What is agent readiness?

Advertises an MCP server so agents can discover and use your tools. Only relevant if you expose agent-facing infrastructure.

What good looks like A valid MCP Server Card. The current proposal (SEP-2127, still a draft) puts it at /.well-known/mcp-server-card; sites in the wild also serve /.well-known/mcp.json and /.well-known/mcp/server-card.json, and any of the three counts.

A single index of the AI-facing things you publish — MCP servers, agent cards, skills, datasets — so an agent finds them in one hop instead of guessing at paths. Adoption is early and the specification is still a draft, so not having one is normal today rather than a defect.

What good looks like A valid /.well-known/ai-catalog.json that actually lists something. An index with nothing in it is discoverable but tells an agent no more than having none.

A discoverable manifest of skills an agent can use on your site.

What good looks like A valid Agent Skills index at /.well-known/agent-skills/index.json.

A machine-readable index of your APIs (RFC 9727) lets agents find and use them.

What good looks like A valid /.well-known/api-catalog.

Discovery metadata lets agents learn how to authenticate against protected resources.

What good looks like Valid OAuth authorization-server metadata at the well-known path.

RFC 9728 protected-resource metadata is how an MCP server tells an agent which authorization server guards it — the entry point of the MCP auth handshake.

What good looks like A valid /.well-known/oauth-protected-resource pointing at your authorization server.

OIDC discovery metadata lets agents and clients learn your token, authorization and JWKS endpoints without hard-coding them.

What good looks like Valid OpenID Connect discovery metadata at /.well-known/openid-configuration.

Web Bot Auth (IETF draft) lets a BOT OPERATOR cryptographically prove its traffic: the operator publishes signing keys on its own domain, and websites verify them. This one only applies if this domain operates a bot or agent — a normal publisher site has nothing to publish here, and that's expected.

What good looks like Only if you operate a bot/agent: a JWKS at /.well-known/http-message-signatures-directory on the domain your bot signs as (e.g. chatgpt.com publishes one).

UCP (Google) is how an AI shopping agent finds out what you sell without a human browsing your site. The agent appends /.well-known/ucp to your domain and reads a JSON manifest of your services, capabilities, payment handlers and API endpoints. Only relevant if you sell something — we don't check it otherwise.

What good looks like A JSON manifest at /.well-known/ucp declaring what you sell, how to transact, and which transports you support.

OAuth tells an agent how to authenticate. auth.md tells it how to register in the first place — the step before that. Without one, an AI agent acting for a customer has no documented way to get credentials for your service.

What good looks like A /auth.md describing your registration flows, scopes and endpoints, alongside your OAuth protected-resource metadata.

DNS-based AI-discovery records help agents find your endpoints without fetching the page.

What good looks like AI-discovery DNS records are published.