Open standard
Busymate AI Agent Ready v1
Can an AI find you, understand you, trust you, and do useful work with you? That is the whole question. This standard answers it with one number and shows the receipt behind every point.
Version 1.0 — six sections, ten requirements, one hundred points.
01Architecture
Five layers, and one card that joins them
An agent meets a website in layers, each answering a different question. agents.json is the single card at the top that points at all of them, so nothing has to be guessed at.
Content
The page itself — written once, served as HTML to a reader and as Markdown to a machine.
Discovery
Signposts that say where to start: a sitemap, an llms.txt, headers that point at both.
Semantics
Meaning attached to the facts — JSON-LD in the page, frontmatter on the Markdown.
Actions
What may be done here and now, in the browser the visitor already has open: WebMCP page tools.
Remote capabilities
What the service can be asked to do from anywhere: an MCP endpoint behind OAuth.
agents.json
The capability card: what you publish, which interfaces you expose, how to sign in, and which person to reach.
02Scoring
Six sections share one hundred points
Each layer is graded as the section a reader recognises. Inside a section the requirement holds the bulk of the weight and the supporting diagnostics hold the remainder.
| Layer | Section | What it asks | Points |
|---|---|---|---|
| Discovery | Discover | Can an AI agent find your content? | 15 |
| Semantics | Understand | Does an agent understand your business correctly? | 15 |
| Content | Read | Can an agent consume your content efficiently? | 20 |
| Actions | Act | Can an agent take actions on your website? | 20 |
| Remote capabilities | Connect | Can external agents call your systems? | 20 |
| Safety | Trust | Can an agent authenticate, confirm actions, and reach a human? | 10 |
| Total | 100 | ||
The last row grades a concern the figure above does not draw: who is allowed to act, and how a visitor reaches a person when nobody should.
A check that cannot apply to you leaves the denominator instead of counting against you — sign-in discovery is not owed by a service where every tool is already open to everyone.
8 of the 35 checks are conventions nobody has agreed on yet. They are worth nothing either way: reported when found, never a deduction when absent.
03Requirements
The ten a site has to meet
Ten clauses decide whether a site is ready. Everything else the scan reports is a diagnostic — useful, evidenced, and never the line between ready and not.
Content
- R1
- Important content is present in the initial HTML.
- R2
- Pages can expose a Markdown representation of themselves.
Discovery
- R3
- The site publishes a sitemap.
- R4
- The site publishes an llms.txt.
- R5
- The site publishes a machine-readable capability manifest.
Semantics
- R6
- Pages declare their language and their canonical URL.
- R7
- The site publishes structured business or product metadata.
Actions
- R8
- Web actions are declared when the page offers any.
- R9
- Backend agent tools or an API are declared when the service offers any.
Safety
- R10
- Authentication, authorization and human hand-off are explicit.
Clause nine takes any honest answer — a live MCP endpoint, an OpenAPI document, a GraphQL schema, or an interface named in the capability card. Having one is what counts, not which one.
The last clause is proven twice over: a person an agent can hand a visitor to, and a stated posture on who may do what.
04One address
The same link, in whichever form the caller reads
A reader opens a page and gets the page. A machine asks for plain text with one request header and gets plain text. Nothing forks into a second site.
Ask, and Markdown comes back
A request carrying Accept: text/markdown answers 200 with Content-Type: text/markdown; charset=utf-8. Every other request is served the HTML, unchanged.
Vary: Accept, every time
The response names the request header that shaped it, so anything caching in between keeps the two forms apart instead of serving one to both.
Frontmatter that travels with it
The Markdown opens with its canonical address, the date it last changed and the language it is written in — known before a word of the body is read.
Link headers that point
One header describes the site by llms.txt, one offers agents.json as an alternate, and one offers the page's own Markdown alternate; the HTML head repeats that last one. Together they separate a file that happens to exist from a site that means to be read.
GET /pricing HTTP/1.1
Host: yourwebsite.com
Accept: text/markdown
HTTP/1.1 200 OK
Content-Type: text/markdown; charset=utf-8
Vary: Accept
Link: </llms.txt>; rel="describedby"; type="text/plain"
Link: </agents.json>; rel="alternate"; type="application/json"
Link: </pricing/md>; rel="alternate"; type="text/markdown"
---
title: Pricing
description: What each plan includes and what it costs.
canonical: https://yourwebsite.com/pricing
updated: 2026-09-15
language: en
---
# PricingThere are no AI URLs here. A /md suffix may sit behind the page as a quiet fallback for a client that cannot negotiate, but it is never advertised and never canonical — what a person shares is what an agent fetches.
05Evidence
Every verdict carries its receipt
A score with nothing behind it is an opinion. Each check keeps three lines: the call it made, the answer this document expects, and the answer it actually got.
check: markdown_representation
request: GET https://yourwebsite.com/pricing
Accept: text/markdown
expected: text/markdown with Vary: Accept
received: 200 text/html; charset=utf-8 — no Vary header
status: fail
weight: 5
earned: 0Only the headers that change the answer are recorded, and credentials never are.
check: mcp_transport
endpoint: https://yourwebsite.com/mcp
transport: streamable-http
protocol:
offered: 2025-06-18
returned: 2025-03-26
negotiated: 2025-03-26
initialize: true
toolsList: true
auth:
mode: oauth
oauthMetadata: true
metadataUrl: https://yourwebsite.com/.well-known/oauth-authorization-server
pkce: [S256]
dynamicRegistration: true # optional either way
requirementsDocumentedAt: the capability manifest
tools:
listedWithoutToken: 7 # listed, not usable
authenticated: null # we never sign in to your server
withReadOnlyHint: 7
executionTested: false # so the execution check stays UNVERIFIED
status: passA remote interface records more: where it lives, the transport it identified, how it advertises sign-in, and how many tools answer with no token against how many need one.
An authenticated count reads as unknown, not zero, when nobody signed in to count it.
06Verdicts
Four ways a check can land
Each one is a different sentence to a site owner, so none of them is rounded into another.
- PASS
What the clause expects came back.
- PARTIAL
Some of it is in place; the receipt names the half that is not.
- OPTIONAL
An unsettled convention, noted as found or absent and worth no points in either direction.
- FAIL
Asked for, and nothing was there.
Could not check is never a pass
A refusal, a timeout, a redirect that never lands: the probe kept its weight and is listed on its own. A reader can then tell a missing feature from an unanswered question, and no gap is ever quietly scored as a success.
07What changed
Version 1.2
An external audit of one of our own live reports found places where the score was more confident than the evidence, and places where it marked a site down for doing the right thing. Every finding below is a rule that moved, so a report you read before this version may score differently now — and should.
Finding a capability is not being allowed to use it
A tool catalogue that answers without a token tells you the tools are LISTED. It does not tell you any of them will run, for you, today. Version 1 collapsed those into one verdict and gave full marks for the first. They are now four separate findings:
- Discovery — the endpoint answers, negotiates a protocol revision and lists its tools.
- Documented access — the service states which capabilities need a token and which do not.
- Sign-in discovery — OAuth metadata resolves, and advertises PKCE where a client has to verify it.
- Tested execution — an authenticated call actually succeeds.
Only the first three can be measured from outside. The fourth stays unverified on every report this scanner writes: it holds no credential for your service and never calls a stranger's tool. Those points are reported apart, never counted as a pass and never blamed on you.
One result, three forms
The page, the Markdown and the JSON now render the same result object — same scan, same statuses, same totals. They used to be able to disagree with each other.
No perfect connection score
Authenticated execution is never tested from outside, so its points stay unverified for every site, ours included. A report can no longer say a service is fully callable on evidence it does not have.
Version-aware probing
The report records what it offered, what your server answered, and the raw handshake. A feature a later revision introduced is never held against a session pinned to an earlier one.
Hints are not behaviour
How many tools declare a read-only hint is reported on its own line and scores nothing. Whether a person is actually asked before a consequential action needs a workflow test, and says so.
Three kinds of crawler
Model training, AI search and citation, and a page a person asked an assistant to open are three decisions. Only the last two are discovery. Opting out of training costs nothing.
A default is a policy
No permissions-policy entry for page tools means the draft's default allowlist applies — your own origin, nobody else. That passes. An explicit allowlist is hardening on top of it.
The right fields per type
A last-modified date is asked of the content types that define one, never of the node that says who you are. Identity and freshness are graded separately.
Findings name their scope
A result read from one page says so, and the routes the scan actually read travel with the report. Nothing measured on a home page is written as if it described every screen.
A twin has to agree with itself
A capability manifest published at both its well-known and its root path is now checked for saying the same thing at both — not merely for one copy existing.
A sitemap has to be a real document
A sitemap is now checked for being an actual urlset or sitemapindex whose links point at your own address, not merely for answering with a 200.
A hand-off contact needs no crawl
A mailto link, a contact page, structured contact data or a stated contact line in llms.txt now all count toward reaching a person — none of them need anything to have been crawled first.
A report is a score under this standard, version 1.2 — a diagnostic you can act on, not a certification and not a conformance badge. The rules are published here so you can disagree with them.
See where your own site stands
Put in an address for the graded report and the evidence under it — then ask your mate what to fix first, in plain language.