Agent readiness

A checklist for making your site AI-agent ready — what aardvark publishes for you on every build, and the few steps only you can do (a Web Bot Auth key, DNS-AID records, real OAuth) to score well on isitagentready.com.

isitagentready.com (Cloudflare’s Agent Readiness Scanner) grades how well a site cooperates with AI agents: can they discover it, read it, learn the rules, and find its machine interfaces? aardvark publishes almost all of those signals automatically on every vark build — this page is the checklist, so you can see what’s already handled and do the handful of steps only you can do.

How the score works

The scanner runs a set of named checks grouped into five categories and reports a level (the top rung is Agent-Native). Four categories count toward your level:

A fifth category, Commerce (x402, MPP, UCP, ACP, AP2), is reported but does not count toward your score — it only applies to shopping/checkout sites, so a docs or marketing site can ignore it.

What aardvark publishes for you (no work required)

Most are emitted on every build with no configuration — set baseUrl in aardvark.config.yaml, deploy over HTTPS, and they pass. A few are conditional, as the Notes column calls out: WebMCP rides on mcp: true (MCP is opt-in), the API catalog appears once you embed OpenAPI specs, and the Agent Skills index lists whatever skills/ you ship.

See Agent discovery and Generated files for the details of each. The takeaway: out of the box, with just a baseUrl, an aardvark site already clears most of the scanner.

Hand this site to an agent (the page menu)

Discovery files help an agent that already found your site. To let a reader point their own agent at it, the “View in Markdown” menu at the top of every page also offers one-click hand-offs (all on by default, hidden per item under markdownMenu):

The generated artifacts (built once per vark build, no config beyond markdownMenu):

• /_aardvark/<slug>-docs-skill.zip — the downloadable skill (also published into the /.well-known/agent-skills/index.json discovery index above, so agents find it like your other skills).
• /_aardvark/<slug>-docs-plugin.zip — a single Claude plugin (the skill and, when mcp: true + a baseUrl, the MCP server) for the Claude apps: Customize → Plugins → upload a custom plugin file.
• /_aardvark/<slug>-docs-marketplace.zip — the same plugin wrapped in a local marketplace for the Claude Code terminal; add it with /plugin marketplace add ./<slug>-docs-marketplace then /plugin install.
• /.well-known/claude-plugin/marketplace.json — a hosted marketplace, so /plugin marketplace add {baseUrl}/.well-known/claude-plugin/marketplace.json installs the MCP server in one command (written when installPlugin is on — the default — plus mcp: true and a baseUrl).
• /_aardvark/agent-setup.html — the “Install Plugin” link target: a benefit-led page that walks a reader through installing the plugin in the Claude apps AND the Claude Code terminal.

To turn an item off, set it under markdownMenu (e.g. markdownMenu: {copyMcp: false}); every item defaults on. Copy MCP additionally requires mcp: true, and Install Assistant requires the assistant app to be built.

What only you can do

A static-site generator can’t generate a cryptographic identity for you, operate your DNS, or run your identity provider. These steps are yours:

1. Publish a Web Bot Auth key

Web Bot Auth lets your site identify itself when an agent sends signed requests on its behalf. The scanner looks for a JWKS (a set of public keys) at /.well-known/http-message-signatures-directory. aardvark publishes that directory — you just provide a public key.

Generate an Ed25519 keypair:

vark web-bot-auth-keygen

Private key — store as a secret; your signing agent needs it (NOT recoverable):
  <PRIVATE_KEY>

Public key — add to aardvark.config.yaml:

  webBotAuth:
    keys:
      - <PUBLIC_KEY>

Then add the public key to aardvark.config.yaml:

webBotAuth:
  keys:
    - <PUBLIC_KEY>   # the PUBLIC key from the command above

Listing a key turns the feature on; the next vark build writes the JWKS. Keep the private key out of your repo — store it as a secret wherever your signing agent runs (aardvark never holds it, and the public directory is safe to commit). aardvark only publishes the directory; it never signs requests itself. Full reference: Web Bot Auth.

2. Publish your DNS-AID records (and enable DNSSEC)

DNS-based Agent Interface Discovery is validated over DNS-over-HTTPS against your authoritative nameservers — so no HTTP server, vark serve included, can make it pass. aardvark writes a copy-pasteable zone file for you at /.well-known/dns-aid/records.zone; you publish it:

Configuration and the full walkthrough live in Agent discovery.

3. Point OAuth at your IdP

aardvark always advertises OAuth 2.1 / OpenID Connect discovery metadata (derived from baseUrl as labelled examples if you set nothing), so the discovery checks pass on a fresh build. For a real deployment, point the oauth block at your actual identity provider (for example Cloudflare Access) and fill in the oauth.agentAuth sub-block so auth.md advertises how an autonomous agent registers and proves identity:

oauth:
  issuer: https://your-idp.example.com
  authorizationEndpoint: https://your-idp.example.com/authorize
  tokenEndpoint: https://your-idp.example.com/token
  jwksUri: https://your-idp.example.com/.well-known/jwks.json
  agentAuth:
    registerUri: https://your-idp.example.com/oauth/register
    identityTypesSupported: [service_account, delegated_user]
    credentialTypesSupported: [client_secret, private_key_jwt]

aardvark is not an OAuth server — these documents only point agents at where to authenticate. See Agent discovery for every field.

Full checklist

Every scanner check, who handles it, and where to configure it:

Verify your score

After deploying, re-run the scan:

curl -X POST https://isitagentready.com/api/scan \
  -H 'Content-Type: application/json' \
  -d '{"url": "https://YOUR-SITE.com"}'

Or just open isitagentready.com and enter your URL. A check that reads unableToCheck is usually a fetch timeout, not a failure — re-run it. For Web Bot Auth specifically, confirm checks.botAccessControl.webBotAuth.status is "pass".

Known gaps

• A2A Agent Card (/.well-known/agent.json): aardvark advertises an A2A entry in its DNS-AID records but does not yet generate the agent card document itself. If you need this check, ship the card as a static file under static/.well-known/.
• Commerce checks: out of scope for a docs/marketing site and excluded from the score.