these technologies exits here, and so does a check we could not finish.
1: At least one published technology is broken. This is the only code that means your site.
2: The run could not happen: bad usage, or a host that refused us or never answered. A home page that 404s is not this — the origin answered, so the checks run and the status is reported as context.

What it checks

Every host-level technology this scanner knows about, each one linking to its own reference page. The list comes from the same registry the scanner runs from, so it cannot drift from what the tool actually does.

robots.txt: The crawl-policy file every agent reads first.
AI-bot rules: Named rules for GPTBot, ClaudeBot and friends, rather than one blanket policy.
Content Signals: Cloudflare's robots.txt vocabulary for search, AI input and AI training.
ai.txt: Attribution preferences for AI systems that use the content.
TDMRep: The W3C text and data mining reservation, used mainly by publishers.
XML sitemap: The URL inventory agents and crawlers use for discovery.
llms.txt: A hand-written Markdown index of a site's most useful pages, written for language models.
Markdown negotiation: Markdown served to agents that ask for it with Accept: text/markdown.
MCP server card: Advertises a Model Context Protocol endpoint agents can call.
MCP authorization: The OAuth discovery chain protecting that MCP endpoint.
OpenAPI description: A machine-readable contract for the site's API.
API catalog: An index at /.well-known/api-catalog listing the site's APIs and their descriptions.
NLWeb endpoint: Microsoft's conversational /ask route returning schema.org answers.
UCP profile: Universal Commerce Protocol discovery for agentic shopping.
Web Bot Auth directory: Public keys letting verified agents prove who they are.
A2A agent card: Declares an agent this site operates, for agent-to-agent work.

What it does not check

Per-URL and in-browser signals — canonical, JSON-LD, Product schema, WebMCP — need a rendered page and a real browser, so they stay in the hosted scanner. Run a URL through the box on the home page for those.

Run a scan Build an agent-ready file Read the reference

The same checks, in your pipeline