# The same checks, in your pipeline

Everything this scanner checks about a host, as a command you can run against a preview build before it ships. No account, no key, and no build failed for a technology you chose not to publish.

## Install

Published to GitHub Packages, so npm needs to be told where the @deepcrawl scope lives. One line in .npmrc,
then the command. Every runtime dependency comes from npmjs.org as normal.

```
@deepcrawl:registry=https://npm.pkg.github.com
```

```
npx @deepcrawl/agentic-readiness example.com
```

## It will not fail your build because you did not adopt something

Missing is not the same as broken. If you do not publish an MCP server card, nothing is reported. If you
publish one and its endpoint answers nothing, that is a defect and the build fails.

It also will not fail a build for a check it could not finish. A timeout, a blocked request or a spent budget
is us failing to look, not you failing to publish, so those are reported as partly assessed and exit clean.

## In CI

```
- name: Agent readiness
  run: npx @deepcrawl/agentic-readiness ${{ env.PREVIEW_HOST }}
```

With --json, `checked` is every technology the tool can check and `adopted` is how many the host publishes.

## Options

- `--json` — machine-readable output on stdout, for a later step to read
- `--fail-on <what>` — defect (default) or never. Governs defects only: a site that refused us still exits 2, because no report was produced
- `--user-agent <ua>` — who to identify as; the default is this tool, and it is always traceable
- `--header <k:v>` — an extra request header, repeatable, for an edge that needs a bypass token
- `--timeout <ms>` — the budget for the whole host, default 60000. Checks that run out of it are reported as partly assessed rather than as failures
- `--allow-private` — permit localhost and private addresses, which is how you scan your own preview build
- `--no-color` — plain text, for a log that will be read later
- `--version, --help` — print and exit

## Exit codes

- `0` — No defects. A site that publishes none of these technologies exits here, and so does a check we could not finish.
- `1` — At least one published technology is broken. This is the only code that means your site.
- `2` — The run could not happen: bad usage, or a host that refused us or never answered. A home page that 404s is not this — the origin answered, so the checks run and the status is reported as context.

## What it checks

- [robots.txt](https://agentic-readiness.lumar.io/docs/access/robots-txt.md) — The crawl-policy file every agent reads first.
- [AI-bot rules](https://agentic-readiness.lumar.io/docs/access/per-bot-rule.md) — Named rules for GPTBot, ClaudeBot and friends, rather than one blanket policy.
- [Content Signals](https://agentic-readiness.lumar.io/docs/access/content-signal.md) — Cloudflare's robots.txt vocabulary for search, AI input and AI training.
- [ai.txt](https://agentic-readiness.lumar.io/docs/access/ai-txt.md) — Attribution preferences for AI systems that use the content.
- [TDMRep](https://agentic-readiness.lumar.io/docs/access/tdm-rep.md) — The W3C text and data mining reservation, used mainly by publishers.
- [XML sitemap](https://agentic-readiness.lumar.io/docs/discoverability/sitemap.md) — The URL inventory agents and crawlers use for discovery.
- [MCP server card](https://agentic-readiness.lumar.io/docs/capabilities/mcp-server.md) — Advertises a Model Context Protocol endpoint agents can call.
- [MCP authorization](https://agentic-readiness.lumar.io/docs/capabilities/mcp-auth.md) — The OAuth discovery chain protecting that MCP endpoint.
- [OpenAPI description](https://agentic-readiness.lumar.io/docs/capabilities/open-api.md) — A machine-readable contract for the site's API.
- [NLWeb endpoint](https://agentic-readiness.lumar.io/docs/capabilities/nl-web.md) — Microsoft's conversational /ask route returning schema.org answers.
- [UCP profile](https://agentic-readiness.lumar.io/docs/commerce/ucp.md) — Universal Commerce Protocol discovery for agentic shopping.
- [Web Bot Auth directory](https://agentic-readiness.lumar.io/docs/trust/web-bot-auth.md) — Public keys letting verified agents prove who they are.
- [A2A agent card](https://agentic-readiness.lumar.io/docs/trust/agent-card.md) — Declares an agent this site operates, for agent-to-agent work.

## What it does not check

Per-URL and in-browser signals (canonical, JSON-LD, Product schema, WebMCP) need a rendered page, so they
stay in the hosted scanner at https://agentic-readiness.lumar.io/.

---

- Run a scan: https://agentic-readiness.lumar.io/
- Build an agent-ready file: https://agentic-readiness.lumar.io/build
- The reference: https://agentic-readiness.lumar.io/docs