Is your site agent-ready? A check for MCP, A2A, OAuth discovery and Content Signals

Most advice about "AI-ready" sites stops at one thing: let the crawlers in. That is the right first step and it is also the easy one. The question this site cares about is the next one. If an agent shows up, not to read a page but to get something done, does your site tell it what it can do?

That is a different test from visibility. A visibility tracker asks whether your brand appears in answers. An agent-readiness check asks whether software acting on someone's behalf can reach you, understand you and, where you choose, act on your services. The two overlap, but a site can pass one and fail the other.

Two layers, and why they differ

Layer one: access. Can AI crawlers fetch your pages at all? This is governed by robots.txt, by your CDN or firewall rules, by login walls, by rendering, and by plain errors. It is the layer that decides whether you can be read, and it is where most real problems live. A blanket disallow added during a staging scare can sit in production for a year.

Layer two: declaration. Does your site publish machine-readable statements about itself and its capabilities? These include:

• llms.txt, a plain-text file describing the site for language models. Be careful here. We have no evidence that any particular engine relies on it, and you should not promise a client that it changes citations. Our post on whether llms.txt is required for AI search optimization goes through that debate. Publishing one is cheap, and it is a reasonable thing to do, but it is not a lever with proven effect.
• MCP server cards, which describe a Model Context Protocol server your site or product exposes, so that agents can discover tools.
• A2A agent cards, the discovery document for the Agent2Agent protocol, which describes an agent and what it can do. See Agent2Agent and AI search.
• OAuth discovery, the metadata that lets an agent find out how to authenticate against your service.
• Content Signals, a way to state in robots.txt how you want your content used, such as for search, for AI input or for training.

Most content sites will not need an MCP server or an A2A card. A SaaS product with an API often should think about it. A publisher cares most about Content Signals and access. Know which of the five apply before you chase a score.

A checklist you can run in an afternoon

1. Read your own robots.txt. List every user agent it blocks. Compare against the AI crawlers you actually want: GPTBot, OAI-SearchBot, ChatGPT-User, ClaudeBot, Claude-User, Claude-SearchBot, PerplexityBot, Perplexity-User and the Google and Meta agents. There is no crawler called "ChatGPTBot," so a rule with that name does nothing.
2. Decide on training versus search. Some sites want to be fetched for answers but not used for training. Different bots, and different rules. Make that choice on purpose.
3. Test from outside. Request key pages as each major bot would, from an address outside your network. CDN bot rules, WAF challenges and geoblocking often block crawlers even when robots.txt allows them.
4. Check rendering. If your key content only appears after client-side scripts run, a crawler that does not run them sees a shell.
5. Check sitemaps and status codes. Sitemaps should list live canonical pages. Errors and long redirect chains waste fetches.
6. Look for declarations you already have. An existing API with OAuth probably has discovery metadata already. An existing MCP server may lack a card. List what you have before you build anything.
7. Write the decision down. For each of the five declarations: needed, not needed, or later. A documented "not needed" beats an accidental gap.

The free check Promptwatch shipped

On September 8, 2026, Promptwatch released the Agentic Readiness Check as a free tool. You enter a domain and it shows which AI crawlers can reach the site and which agent standards it supports, including llms.txt, MCP, A2A, OAuth discovery and Content Signals. Every result gets a shareable page. In the product notes, the robots.txt test runs against nine AI crawlers and the rest are probes for the standards listed.

A related free tool, the AI Visibility Report, launched on September 1. You enter a website and a live scan reads robots.txt, extracts what AI thinks you do, then asks real engines the questions buyers ask. In a couple of minutes you get scores for visibility, mentions, position, citations and whether AI crawlers can read the site. Its agent readiness section checks robots.txt, llms.txt, sitemaps and crawler access, with a fix list you can copy as a prompt. Neither requires a login for the scan.

Use them for a quick baseline. Treat the result as a first pass, not a verdict. A check from outside cannot see your WAF logs, and a pass on robots.txt does not prove a bot got through.

Turning the baseline into an agent-run loop

A one-off check goes stale. The useful move is to make it recurring and to confirm it against real traffic.

The weekly site audit in Promptwatch covers crawlability checks, 21 checks in all, and an email each Tuesday lists the issues AI crawlers may trip over. That keeps the access layer under watch. It does not replace logs.

For evidence, use crawler logs. They are IP-verified, so spoofed user agents are filtered out, and they list actual requests by bot, with errors and failure explanations. They start on Professional, and Essential has none. If a check says GPTBot is allowed but your logs show it never arrives, or arrives and meets 403s, you have found the real problem, which a robots.txt read cannot show. Our post on an agent that reads crawler logs and proposes robots.txt fixes shows that loop.

If you want an agent in the middle of it, Agent Chat can look at crawler data and the audit and suggest fixes, but robots.txt and firewall edits should stay behind a human approval. A bad edit can lock out every bot at once.

What this does not tell you

It does not tell you whether you will be cited. Access is necessary, not sufficient. You still need content that answers the question and sources that engines trust.

It does not tell you that any engine honors a given declaration. Content Signals, llms.txt and agent cards are statements of intent. Support varies and changes, so check each one's current status before you build around it.

And it says nothing about whether you need agent-facing services at all. For the wider framing, read agentic search explained and agent experience optimization for websites.

Our recommendation

Start with the free check, fix what it flags in robots.txt and your CDN, then move to evidence. Promptwatch is where we would take it next, since the readiness check, the weekly audit, the IP-verified crawler logs and the citation data sit together, so you can see not only whether an agent could reach you but whether one did. Remember the floor on logs: Professional and above.