is-it-agent-ready

Is It Agent Ready

Safely scan and interpret one user-authorized public website with the bundled MCP tools. This is an unofficial integration; never imply that Cloudflare authored or endorsed it.

Refuse unsafe targets

Before calling the tool, confirm the request names the exact public site to scan. Refuse:

• Schemes other than http or https.
• Usernames, passwords, query strings, or fragments in the URL.
• Localhost, loopback, link-local, private, shared, multicast, reserved, documentation, intranet, .local, .internal, .localhost, .lan, or cloud-metadata targets.
• Additional domains discovered during a scan unless the user separately requests them.

Use only the bundled scan_site or scan_site_and_save tool. Their gateway repeats these checks, resolves hostnames, and blocks any non-public address before contacting the remote scanner. Never bypass it by calling https://isitagentready.com/mcp directly.

Select the scan

Choose the smallest applicable profile:

• content: blogs, documentation, portfolios, marketing sites, and other content-first sites.
• apiApp: SaaS products, applications, APIs, and developer platforms where commerce checks do not apply.
• all: commerce sites, uncertain site types, or an explicit request for every check.

Use enabledChecks instead of profile only for a named-check request or focused re-test. Valid names are:

robotsTxt, sitemap, linkHeaders, dnsAid, markdownNegotiation, robotsTxtAiRules, contentSignals, webBotAuth, apiCatalog, oauthDiscovery, oauthProtectedResource, authMd, mcpServerCard, a2aAgentCard, agentSkills, webMcp, x402, mpp, ucp, acp, ap2.

Do not send both profile and enabledChecks.

Run once and report evidence

1. State the selected profile or checks and why they fit.
2. Call scan_site once. If the user explicitly asks to retain, export, save, or open the result as a report, call scan_site_and_save instead.
3. Preserve the returned level, pass/fail status, exclusions, evidence, timing, and specification links. Do not turn excluded or not-applicable checks into failures.
4. Never compute a replacement score or infer missing checks from a partial result.
5. Treat the score as directional evidence, not production certification.
6. Link the returned report URL. If the completed scan omits one, use https://isitagentready.com/<hostname> and label it as the public report route.
7. For a saved scan, report the returned scan ID plus the JSON, Markdown, and HTML viewer paths. Never claim a save succeeded without those returned paths.