# AgentPass — the ARI-100 agent-readiness audit

The agent-readiness audit for sites that want to be read, quoted and operated by AI agents.

Updated November 9, 2026 · by Scott Scheferman · engine v1.0

Scan a URL and get a 100-point ARI-100 score, a letter grade, a 0–5 level, a per-crawler reachability matrix and a paste-ready fix pack. Free scan, no account.

- Scan form: https://www.agentpass.page/
- Pricing: https://www.agentpass.page/pricing
- Methodology: https://www.agentpass.page/methodology
- Dogfood — the six real sites we measure, with the delta and every check still open: https://www.agentpass.page/dogfood
- API docs: https://www.agentpass.page/api

## What one scan returns

| Output | What it is |
|---|---|
| Score | ARI-100, grade A+ to F, level L0 to L5 |
| Domain table | eight weighted domains, each with its own score |
| Crawler matrix | 32 named crawlers, verdict per agent |
| Fix pack | failing checks with id, weight, evidence and a prompt |

## The eight domains

| Domain | Weight | Checks | What it reads |
|---|---|---|---|
| Reachability & Access | 20 | 15 | robots.txt policy, live reachability for 32 named AI crawlers, indexability, interstitial and edge-block detection. |
| Render & Delivery | 10 | 11 | Server-rendered text before scripts run, status codes, soft-404 detection, TTFB, payload weight and text-to-markup ratio. |
| Structure & Semantics | 12 | 14 | Title, description, a single H1, heading order, self-canonical, language, social tags and control names. |
| Structured Data | 12 | 12 | JSON-LD that parses, page and entity types, sameAs identity, dates, breadcrumbs and price-vs-page agreement. |
| Discovery Files | 14 | 18 | Sitemap, llms.txt shape, llms-full.txt, Markdown mirrors, Accept negotiation, Link headers and the AGENTS.md build guide. |
| Agent Interfaces | 14 | 27 | OpenAPI, RFC 9727 catalog, RFC 9728 and RFC 8414 metadata, MCP card plus a live MCP handshake, A2A and error shapes. |
| Operability & Commerce | 10 | 13 | Search, cart form semantics, variant controls, price in server HTML, guest checkout and policy links. |
| Trust & Authority | 8 | 10 | Author, visible dates, outbound sources, about/contact reachability, legal name, HTTPS hygiene and broken links. |

## The crawler matrix

32 crawlers across 28 platforms: 11 AI search indexers, 8 live user agents, 11 training crawlers and 2 niche fetchers. 21 carry weight in the access score.

Each agent is fetched with its own user-agent string and matched against robots.txt with RFC 9309 longest-match rules. Verified-identity crawlers that answer differently to a verified IP are marked unverifiable and leave the denominator rather than being scored as blocked.

## How ARI-100 is computed

    domain_score = round(1000 * sum(weight * points) / sum(weight applied)) / 10
    core         = sum(domain_score * domain_weight) / sum(domain_weight)
    ARI-100      = min(100, core + min(5, emerging_signals_passed))

A pass earns its weight, a partial earns half, a fail earns nothing, and inconclusive or not-applicable checks leave the domain denominator. The bonus is capped at 5.

## Questions agents ask

### What does the ARI-100 score actually measure?

It measures the affordances an AI agent needs before it can read, trust and operate a site over plain HTTP: reachable robots policy, server-rendered text, stable structure, parseable structured data, discovery files, machine interfaces and a checkout path. Each check returns pass, partial, fail, inconclusive or not applicable, and the domain score is the weight-normalised sum.

### Why is a snapshot not a guarantee?

One scan is one request per surface at one moment. A CDN rule change, a bot-manager threshold or a redeploy can flip a verdict minutes later. Re-scan after every deploy, and treat the score as a regression test rather than a certificate.

### How do you test crawlers you cannot verify?

Every crawler is probed with its real user-agent string and checked against your robots.txt with RFC 9309 longest-match semantics. Verified-identity crawlers answer differently to a verified IP, so a rejection for them is labelled unverifiable instead of blocked, and it leaves the access denominator rather than being scored as a failure.

### Is the free tier a trial?

No. Scout stays free: one scan a day, the score, the domain table, the crawler matrix and the first three fix prompts. Paid tiers unlock the whole fix pack, higher API limits, history and a CI gate.

### Can a coding agent use the report directly?

Yes. Every fix carries the check id, weight, observed evidence and a prompt written to be pasted into an agent. GET /report/<host>.md returns the same content as Markdown, and the MCP tools scan_site and get_report return JSON over one POST.

## Standards

- [RFC 9309 — Robots Exclusion Protocol](https://www.rfc-editor.org/rfc/rfc9309)
- [RFC 9727 — API discovery linkset](https://www.rfc-editor.org/rfc/rfc9727)
- [RFC 9728 — OAuth protected resource metadata](https://www.rfc-editor.org/rfc/rfc9728)
- [llms.txt convention](https://llmstxt.org/)
- [Schema.org vocabulary](https://schema.org/)