@capitalthought/agentsfirst-mcp 0.1.0 → 0.1.2

package/dist/probe.d.ts

@@ -168,6 +168,7 @@ export interface WebsiteSignals {
             ai_agents_addressed: string[];
             address_count: number;
             blanket_disallow: boolean;
+            content_signal_directives?: Record<string, string>;
         };
         markdown_negotiation: {
             requested?: string;

package/dist/probe.js

@@ -344,6 +344,7 @@ export async function probeWebsite(url) {
         ['well_known_ai_plugin', `${origin}/.well-known/ai-plugin.json`],
         ['well_known_oauth', `${origin}/.well-known/oauth-authorization-server`],
         ['well_known_mcp', `${origin}/.well-known/mcp-server-card`],
+        ['well_known_mcp_json', `${origin}/.well-known/mcp-server-card.json`],
         ['sitemap', `${origin}/sitemap.xml`],
         ['openapi_root', `${origin}/openapi.json`],
         ['openapi_v1', `${origin}/v1/openapi.json`],
@@ -378,10 +379,26 @@ export async function probeWebsite(url) {
             'cohere-ai',
         ];
         const declared = aiAgents.filter((ua) => new RegExp(`User-agent:\\s*${ua}`, 'i').test(robotsBody));
+        // Content-Signal directive (Cloudflare's emerging AI-policy convention).
+        // Format: `Content-Signal: ai-train=yes, search=yes, ai-input=yes`
+        const contentSignalLines = robotsBody.match(/^Content-Signal:\s*(.+)$/gim) ?? [];
+        const directives = {};
+        for (const line of contentSignalLines) {
+            const m = line.match(/^Content-Signal:\s*(.+)$/i);
+            const captured = m?.[1];
+            if (!captured)
+                continue;
+            for (const pair of captured.split(',')) {
+                const [k, v] = pair.split('=').map((s) => s.trim().toLowerCase());
+                if (k && v)
+                    directives[k] = v;
+            }
+        }
         out.signals.robots_analysis = {
             ai_agents_addressed: declared,
             address_count: declared.length,
             blanket_disallow: /User-agent:\s*\*[\s\S]*?Disallow:\s*\//i.test(robotsBody),
+            ...(Object.keys(directives).length > 0 && { content_signal_directives: directives }),
         };
     }
     const homepageBody = out.signals.homepage?.body;

package/dist/score.js

@@ -488,22 +488,38 @@ function scoreBotAccessControl(signals) {
     let pts = 0;
     const notes = [];
     const robots = signals.signals.robots_analysis;
-    if (robots) {
-        if (robots.address_count > 0 && !robots.blanket_disallow) {
-            pts += 10;
-            notes.push('Per-bot allow/deny posture (no blanket disallow)');
-        }
-        else if (robots.address_count > 0) {
-            pts += 5;
-            notes.push('Addresses AI agents but uses blanket disallow');
-        }
-        if (robots.address_count >= 3) {
-            pts += 5;
-            notes.push(`Distinct posture for ${robots.address_count} bots — granular control`);
-        }
+    if (!robots) {
+        notes.push('No robots.txt analysis available');
+        return { pts: 0, max, status: statusFor(0, max), notes };
+    }
+    // 10 pts: Cloudflare Content-Signal directive OR equivalent AI-policy declaration.
+    // Content-Signal is the modern machine-readable convention; per-bot rules are the
+    // older convention and earn partial credit when Content-Signal is absent.
+    const cs = robots.content_signal_directives;
+    if (cs && Object.keys(cs).length > 0) {
+        pts += 10;
+        const fmt = Object.entries(cs)
+            .map(([k, v]) => `${k}=${v}`)
+            .join(', ');
+        notes.push(`Content-Signal directive declared: ${fmt}`);
+    }
+    else if (robots.address_count >= 3) {
+        pts += 5;
+        notes.push(`AI policy implicit via ${robots.address_count} per-bot rules — consider adding a Content-Signal directive for machine-readable, future-proof AI policy`);
     }
     else {
-        notes.push('No robots.txt analysis available');
+        notes.push('No Content-Signal directive and no per-bot AI policy in robots.txt');
+    }
+    // 5 pts: per-bot granular posture (names ≥3 AI bots and is not paired with a global blanket disallow).
+    if (robots.address_count >= 3 && !robots.blanket_disallow) {
+        pts += 5;
+        notes.push(`Per-bot granular posture for ${robots.address_count} named bots`);
+    }
+    else if (robots.address_count >= 3 && robots.blanket_disallow) {
+        notes.push(`Names ${robots.address_count} bots but pairs with a global blanket disallow`);
+    }
+    else if (robots.address_count > 0) {
+        notes.push(`Names ${robots.address_count} bot(s) — under threshold (need 3+) for granular-control credit`);
     }
     return { pts: Math.min(pts, max), max, status: statusFor(pts, max), notes };
 }
@@ -512,9 +528,12 @@ function scoreAgentCapabilities(signals) {
     let pts = 0;
     const notes = [];
     const surfaces = signals.signals.surfaces;
-    if (surfaces['well_known_mcp']?.ok) {
+    if (surfaces['well_known_mcp']?.ok || surfaces['well_known_mcp_json']?.ok) {
         pts += 15;
-        notes.push('/.well-known/mcp-server-card published');
+        const variant = surfaces['well_known_mcp_json']?.ok
+            ? '/.well-known/mcp-server-card.json'
+            : '/.well-known/mcp-server-card';
+        notes.push(`MCP Server Card published at ${variant}`);
     }
     else {
         notes.push('No MCP Server Card');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capitalthought/agentsfirst-mcp",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "MCP server that scores websites and codebases against the Agents First framework. Use it to check how agent-ready any product is. https://agentsfirst.dev",
   "license": "MIT",
   "author": "Joshua Baer <josh@capitalfactory.com>",