The scanner behind Agent Readiness on StartupHub.ai is now open source under the MIT license as the package open-agent-readiness. That is the same scanner the website runs, scoring rubric web/2026.11. It scores how well a website works for AI agents: assistants that browse on a person's behalf, coding agents and MCP clients.
The one-line command npx open-agent-readiness scan in the code block below needs no account and no API key. We publish the source on GitLab and the npm package for anyone to inspect.
npx open-agent-readiness scan yoursite.comWhy we opened it
A score is easier to trust when anyone can read the code that produced it and run it on their own machine. The checks, weights and scoring formula were already published in agent-readiness-spec under CC BY-ND 4.0. Now the code sits next to the method. We have already scored more than 90,000 sites with the scanner.
Meta AI could not see the footer of our site because the page HTML was so large the fetcher stopped reading before it arrived. That is why the scanner checks HTML size and whether the headline with the first facts sits within the first 50 KB of the page. It also checks whether GPTBot, ClaudeBot, PerplexityBot, Bingbot, Googlebot and Meta's fetcher actually receive the page, not just what robots.txt allows.
What it checks
The scanner scores six categories: Discoverability, Content, Access Control, Capabilities, Commerce and Quality. A seventh row lists protocols that are detected but never scored. Those protocols appear for visibility while the score reflects only what agents use today.
| Category | What it checks |
|---|---|
| Discoverability | robots.txt, sitemap, Link header (RFC 8288), llms.txt discovery link, AGENTS.md or CLAUDE.md, on-site search URL |
| Content | Markdown content negotiation, llms.txt and its link notes, llms-full.txt, HTML size within agent limits, page text present in the HTML, facts near the top |
| Access Control | Browse bots can fetch the site, AI bot rules in robots.txt, what each AI and search client actually receives |
| Capabilities | MCP Server Card and live MCP endpoint, OpenAPI spec, OAuth discovery (RFC 8414, RFC 9728) |
| Commerce | Pricing and checkout pages reachable, Offer and Product structured data, payment links |
| Quality | OpenGraph, single H1, image alt text, meta description, canonical URL, JSON-LD and entity JSON-LD, security.txt (RFC 9116), JSON content negotiation |
| Shown, not scored | A2A agent card, Agent Skills, agentic registration, API catalog (RFC 9727), x402, x402-mesh, MPP and other agent payment protocols, Web Bot Auth, Content Signals, RateLimit headers |
Run it
npx open-agent-readiness scan <url> [options]
In a terminal the report shows a bar for each category. Below that the Fix first list ranks findings with the heaviest fix at the top, marked by a check, cross or warning sign. Every failing check includes a fix prompt that can be pasted into a coding agent such as Claude Code or Cursor.
For automation the scanner writes --json for the full result and --markdown for a report ready to paste into a coding agent. The package also installs the shorter alias agent-ready.
| Option | What it does |
|---|---|
| --json | The full result as JSON |
| --markdown | A report to paste into a coding agent |
| --min-score <n> | Exit with code 1 below n |
| --user-agent <ua> | User-Agent sent with every probe |
| --no-color | Plain output |
| --version | Print the version |
Fail a build when the score drops
# .gitlab-ci.yml
agent-readiness:
image: node:20
script:
- npx open-agent-readiness scan https://yoursite.com --min-score 70When the score drops below the --min-score value the job exits with code 1 and the build fails. That turns agent readiness into a check a team cannot quietly regress on. Any CI that runs Node.js works the same way, and the README shows a GitLab CI example.
Use it as a library
import { scan } from 'open-agent-readiness';
const result = await scan('https://yoursite.com');
console.log(result.total_score, result.grade);
for (const check of result.checks.filter((c) => c.status === 'fail')) {
console.log(check.title, check.fix_prompt);
}The result carries total_score, grade and a checks list where each failing entry includes a fix_prompt. It needs Node.js 18 or later and has no runtime dependencies. Every request passes a guard that refuses private, loopback and internal addresses. An offline test suite runs in CI on Node.js 18, 20 and 22. Every release ships with npm provenance that links the published version to the pipeline and commit that built it.
What is scored, and what is only shown
Protocols agents do not use yet are detected but never scored, including x402, A2A agent cards and MPP. No site loses points for skipping something no agent reads today. When agents start using a protocol, a later rubric version can move it into the score.
Bonus points for linking to StartupHub.ai were removed from the score. The open package adds a Submit a StartupHub.ai profile line to its Markdown report only with --startuphub-promo, which is off by default.
What the hosted scanner adds
The hosted scanner runs the same free scan as the open package. We added benchmarks against other scanned sites, plus score history that alerts when a score drops and badges you can publish. You can run it at startuphub.ai/agent-readiness, which also includes the Live Agent Run where real AI coding agents attempt tasks on the site. A free account includes three Live Agent Runs a month.
If a check gives the wrong answer, we learn most from that example. Please file the URL with what the check said as an issue on the source on GitLab, where merge requests are also welcome. Everything in one place is on the project page.
