# Agent Ready — The Agent Readable Website > Markdown (GEO/AEO) version of . Author: **Mauricio Yokoyama Issei** · en-BR · Published: 2026-09-07 · Updated: 2026-09-07. ## In short **Agent Readiness** is not a list of files in `/.well-known/`. It's treating the agent like a **third first class consumer** — arriving without a session, without layout and without context — and publishing by machine reading, **what exists**, **in which format**, **under which rules** and **with which credential**. - **Discoverable** — explicit discovery in independent layers: DNS, header `Link` (RFC 8288), `robots.txt`, sitemap. - **Readable** — content negotiation: `Accept: text/markdown` in the same URL, with `Vary: Accept`. - **Controllable** — machine-readable rule: `Content-Signal: ai-train=no, search=yes, ai-input=yes`. - **Callable** — invocable contracts: API Catalog (RFC 9727), MCP Server Card, Agent Skills with digest, WebMCP. ## The five layers of discovery The agentic surface of this site is published in five independent layers among each other: (1) DNS — HTTPS/SVCB records under agents., resolved before any HTTP and validated by DNSSEC; (2) HTTP header — Link (RFC 8288) with seven relationships in every response, plus Vary: Accept; (3) /.well-known/ — api-catalog (RFC 9727), ai-catalog.json, mcp/server-card.json, agent-card.json, agent-kills/index.json, oauth-protected-resource (RFC 9728), openid-configuration and oauth-authorization-server; (4) auth — auth.md in prosa plus Oauth metadata; (5) runtime — tools registered in navigator. modelContext (WebMCP). None of them depend on the other: the agent enters by anyone, because you do not control which one the client knows. ## Markdown Content Negotiation The same URL responds HTML to browsers and Markdown to those who send Accept: text/markdown. The implementation lives in a function on the edge of the CDN that compares the q quality values of text/markdown and text/html according to RFC 7231 §5.3.2 — a browser sends text/html,...,*/*;q=0.8 and cannot receive Markdown. Two guards are mandatory: issue Vary: Accept, without which CDN delivers the wrong cached version; and exempt /.well-known/ from any extension suffix rule, since there names have no extension per IANA record. ## Machine-readable usage control Robots. txt answers if the bot can fetch; Content-Signal answers what he can do later. There are three independent decisions — search, ai-input and ai-train — and they deserve independent answers. In this site: Content-Signal: ai-train=no, search=yes, ai-input=yes. A check that goes through no blocking is not the same as a check that goes through the presence of a rule: if your policy differs by agent, you need to write it. ## Invocable contracts API Catalog (RFC 9727) publishes a linket with service-desc, service-doc and status per resource. The OAuth metadata (RFC 8414 and RFC 9728) declare scopes, authorization server and policy; auth.md describes the prose flow for the agent to read — including when access is anonymous, because declaring anonymous identity prevents the agent from trying a nonexistent flow. Agent Skills publishes reusable procedure with digest SHA-256, which makes verifiable the instruction that enters the context of the model. WebMCP logs tools in navigator. modelContext behind a test of existence, degrading in silence where API does not exist. ## How to test and what the score does not prove Run the scan by POST in https://isitagentready.com/api/scan and read the JSON: the interface remediation text is fixed by check and does not change between attempts, while the evidence indicates which validator failed. Correct one check at a time, publish — the scan runs against production, not against the repository — and write a test for every check you pass. On the limits: Discovery Checks validate documents, not runtime; only declare the capabilities that you sustain and test each one by actually exercising it. Neutral checks don't penalize the note, so they don't testify to anything either. A score 100 means that the site passed the checks of that instrument in that configuration on that date. ## Frequently Asked Questions **What is Agent Readiness?** Agent Readiness is the property of a site whose public surface is designed to be consumed by autonomous software: the resources are discoverable by explicit mechanism, the content is delivered in the format the agent requests, the rules of use are declared legible by machine and the available actions are published as invocable contracts. It's a new layer on HTML, SEO and AEO — not a replacement of any of them. **What does it mean to be Agent-Ready?** It means that an agent can answer four questions about his website without guessing: what features there are, in which format he can read them, what he can do with the content and how he invokes an action. A bot-only site responds to 200 and does not block; an agent-ready site transfers to itself the burden of inference, publishing each of these responses verifiably. **How to reach score 100 on IsItAgentReady?** Implementing the categories in order: discovery (robots.txt, sitemap, header Link RFC 8288, DNS records with DNSSEC), content accessibility (access negotiation: text/markdown with Vary: Accept), access control (Content Signals), and protocol discovery (API Catalog RFC 9727, OAuth RFC 8414/9728 metadata, auth.md, MCP server card, A2A agent card, Agent Skills and WebMCP). Fix one check at a time, publish, and read the evidence in the JSON scan instead of the generic text of the interface. **What's Markdown for agents?** It is delivering the same URL in Markdown when the client sends Accept: text/markdown, by content negotiation (RFC 7231 §5.3.2). An application page with 197 KB of HTML usually fits in a few KB of Markdown — on this site, 3.7 KB for the same text, 52 times less bytes. Two traps: compare q quality values, since a browser sends */*;q=0.8 and cannot receive Markdown, and issue Vary: Accept for CDN does not serve the wrong version. **What is an MCP Server Card?** It is a JSON document in /.well-known/mcp/server-card.json that describes, in a machine-readable way, which tools and features a domain exposes by the Model Context Protocol: server name, transport, typed input tools and downloadable features. It is the layer of discovery — the description of the contract. Post on it exactly the capabilities you are ready to sustain. **What are Agent Skills?** Agent Skills publish reusable procedure, not given: each skill is a SKILL.md file with instructions on how to do something in that domain, listed in an index.json with the URL and digest SHA-256 file. The digest is the central point — instruction that enters the context of a model is the surface of attack, and the digest allows the agent to verify that it carried what the index promised. **How do agents find APIs?** By the RFC 9727 Catalog API: a linket in /.well-known/api-catalog that, for each feature (anchor), lists typed links — service-desc for machine-readable specification, service-doc for prose documentation, status for the state. The same catalogue can be advertised on the Link header (RFC 8288), which allows the agent to discover everything with a HEAD request, without downloading page or knowing path convention. **How to control access to AI bots?** With two complementary layers. The robots.txt (RFC 9309) responds if the bot can fetch. The Content-Signal directive answers what it can do after it has sought, separating three independent decisions: search (appearing in search), ai-input (being used as source of a generated response) and ai-train (turn training data). To distinguish bots from each other by cryptographic identity, there is also Web Bot Auth, based on HTTP message signature. **How to test if a website is Agent-Native?** Run a scan on the IsItAgentReady — by the interface or by POST in the API — and read the JSON, not the interface remediation text, which is fixed by check and identical on every site that fails that check. The real signal is in the detail of the evidence, which indicates which validator failed. Then fix one check at a time, publish (the scan runs against production, not against the repository), rescan and write a test for each check you have passed. **Does a score 100 mean the site is perfect for agents?** Nope. It means something precise and limited: the site passed the checks that that instrument considered, in that configuration, on that date. Discovery checks validate documents — which the file exists, is valid JSON and has mandatory fields — and do not connect with what the document describes. In addition, neutral checks do not penalize the note and therefore do not attest anything: an instrument that does not punish the absence does not certify the presence. ## Glossary - **Agent Readiness** — Public surface designed for consumption by autonomous software: discoverable, legible, governed and invocable. - **Agent-Native** — Level at which the site publishes invocable and undiscoverable contracts, not just accessible content. - **Header Link (RFC 8288)** — Announce related features in HTTP header; the agent discovers the surface with a HEAD. - **Content negotiation** — Serve different formats in the same URL as the Accept header, with Vary: Accept. - **Content Signals** — Directive on robots. txt declaring permitted uses: search, ai-input and ai-train. - **API Catalog (RFC 9727)** — Linkset on /.well-known/api-catalog indicating specification, documentation and status of each resource. - **PRM (RFC 9728)** — OAuth Protected Resource Metadata: what scopes the resource requires and where the policy is. - **auth.md** — Markdown document describing the prose authentication stream for the agent to read. - **MCP Server Card** — Machine-readable description of the tools and features that a domain exposes by MCP. - **A2A Agent Card** — Declaration of skills that a domain offers to other agents (Agent2Agent). - **Agent Skills** — SKILL.md reusable procedures indexed with digest SHA-256 verifiable. - **WebMCP** — Tool log on navigator. modelContext: the only layer in runtime. - **DNS-AID** — HTTPS/SVCB records under agents. announcing agentic entry points; requires DNSSEC. - **Web Bot Auth** — Bot identity proven by HTTP message signature, instead of declared in User-Agent. *© 2026 Mauritius Yokoyama Issei. Citable content with assignment (fair use educational).*