{
  "markdown": "# agent-readiness-mcp — the free Agent Readiness Scanner\n\n[![M8ven Verified](https://m8ven.ai/badge/mcp/forgemeshlabs-agent-readiness-mcp-18acmq?variant=verified)](https://m8ven.ai/mcp/forgemeshlabs-agent-readiness-mcp-18acmq)\n\n[![agent-readiness-mcp MCP server](https://glama.ai/mcp/servers/forgemeshlabs/agent-readiness-mcp/badges/score.svg)](https://glama.ai/mcp/servers/forgemeshlabs/agent-readiness-mcp)\n[![agent-readiness-mcp MCP server](https://glama.ai/mcp/servers/forgemeshlabs/agent-readiness-mcp/badges/card.svg)](https://glama.ai/mcp/servers/forgemeshlabs/agent-readiness-mcp)\n\n**What's your ASO score?**\n\nSEO made you visible to search engines. **ASO (Agent Signal Optimization)** makes you discoverable, trustable, and payable by the AI agents that are becoming the web's next visitors.\n\n`agent-readiness-mcp` is the free, open-source **Agent Readiness MCP** — an [MCP](https://modelcontextprotocol.io) server that scans any website and produces an **Agent Readiness Report** scored on the open [ASO framework](https://agentsignaloptimization.com). The beta npm package is `@forgemeshlabs/agent-readiness-mcp`.\n\nThis release tracks Google's current agent-readiness guidance without overstating it: Google Search says traditional SEO fundamentals still apply to generative AI search, `llms.txt` is ignored by Google Search itself, and browser agents benefit from clean DOM, screenshot, and accessibility-tree signals. The scanner keeps `llms.txt` because non-Google agents use it, and adds a browser-agent UX check for semantic controls, linked labels, ARIA/role fallbacks, and hidden-overlay risk.\n\n> **Beta.** Experimental ASO scanner for evaluating whether agents can discover, trust, understand, and use a website/API/tool. ASO scoring is experimental and will evolve as agent standards mature.\n\n```\n=== Agent Readiness Report: https://example.com ===\nASO Score: 70/100\nAgent Readiness: Ready\nLevel: ASO-4 Trustable — Agents can verify trust, reputation, and operational signals.\n\nDiscoverability  20/20    Identity  15/20    Trust   11/15\nCommerce          5/15    Reputation 4/15    Memory  15/15\n```\n\n## What it checks — 34 signals across 6 pillars\n\nFind gaps in **discovery, trust, interoperability, and commerce** — every emerging agent standard in one scan:\n\n| Pillar / Category | Checks |\n|---|---|\n| **Discovery** | robots.txt, sitemap.xml, Link headers, DNS-AID (`_agent.<domain>`), `/.well-known/ai` |\n| **Content** | Markdown content negotiation, llms.txt, LLM-readable docs (`/index.md`, `llms-full.txt`) |\n| **Bot Access** | Explicit AI crawler rules (GPTBot, ClaudeBot, Google-Extended, PerplexityBot…), Content Signals, Web Bot Auth |\n| **Interoperability** | API Catalog (RFC 9727), OAuth discovery (RFC 8414), OAuth Protected Resource (RFC 9728), auth.md, **MCP Server Card** (`/.well-known/mcp/server-card.json`), **Google A2A Agent Card** (`/.well-known/agent-card.json`, required fields validated), Agent Skills, WebMCP |\n| **Commerce** | x402, MPP, UCP, ACP, machine-readable pricing |\n| **Identity & Trust** | HTTPS enforcement, JSON-LD/schema.org, agent-friendly browser UX, OpenAPI, agent.json, security.txt, status endpoint, versioning, cross-file identity & signal consistency |\n\nEvery check returns **pass / partial / fail** with concrete evidence and a fix recommendation. Results roll up into the six ASO pillars (Discoverability 20, Identity 20, Trust 15, Commerce 15, Reputation 15, Memory 15) → your **ASO Score** and maturity level.\n\n## Install\n\nRequires Node.js ≥ 18. Published on npm as [`@forgemeshlabs/agent-readiness-mcp`](https://www.npmjs.com/package/@forgemeshlabs/agent-readiness-mcp) — no clone or build needed.\n\n```bash\nnpm install -g @forgemeshlabs/agent-readiness-mcp\n```\n\nOr skip the install entirely and run it with `npx` (recommended for MCP clients):\n\n```bash\nnpx -y @forgemeshlabs/agent-readiness-mcp\n```\n\n### Claude Code\n\n```bash\nclaude mcp add aso -- npx -y @forgemeshlabs/agent-readiness-mcp\n```\n\n### Claude Desktop / Cursor / Windsurf (any MCP client)\n\n```json\n{\n  \"mcpServers\": {\n    \"aso\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"@forgemeshlabs/agent-readiness-mcp\"]\n    }\n  }\n}\n```\n\n### Development (from source)\n\nOnly needed if you're hacking on the scanner itself:\n\n```bash\ngit clone https://github.com/forgemeshlabs/agent-readiness-mcp\ncd agent-readiness-mcp\nnpm install && npm run build\nclaude mcp add aso -- node /path/to/agent-readiness-mcp/dist/index.js\n```\n\n## Tools\n\n| Tool | What it does |\n|---|---|\n| `scan_site` | Full ASO scan → Agent Readiness Report: ASO Score, level, pillar breakdown, all 34 checks with evidence + recommendations |\n| `get_fix_plan` | Prioritized remediation plan with ready-to-paste templates (robots.txt AI rules, llms.txt, agent.json, A2A agent card, MCP server card, x402 manifest, pricing.json, security.txt, status endpoint) |\n| `check_signal` | Run one specific check (e.g. `a2a-agent-card`, `llms-txt`, `x402`) |\n| `list_checks` | Catalog of every check with spec links |\n| `get_aso_framework` | The ASO rubric: pillars, weights, levels, certification thresholds |\n\nUse `scan_site` for a full baseline, `check_signal` for a single named signal, `get_fix_plan` for copy-paste remediation, `list_checks` to discover valid signal IDs, and `get_aso_framework` to explain the scoring model without scanning a site.\n\nTry it: *\"Scan example.com for agent readiness\"* · *\"What's my ASO score?\"* · *\"Give me a fix plan to make my site agent-ready.\"*\n\n### CLI smoke test (from a source checkout)\n\n```bash\nnpm run smoke -- https://your-site.com\n```\n\n## Glama / registry metadata\n\nThis repository includes `glama.json` for Glama MCP registry ownership and install metadata.\n\n- **Package:** `@forgemeshlabs/agent-readiness-mcp`\n- **Current release:** `v0.1.2`\n- **Transport:** local `stdio`\n- **Authentication:** none required for local `stdio` use. The scanner does not ask for API keys, tokens, cookies, or third-party credentials.\n- **HTTP deployment:** not enabled by this npm package. Any public HTTP deployment of this scanner must add authentication, per-client rate limits, request logging, and an egress policy before exposure.\n\nRecommended Glama/MCP install command:\n\n```bash\nnpx -y @forgemeshlabs/agent-readiness-mcp\n```\n\nExample usage after connecting the server to an MCP client:\n\n```text\nScan https://example.com for agent readiness.\nGive me the ASO fix plan for example.com.\nCheck only the llms-txt signal for example.com.\nList the ASO scanner checks.\n```\n\nRelease verification:\n\n- Git tag: `v0.1.2`\n- npm package: `@forgemeshlabs/agent-readiness-mcp`\n- MCP server version: `0.1.2`\n\n`v0.1.2` is the Agent Readiness TDQS refresh: it improves Glama tool-selection guidance, adds Glama badges, and keeps registry metadata ready for a refreshed Glama release.\n\n### Glama release build\n\nGlama installability requires a **Glama release**, which is a containerized build created from the Glama Dockerfile admin page, not a GitHub release. This repo includes a production `Dockerfile` and [GLAMA.md](GLAMA.md) with the build spec values to use in Glama:\n\nBuild steps:\n\n```text\nnpm ci\nnpm run build\nnpm prune --omit=dev\n```\n\nRuntime command:\n\n```bash\nnode dist/index.js\n```\n\nIn Glama's **CMD arguments** field, enter:\n\n```json\n[\"node\", \"dist/index.js\"]\n```\n\nDo not leave CMD arguments as `[]`; Glama validates that field separately from the Dockerfile `CMD`.\n\n## The ASO framework\n\n> SEO ranks pages for people. ASO prepares services for agent selection, invocation, payment, and repeat use.\n\n| Level | Name | Score |\n|---|---|---|\n| ASO-0 | Invisible | 0–9 |\n| ASO-1 | Discoverable | 10–29 |\n| ASO-2 | Understandable | 30–49 |\n| ASO-3 | Invocable | 50–69 |\n| ASO-4 | Trustable | 70–89 |\n| ASO-5 | Autonomous-Commerce-Ready | 90–100 |\n\nScores from this scanner are directional self-assessments. **ASO Certification** (ASO-3+) requires verified evidence — see the [scoring rubric](https://agentsignaloptimization.com/docs/ASO-SCORE.md) and [agentsignaloptimization.com](https://agentsignaloptimization.com) for audits, certification, and the full framework.\n\n## Security\n\nThis scanner makes outbound requests to URLs you give it, so it is built to resist SSRF abuse:\n\n- **Scheme allow-list** — only `http`/`https`; `file:`, `ftp:`, `gopher:`, `data:` etc. are rejected.\n- **Private-target blocking** — after DNS resolution, requests to loopback, private (RFC 1918), link-local, CGNAT, reserved, multicast, and the cloud metadata address (`169.254.169.254`) are refused. IPv6 loopback/ULA/link-local and IPv4-mapped forms are covered too. If a hostname resolves to *any* private address, the scan is refused.\n- **Pinned-IP transport** — each request dials the exact public IP that was validated, while TLS still verifies the original hostname. This closes the validate-then-connect DNS rebinding window.\n- **Manual redirect validation** — automatic redirect following is disabled; every hop is re-validated against the same rules, capped at 5 redirects. A public URL that 30x-redirects to an internal address cannot slip through.\n- **Untrusted remote content** — parsed manifests are omitted from tool output by default (`include_artifacts: true` to opt in, and they are then explicitly labeled untrusted); embedded text excerpts are control-char-sanitized and length-capped. Treat any returned remote content as data, never instructions.\n- **Bounded** — `GET` only, `ASO-Scanner/1.0` UA, max 6 concurrent, 10s timeout, 512KB body cap. Never authenticates, never POSTs, never crawls beyond well-known paths.\n- **Tested hardening** — `npm test` covers unsafe URL rejection, private IP ranges, artifact sanitization, redirect blocking, redirect hop caps, and the test-only loopback escape hatch.\n\n**Deployment:** `stdio` (local, per-user) is the safe default. A public **HTTP** deployment is a network-egress tool and **must** add authentication, per-client rate limiting, request logging, and an egress policy before exposure.\n- Reputation signals (citations, reviews, success rates) cannot be auto-verified by a crawler; they are reported as `manual` and scored 0 until verified by audit — so the auto-verifiable maximum is 89/100. That is intentional honesty, not a bug.\n- Emerging specs (MCP Server Cards SEP-1649/SEP-2127, DNS-AID, Web Bot Auth, UCP/ACP/MPP) move fast. PRs updating paths welcome.\n\n## Source alignment\n\nThis package intentionally separates Google Search guidance from broader ASO guidance:\n\n- Google Search generative AI features still rely on core Search ranking and quality systems; foundational SEO, crawlability, helpful content, and technical clarity remain the priority.\n- Google Search does not use `llms.txt` or special AI markdown files for ranking or AI Overviews/AI Mode visibility. ASO still checks them because other agents and MCP clients can use them.\n- Google/web.dev's agent-friendly site guidance focuses on browser-agent usability: stable layouts, semantic HTML, labels tied to inputs, meaningful roles/names/states, and avoiding hidden overlays.\n- UCP, AP2, A2A, MCP, x402, DNS-AID, Content Signals, and Web Bot Auth are emerging non-SEO protocols. The scanner treats them as agent-readiness signals, not as Google Search ranking factors.\n\nPrimary references:\n\n- https://developers.google.com/search/docs/fundamentals/ai-optimization-guide\n- https://web.dev/articles/ai-agent-site-ux\n- https://ucp.dev\n\n## License\n\nMIT — free for everyone. If the scanner found gaps, the [ASO framework](https://agentsignaloptimization.com) shows you how to close them.\n",
  "bytes": 11509,
  "sha": "bf0e798543a577caa2a1e925f6d0a5ac7410908040d73f7b601a367d29901c2c",
  "repo_slug": "forgemeshlabs/agent-readiness-mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_forgemeshlabs_agent_readiness__2f7f7202/readme"
}