Local candidate methodology
How the 67-check diagnostic works
Version mvp-2026-10-23-r4; reviewed 2026-10-23. This is a bounded local development candidate, not production scanning, a benchmark, certification or proof of real agent behavior. The complete inventory is 48 readiness checks plus 19 compatibility checks. Two experimental discovery checks are observational and non-scoring. No PAP support is claimed.
Evidence and customer states
Pass means the complete captured evidence meets the supported test. Fail means complete captured evidence demonstrates a defect. Not assessed means a reserved action was excluded, a profile has no weight, or a completed request confirmed the optional discovery file was absent. Inconclusive means the necessary evidence was unavailable, incomplete, blocked or outside the budget; it is never converted into a pass. Partial credit and unknown evidence remain qualified in the detailed record. All 67 outcomes remain visible even when a score is withheld.
Profiles, points and seven categories
WEB: general websites; SERVICE: service businesses; API: developer/API services; ECOM: ecommerce. Existing readiness weights total 100 in each profile. Compatibility adds WEB 17, SERVICE 17, API 17, ECOM 16 points before normalization. Categories are Discoverability, Comprehension, Interaction, Protocols, Trust, Tasks, and Agent compatibility. Each category divides earned points by its eligible points; the overall score uses the combined eligible weight, not an average of category percentages.
Original points minus owner-only and genuine runtime-not-applicable exclusions equals applicable scoring points. Missing or unverified applicable checks stay in that denominator and earn zero credit. Each result earns weight × outcome factor × evidence cap. Pass factor is 1, partial is 0.5; fail, unknown, not assessed and inconclusive earn zero. Profile-native zero, reserved verification-only checks and observational/optional checks earn no score points. A diagnostic failure is still shown and is never highlighted as an opportunity to raise the score.
Evidence caps and coverage
Evidence tiers are declared (D), observed read-only (O), and verified execution (V). No verified action runs in this anonymous candidate. Caps for required D with none/D/O/V evidence are 0/1/1/1; for required O: 0/0.25/1/1; for required V: 0/0.1/0.5/1. Coverage is the observed or verified weight divided by original weight minus owner-only and runtime-not-applicable weight. Inconclusive checks remain in that coverage denominator.
Score bands and withholding
Strong: at least 85/100 and at least 75% evidence coverage. Capable: at least 70, or at least 85 with coverage below 75%. Limited: at least 50 and below 70. Not ready: below 50, or an observed critical failure. Missing or unverified readiness earns no points. The score and label are withheld only when the primary web document was not successfully observed, the scoring denominator cannot be reproduced, or applicable scoring scope is empty. Evidence coverage is disclosed separately; no scanner limitation is presented as an observed site defect. A published score is a sampled readiness heuristic and does not imply that a task journey was completed.
Bounded observation and supported discovery conventions
The raw HTTP phase uses at most seven requests/resources, 2 MiB aggregate, 512 KiB per response and 10 seconds for that phase, clamped further by the manifest and shared budget. These are raw-phase limits, not whole-scanner maxima. Raw HTTP and rendered observation consume the same manifest-owned request, byte and elapsed-time budget. When the manifest permits, seven raw HTTP requests plus one browser attempt can use eight total attempts; no phase may exceed the shared manifest allowance. It reserves the primary page, robots, agents.md, agent.json, sitemap and llms.txt before one optional document or representative page. This reduces optional coverage. A separate controlled loopback fixture uses at most six requests, 64 KiB and two redirects. Raw and rendered comparisons share one bounded render; a crash or cancelled render is inconclusive.
The raw/rendered heuristic requires 400 normalized Unicode characters of substantive raw content and no empty application mount. Scripts, styles, templates and comments do not supply that content. 399 fails the disclosed threshold; 400 and 401 can pass only with complete matching core facts. Short real pages may fail this heuristic; it is not a universal quality standard. Structure requires one actual meaningful visible H1, no forward heading-level skip, title, main content and landmark. Hidden headings do not count; an empty second H1 still violates the one-H1 rule.
Only /agents.md and /.well-known/agent.json are probed for the new experimental checks. agents.md accepts complete UTF-8 plain text or Markdown, a meaningful primary heading, at least 32 characters of identity/description prose and an offer, services, products, capabilities, interaction, usage, how-to or contact section. At most 1,000 lines, 4,096 characters per line and 32 inline Markdown links are supported; reference links are inconclusive. Relative inline links are allowed and resolve against agents.md. Every resolved URL must use HTTPS without credentials, query or fragment; an invalid URL shape fails the document. Otherwise-valid uncaptured links remain inconclusive. Link reachability requires exact completed matching captures: URL syntax is insufficient. Only the fixed same-origin /readiness.md Markdown follow-up may use the remaining slot after explicitly declared critical documents and before a representative page or negotiation. It uses anonymous GET with Accept: text/markdown and retains source-binding, robots, destination and receipt restrictions. Other uncaptured Markdown paths, including /docs/guide.md, remain inconclusive and are not dispatched. Otherwise-valid uncaptured links remain inconclusive. JSON accepts application/json or a +json media type, an object with name and description of 3–512 characters and an endpoints array of 1–16 absolute HTTPS strings, each at most 2,048 characters and without credentials, query or fragment. This is the candidate’s supported convention shape, not universal standard conformance. Parser exhaustion is inconclusive; advertised endpoints are never invoked. Completed 404/410 is not assessed; failed retrieval is inconclusive.
Robots operator tables reuse one captured robots body, separately selecting declarations for eight named tokens and the submitted page only. A declaration is not observed crawler behavior or network enforcement. Allowing does not guarantee inclusion, citations, referrals or traffic; training and search have different purposes. User-triggered provider exceptions are disclosed in the report. Missing or unvalidated observations show not observed.
Every check, in result order
Weights are original points before applicability and evidence exclusions. Tests describe the supported bounded observation; they do not promise every surface was captured. Reserved rows run no action. Free guidance remains generic; exact site changes and tailored remediation belong to the paid Action Plan.
| Check | How tested and limits | WEB | SERVICE | API | ECOM | Score role |
|---|---|---|---|---|---|---|
| Your site loads over a secure connection without dead ends | Canonical URL resolves without a loop and ends in successful HTTPS web content. | 4 | 3 | 3 | 3 | Weighted where applicable |
| Clear rules for which pages assistants may visit | The documented scanner identity receives a parsed, recorded robots policy for sampled public paths. | 4 | 3 | 2 | 3 | Weighted where applicable |
| A working map of your site's pages | A discovered sitemap is parseable, canonical, and contains representative usable URLs. | 4 | 3 | 1 | 3 | Weighted where applicable |
| Your key pages are easy to find | Representative sampled offering, content, documentation, or product routes are reachable through stable crawlable paths. | 3 | 2 | 3 | 2 | Weighted where applicable |
| Your message is the same however it's read | Complete raw/rendered comparisons preserve core facts, including agreement on absent families; raw substantive text must contain at least 400 normalized Unicode characters and no empty application mount. This is a candidate heuristic; incomplete comparisons are inconclusive. | 3 | 2 | 4 | 2 | Weighted where applicable |
| Clear boundaries for AI access | The complete captured robots policy separately declares training, search, and user-directed retrieval preferences; missing supported class declarations or observed invitation conflicts fail this sampled criterion. | 2 | 2 | 2 | 2 | Weighted where applicable |
| Your AI agent is easy to discover | The canonical same-origin A2A Agent Card is safely retrievable; a typed service-desc Link is recorded as a secondary discovery signal. | 0 | 0 | 1 | 0 | Weighted where applicable |
| Your agent guide is discoverable and usable | The complete canonical agents.md is UTF-8 text/plain or text/markdown, with a meaningful heading, identity and offer or interaction section; required links need complete matching safe captures. Missing files are not assessed; incomplete evidence is inconclusive. Experimental non-scoring diagnostic. | 0 | 0 | 0 | 0 | Experimental observational diagnostic; non-scoring |
| It's clear who you are and how to reach you | Each complete sampled page states consistent visible business identity, purpose and contact/support facts, with an explicit location for SERVICE profiles; completed absence fails. Structured-data accuracy is assessed separately. | 4 | 5 | 2 | 3 | Weighted where applicable |
| Your offer, audience, and next step are stated plainly | Each complete sampled page states its offer, audience and next action in text; completed absence fails. Captured material constraints must agree across raw and rendered views; absent constraints are not invented. | 5 | 5 | 3 | 3 | Weighted where applicable |
| Prices and key facts are unambiguous | Applicable price, currency, availability, eligibility, limits, policy, and timing facts are unambiguous. | 4 | 5 | 2 | 4 | Weighted where applicable |
| Your page structure carries meaning | A complete ready snapshot has a nonempty title, exactly one meaningful visible H1, no skipped forward heading level, visible main content and a semantic landmark; links, lists/tables and text alternatives preserve meaning. | 4 | 3 | 2 | 3 | Weighted where applicable |
| Your behind-the-scenes business data is accurate | Structured data is valid for the observed entity, canonical, and free of unsupported claims. | 3 | 3 | 2 | 3 | Weighted where applicable |
| Your facts agree everywhere they appear | Visible text, structured data, feeds, metadata, cart facts, and policies agree on material facts. | 3 | 3 | 2 | 3 | Weighted where applicable |
| Time-sensitive facts look current — or say so | Time-sensitive facts have useful update/provenance signals and stale content is not presented as current. | 2 | 1 | 2 | 1 | Weighted where applicable |
| Your AI agent publishes a valid Agent Card | The canonical Agent Card is JSON, parses as the supported v1 shape, includes its required fields, and declares at least one skill. | 0 | 0 | 1 | 0 | Weighted where applicable |
| Your AI agent's interfaces are reachable | Every supported interface has an absolute HTTPS URL and responds without a 404 under the bounded public check. | 0 | 0 | 1 | 0 | Weighted where applicable |
| Buttons and controls are clearly labeled | Critical controls expose correct accessible names, roles, states, and values. | 5 | 4 | 2 | 4 | Weighted where applicable |
| Your forms are clear and completable | Fields have labels, suitable types/constraints, and deterministic submit controls. | 4 | 4 | 1 | 3 | Weighted where applicable |
| Errors and status are communicated clearly | Loading, validation, availability, updates, errors, and recovery state are exposed. | 4 | 3 | 1 | 3 | Weighted where applicable |
| Links and buttons show where they lead | Critical links and controls expose inspectable destinations or stable identifiers. | 4 | 3 | 2 | 2 | Weighted where applicable |
| Popups and other blockers don't stop the customer's task | Overlays, gates, challenges, popups, and login walls do not make the public task impossible. | 3 | 2 | 1 | 3 | Weighted where applicable |
| Search, filters, and selections narrow things down | Search, filtering, plan/service, documentation, or product selection exposes enough state. | 3 | 2 | 2 | 3 | Weighted where applicable |
| Big decisions get a human checkpoint | Confirmation, handoff, support, and consequences are signaled before high-impact actions. | 2 | 2 | 1 | 2 | Weighted where applicable |
| Your AI assistant guide is up to date | The canonical /llms.txt guide is available and useful in the bounded sample. A completed 404/410 is a missing-guide failure; unsupported freshness or uncaptured required links remain inconclusive. | 1 | 1 | 1 | 1 | Weighted where applicable |
| A lightweight version of your key facts | A documented static text/Markdown representation preserves material facts with lower parsing overhead; a completed negotiation and alternate search without an equivalent representation fails this sampled criterion. | 1 | 1 | 1 | 1 | Weighted where applicable |
| Your machine-readable channels are findable | Applicable public feed, API, catalog, or action surface is discoverable and resolves. | 1 | 3 | 4 | 2 | Weighted where applicable |
| Your machine-readable channels are documented and usable | Applicable feed, action, or API description is parseable, scoped, documented, and task-sufficient. | 2 | 5 | 6 | 2 | Weighted where applicable |
| Your AI agent service is listed publicly and describes its version behavior | A public MCP surface is discoverable and its metadata makes version behavior explicit without initialization. | 0 | 0 | 5 | 0 | Weighted where applicable |
| Your agent service explains its access rules | Public static authorization metadata is coherent without runtime authentication or tool calls. | 0 | 0 | 4 | 0 | Weighted where applicable |
| Your AI agent introduces itself properly | An advertised agent has a valid stable-version card with attributable identity, interfaces, security, and skills. | 0 | 0 | 1 | 0 | Weighted where applicable |
| Live agent behavior (reserved — not assessed) | Long-term registry identity only; live behavior requires owner-authorized assessment. | 0 | 0 | 5 | 0 | Reserved; not assessed; no action runs |
| Your shopping profile is published and consistent | A public released date-versioned UCP profile has coherent services, capabilities, schemas, and versions. | 0 | 0 | 0 | 4 | Weighted where applicable |
| Your product catalog is complete and consistent | Public catalog data exposes product, variant, price, availability, media, seller, and policy fields consistently. | 0 | 0 | 0 | 4 | Weighted where applicable |
| Cart and checkout behavior (reserved — not assessed) | Long-term registry identity only; active cart or checkout behavior is not assessed in RC2. | 0 | 0 | 0 | 6 | Reserved; not assessed; no action runs |
| Your agent discovery document has a valid supported shape | The complete canonical agent.json has JSON media type, nonempty name and description, and a nonempty bounded array of absolute HTTPS endpoint strings without credentials, query or fragment. Endpoints are never invoked. Missing files are not assessed; incomplete evidence is inconclusive. Experimental non-scoring diagnostic. | 0 | 0 | 0 | 0 | Experimental observational diagnostic; non-scoring |
| Your digital presence traces back to you | Public machine surfaces, schemas, policies, and continuation URLs are HTTPS and attributable. | 2 | 2 | 2 | 2 | Weighted where applicable |
| Your policies name the business behind them | Privacy, terms, support/contact, and applicable commercial policies identify the responsible business. | 3 | 3 | 2 | 2 | Weighted where applicable |
| Authorization boundaries (reserved — not assessed) | Long-term registry identity only; protected enforcement is not probed in RC2. | 0 | 0 | 5 | 0 | Reserved; not assessed; no action runs |
| No secrets leak, and consequential actions show their boundaries | Public documents expose no secrets and consequential actions state authorization and confirmation boundaries. | 2 | 2 | 3 | 2 | Weighted where applicable |
| Customers can find a human when it matters | Provider/merchant identity, support escalation, and human continuation are attributable. | 3 | 3 | 3 | 2 | Weighted where applicable |
| Returns, shipping, and other purchase terms are findable | Returns, shipping, taxes/exclusions, renewal, and cancellation are discoverable and consistent. | 0 | 0 | 0 | 2 | Weighted where applicable |
| Your main offering is easy to find | A sampled primary article, service, plan, API, or product is supported by navigation and page evidence. | 4 | 3 | 2 | 2 | Weighted where applicable |
| The facts customers need are extractable | At least three profile-relevant facts are extracted, cited, and checked for cross-surface consistency. | 4 | 4 | 2 | 2 | Weighted where applicable |
| Visitors can browse without surprises | Public navigation and selection/documentation controls are inspected without state-changing action. | 4 | 4 | 3 | 2 | Weighted where applicable |
| Verified customer journey (reserved — not assessed) | Long-term registry identity only; verified execution is not performed in RC2. | 2 | 5 | 3 | 5 | Reserved; not assessed; no action runs |
| There's always a clear next step | A clear human, support, signup, or checkout continuation has an observable destination without activation. | 1 | 4 | 2 | 4 | Weighted where applicable |
| Authenticated tasks (reserved — not assessed) | Long-term registry identity only; credentials and authenticated API tasks are excluded in RC2. | 0 | 0 | 3 | 0 | Reserved; not assessed; no action runs |
| Robots policy | GET /robots.txt returns a parseable 200 text response with a valid user-agent group. | 3 | 3 | 1 | 3 | Weighted where applicable |
| Sitemap discovery | A bounded sitemap search finds a valid 200 XML sitemap/index with canonical HTTP(S) locations. | 3 | 1 | 1 | 2 | Weighted where applicable |
| Agent-useful Link relation | The homepage Link header contains an allowlisted agent-useful relation such as api-catalog, service-desc, or service-doc. | 1 | 1 | 1 | 1 | Weighted where applicable |
| DNS-AID discovery | DNSSEC-valid HTTPS/SVCB data at _index._agents is attributable and has valid ALPN and port data. | 1 | 1 | 1 | 1 | Weighted where applicable |
| Markdown representation | A safe text/markdown request returns equivalent core content with appropriate Vary or a stable alternate. | 2 | 2 | 1 | 2 | Weighted where applicable |
| Recognized AI crawler policy | Robots policy contains a valid explicit group for a versioned recognized AI crawler identity. | 2 | 1 | 1 | 2 | Weighted where applicable |
| Content-Signal policy | Robots policy contains valid search, ai-input, and ai-train yes/no values. | 1 | 1 | 1 | 1 | Weighted where applicable |
| HTTP message signatures directory | Safely retrieve and describe the bounded directory state; it never changes a score. | 0 | 0 | 0 | 0 | Observational; non-scoring |
| API Catalog | The public API catalog is a valid attributable RFC 9727-compatible linkset with at least one target. | 1 | 2 | 3 | 1 | Weighted where applicable |
| OAuth discovery | A canonical discovery document returns coherent HTTPS issuer and endpoint metadata. | 1 | 2 | 2 | 1 | Weighted where applicable |
| Protected-resource metadata | Protected-resource metadata has an attributable resource and nonempty HTTPS authorization servers. | 1 | 2 | 1 | 1 | Weighted where applicable |
| auth.md guidance | auth.md contains discovery, claim, credential-use, error, and revocation guidance with coherent metadata references. | 1 | 1 | 1 | 1 | Weighted where applicable |
| MCP server card | The server card matches the pinned draft shape with identity, HTTPS remote transport, supported protocol versions, and explicit header requirements. | 0 | 0 | 1 | 0 | Weighted where applicable |
| Agent Skills index | The skills index has a supported schema and uniquely named skills with HTTPS SKILL.md URLs. | 0 | 0 | 1 | 0 | Weighted where applicable |
| WebMCP registration | A bounded render exposes a named tool with description and parseable input schema. | 0 | 0 | 1 | 0 | Weighted where applicable |
| x402 declaration | Static public metadata contains a parseable pinned x402 declaration; no paid request is manufactured. | 0 | 0 | 0 | 0 | Optional; non-scoring |
| MPP Payment declaration | Static public metadata contains a parseable pinned MPP Payment declaration. | 0 | 0 | 0 | 0 | Optional; non-scoring |
| UCP profile | GET /.well-known/ucp returns a valid pinned released profile with attributable services and capabilities. | 0 | 0 | 0 | 0 | Optional; non-scoring |
| ACP declaration | A public catalog/link/static document advertises a released ACP version and a valid public schema. | 0 | 0 | 0 | 0 | Optional; non-scoring |