What is agent readiness?

Content-Signal directives (search / ai-input / ai-train) let you state how your content may be used by AI.

What good looks like Clear Content-Signal directives that reflect your policy.

A Link header (RFC 8288) can point an agent at your sitemap, a description of your site or your API documentation from the response alone, without parsing any HTML. It is optional and uncommon. No standard names llms.txt in a Link header, so we do not look for that.

What good looks like A Link header whose relation names a discovery resource you publish, such as sitemap, service-doc, service-desc, api-catalog or describedby.

Advertises an MCP server so agents can discover and use your tools before they connect. Only relevant if you expose agent-facing infrastructure.

What good looks like An AI catalog (/.well-known/ai-catalog.json) with an entry for your MCP Server Card, as the final MCP specification describes. Cards published at the older well-known paths still count, and the result says they are the legacy route.

A single index of the AI-facing things you publish — MCP servers, agent cards, skills, datasets — so an agent finds them in one hop instead of guessing at paths. Adoption is early and the format is still settling, so not having one is normal today rather than a defect.

What good looks like An AI catalog that actually lists something, found at /.well-known/ai-catalog.json or /.well-known/ard.json, or pointed to from robots.txt (an Agentmap line), a link element in the page head, or a Link header. An index with nothing in it tells an agent no more than having none.

An A2A Agent Card is the business card another AI agent reads before it talks to yours: who you are, what skills you offer and how to connect. Only relevant if you run an agent that other agents are meant to call.

What good looks like A JSON Agent Card at /.well-known/agent-card.json that names the agent and lists its skills. The older /.well-known/agent.json is read too.

WebMCP lets a page offer its real actions, like searching or booking, to an AI agent running in the browser, instead of the agent guessing at buttons. Forms can declare themselves as tools right in the HTML. It is an experimental browser feature, so most sites have nothing here yet.

What good looks like Forms that declare a tool name and description in the markup, or the WebMCP bridge script, so a browsing agent can use the page's actions directly.

The IETF's AI preferences work gives a site a standard way to say, in robots.txt or a response header, whether its content may be used for AI training, AI answers or search. Nobody is known to honour it yet, so this is a statement of intent rather than a lock.

What good looks like A Content-Usage line in robots.txt, or a Content-Usage response header, stating your preference for training, AI use and search.

Really Simple Licensing lets a publisher point machines at machine-readable licence terms for its content, including terms that ask AI companies to pay. It is backed by several large CDNs and publishers, though no AI company is known to honour it yet.

What good looks like A License line in robots.txt, or a licence link of the RSL type in the page head or a Link header, pointing at your RSL terms.

TDMRep is a W3C community standard for reserving the right to text-and-data mining of your content, used by publishers in the EU where that right can be opted out of. It can be a response header, a meta tag or a small file.

What good looks like A tdm-reservation signal of 0 or 1 as a response header, a meta tag, or a /.well-known/tdmrep.json file.

Some AI agents never ask a site for Markdown; they follow a link to it. A link in the page head to the Markdown version is how those agents find the cleaner copy of the page.

What good looks like A link in the page head, with the relation alternate and the type text/markdown, pointing at the Markdown version of the page.

If robots.txt says one thing about AI training and the page or its Markdown copy says another, an AI client may follow the more permissive one. Some CDNs add a permissive default to Markdown responses when the site sent none, so the contradiction can appear without anyone writing it.

What good looks like The same content signals in robots.txt, in the page's response headers and on its Markdown version.

A discoverable manifest of skills an agent can use on your site.

What good looks like A valid Agent Skills index at /.well-known/agent-skills/index.json.

A machine-readable index of your APIs (RFC 9727) lets agents find and use them.

What good looks like A valid /.well-known/api-catalog.

Discovery metadata lets agents learn how to authenticate against protected resources.

What good looks like Valid OAuth authorization-server metadata at the well-known path.

RFC 9728 protected-resource metadata is how an MCP server tells an agent which authorization server guards it — the entry point of the MCP auth handshake.

What good looks like A valid /.well-known/oauth-protected-resource pointing at your authorization server.

OIDC discovery metadata lets agents and clients learn your token, authorization and JWKS endpoints without hard-coding them.

What good looks like Valid OpenID Connect discovery metadata at /.well-known/openid-configuration.

Web Bot Auth (IETF draft) lets a BOT OPERATOR cryptographically prove its traffic: the operator publishes signing keys on its own domain, and websites verify them. This one only applies if this domain operates a bot or agent — a normal publisher site has nothing to publish here, and that's expected.

What good looks like Only if you operate a signed bot or agent: a JWKS at /.well-known/http-message-signatures-directory on the domain your bot signs as, so the sites it visits can verify it.

UCP (Google) is how an AI shopping agent finds out what you sell without a human browsing your site. The agent appends /.well-known/ucp to your domain and reads a JSON manifest of your services, capabilities, payment handlers and API endpoints. Only relevant if you sell something — we don't check it otherwise.

What good looks like A JSON manifest at /.well-known/ucp declaring what you sell, how to transact, and which transports you support.

OAuth tells an agent how to authenticate. auth.md tells it how to register in the first place — the step before that. Without one, an AI agent acting for a customer has no documented way to get credentials for your service.

What good looks like A /auth.md describing your registration flows, scopes and endpoints, alongside your OAuth protected-resource metadata.

Two competing drafts let a domain announce its AI agent endpoints in DNS: AID, a community specification, and DNS-AID, an IETF draft. Neither is a ratified standard and they are not compatible with each other, so a missing record is expected.

What good looks like If you run an agent-facing service: a record in either draft's format that points to an endpoint that answers.