Methodology · v1 · 2026-06-10

The Agent Readiness Methodology

The audit scores whether AI agents can discover, understand, access, operate, verify, and safely use a product. Six surfaces, each scored independently, each tied to remediation steps a contractor team can execute. The rubric is public so anyone can replicate the diagnostic; the value of the engagement is the prioritization, the business impact analysis, and the implementation sequence.

// surface 01

Discoverability

Can an agent find your product without prior knowledge? Discoverability covers everything an automated client encounters before parsing a page: robots policy, sitemaps, llms.txt, well-known endpoints, and the HTTP signals that tell a crawler what kind of surface this is.

·robots.txt correctness (no accidental Disallow on AI-relevant paths)
·Sitemap completeness and freshness across every public route
·llms.txt presence with stable anchors for the surfaces that matter
·/.well-known/agents.json, /.well-known/mcp/, and equivalent registries
·Link headers: service-desc, service-doc, describedby

// surface 02

Documentation clarity

Once an agent lands, can it understand what the page is? Documentation clarity covers semantic HTML, structured data, and the consistency between what humans read and what machines parse. A page that renders beautifully but ships no JSON-LD is invisible to retrieval pipelines.

·Schema.org coverage on every product, service, and pricing page
·JSON-LD validity (parses, no Google rich-results warnings)
·OpenGraph and Twitter cards consistent with on-page content
·Canonical and redirect chains that resolve cleanly
·Semantic HTML: one H1, sensible headings, lists where appropriate

// surface 03

API and workflow accessibility

Can an agent move from reading to doing? This surface covers whether your APIs, MCP servers, and workflow endpoints are documented in machine-readable form and reachable without out-of-band setup.

·OpenAPI specification published at a stable URL
·MCP server catalog or tool list discoverable
·Rate-limit headers documented and consistent with behavior
·Developer documentation parseable without JavaScript
·Versioning policy and deprecation signaling

// surface 04

Authentication and permissions

Can an agent get the right level of access without breaking? Auth is where agent integrations most often stall: missing OAuth metadata, ambiguous scopes, session handling that assumes a browser.

·OAuth metadata discoverable via well-known endpoints
·Scope names and effects documented unambiguously
·Token refresh and revocation flows behave deterministically
·Session handling tolerant of headless clients
·Permission errors return structured, actionable bodies

// surface 05

Error handling and recovery

When something goes wrong, can an agent recover? An agent that hits a 500 with an HTML error page has no path forward. Errors must be structured, idempotent retries must be safe, and partial failures must be surfaceable.

·Errors return JSON with machine-readable codes, not HTML
·Idempotency keys honored on retryable mutations
·Rate-limit responses include Retry-After
·Partial-failure semantics documented for bulk operations
·Webhook delivery includes replay and signature verification

// surface 06

Trust, governance, and observability

Is the agent's activity visible, governable, and safe? This surface covers the controls that make agent traffic a first-class citizen: bot policy that matches WAF behavior, header hygiene, audit logging, and a clear data-handling story.

·Bot policy declared in robots.txt matches what the WAF actually does
·User-agent rules consistent across CDN, origin, and analytics
·Crawler analytics surfaced so agent traffic is measurable
·Security headers (CSP, HSTS, X-Content-Type-Options) shipped
·Audit log retention and access documented

// scope clarification

Why this is different from Lighthouse, SEO, or SOC2

vs Lighthouse

Lighthouse measures whether a browser can render the page fast. It does not check whether an agent can parse the offering, find the API, or complete a task. A site can score 100 in Lighthouse and be entirely opaque to agents.

vs SEO audits

SEO audits optimize for search-engine ranking. Agent readiness includes that signal but also covers API discovery, auth flows, error semantics, and well-known endpoints, none of which appear in a typical SEO report.

vs SOC2

SOC2 audits control posture, not agent legibility. They confirm you have policies. Agent readiness confirms whether automated clients can do the work those policies are designed to govern.

// framing

What happens if you score badly?

A low score is the deliverable, not the failure. The audit's job is to tell you, with evidence, where the gaps are and which ones matter commercially. The remediation roadmap is the work product: a prioritized list of changes with severity, business impact, and effort, written as tickets your team can pull into a sprint.

Most engagements identify between 12 and 40 findings. Of those, 3 to 6 typically matter for the next two quarters. The rest are recorded for monitoring or backlog. We do not pad the report.

Run the methodology on your site.

The Agent-Readiness Gap Audit applies this rubric across all six surfaces and returns a scorecard, surface map, and prioritized remediation tickets.

See the audit →Apply

// get the next teardown

Get the next teardown

Technical teardown, no fluff. One email when the next agent-readiness teardown goes live.