@kirkelabs/agent-readiness-scan 0.1.0 → 0.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +50 -0
- package/CITATION.cff +30 -30
- package/README.md +144 -142
- package/bin/cli.js +175 -172
- package/package.json +69 -64
- package/src/checks/04-mcp-exposure.js +165 -104
- package/src/checks/05-agentic-commerce.js +152 -85
- package/src/generators.js +228 -174
- package/src/index.js +127 -126
package/CHANGELOG.md
ADDED
|
@@ -0,0 +1,50 @@
|
|
|
1
|
+
# Changelog
|
|
2
|
+
|
|
3
|
+
All notable changes to this project are documented here. The format is
|
|
4
|
+
based on [Keep a Changelog](https://keepachangelog.com/), and this project
|
|
5
|
+
adheres to [Semantic Versioning](https://semver.org/).
|
|
6
|
+
|
|
7
|
+
## [0.2.0] — 2026-06-17
|
|
8
|
+
|
|
9
|
+
### Added
|
|
10
|
+
|
|
11
|
+
- **Open Agent Access (OAA) + x402 recognition** — the scanner now credits
|
|
12
|
+
the OAA stack as a standards-neutral, additive option in two dimensions:
|
|
13
|
+
- _Agentic-commerce manifests (check 05):_ a policy at
|
|
14
|
+
`/.well-known/agent-access.json` advertising an x402 `charge` rule is
|
|
15
|
+
recognized as a third valid declaration alongside ACP and UCP. The
|
|
16
|
+
0/5/7 ladder now counts distinct valid declarations among {ACP, UCP,
|
|
17
|
+
OAA-x402}.
|
|
18
|
+
- _MCP exposure (check 04):_ a server-card `authorization.model:
|
|
19
|
+
"open-agent-access"` (or `authorization.policy` URL) is credited as a
|
|
20
|
+
scoped-auth posture equivalent to OAuth-protected-resource (+2), with a
|
|
21
|
+
further +1 when the referenced policy enforces per-call gating
|
|
22
|
+
(`requireAgentIdentity` + a deny/charge rule). The dimension remains
|
|
23
|
+
capped at 7.
|
|
24
|
+
- New `/.well-known/agent-access.json` scaffold in the generated customs
|
|
25
|
+
declaration, plus an `authorization` block in the generated MCP server
|
|
26
|
+
card pointing at it.
|
|
27
|
+
- Fetch wiring for `/.well-known/agent-access.json`.
|
|
28
|
+
- Tests covering OAA-x402 commerce scoring, OAA-guard MCP scoring, and
|
|
29
|
+
regression tests asserting ACP/UCP/OAuth-only sites score identically to
|
|
30
|
+
before.
|
|
31
|
+
- npm publish configuration: `publishConfig.access: public`, a
|
|
32
|
+
`prepublishOnly` lint+test guard, and a release-triggered GitHub Actions
|
|
33
|
+
publish workflow.
|
|
34
|
+
|
|
35
|
+
### Changed
|
|
36
|
+
|
|
37
|
+
- Documentation (`README.md`, `docs/METHODOLOGY.md`) updated to describe the
|
|
38
|
+
OAA signals, the exact evidence each requires, and the scoring ladders,
|
|
39
|
+
with a plain disclosure that OAA is implemented by Kirke Labs (the tool's
|
|
40
|
+
author) and is held to the same evidentiary bar as the other standards.
|
|
41
|
+
|
|
42
|
+
### Unchanged (by design)
|
|
43
|
+
|
|
44
|
+
- No dimension weights changed. A site declaring only ACP/UCP (commerce) or
|
|
45
|
+
OAuth/PKCE (MCP auth) scores exactly as it did in 0.1.0.
|
|
46
|
+
|
|
47
|
+
## [0.1.0] — 2026-06-01
|
|
48
|
+
|
|
49
|
+
- Initial release: 8-dimension agent-readiness scorer + customs-declaration
|
|
50
|
+
generator.
|
package/CITATION.cff
CHANGED
|
@@ -1,30 +1,30 @@
|
|
|
1
|
-
cff-version: 1.2.0
|
|
2
|
-
message:
|
|
3
|
-
title:
|
|
4
|
-
abstract:
|
|
5
|
-
type: software
|
|
6
|
-
license: MIT
|
|
7
|
-
repository-code:
|
|
8
|
-
url:
|
|
9
|
-
version: 0.
|
|
10
|
-
date-released: 2026-06-
|
|
11
|
-
authors:
|
|
12
|
-
- given-names: Soleman
|
|
13
|
-
family-names: El Gelawi
|
|
14
|
-
email: soleman@kirkelabs.com
|
|
15
|
-
affiliation:
|
|
16
|
-
# sameAs: https://www.linkedin.com/in/soleman-gelawi/ , https://github.com/sgelawi
|
|
17
|
-
- given-names: Steve
|
|
18
|
-
family-names: Kirton
|
|
19
|
-
email: steve@kirkelabs.com
|
|
20
|
-
affiliation:
|
|
21
|
-
# sameAs: https://www.linkedin.com/in/stevekirton-kirkelabs/
|
|
22
|
-
keywords:
|
|
23
|
-
- ai-agents
|
|
24
|
-
- mcp
|
|
25
|
-
- acp
|
|
26
|
-
- agentic-commerce
|
|
27
|
-
- crawler-policy
|
|
28
|
-
- web-bot-auth
|
|
29
|
-
- schema-org
|
|
30
|
-
- algorand
|
|
1
|
+
cff-version: 1.2.0
|
|
2
|
+
message: 'If you use this software, please cite it as below.'
|
|
3
|
+
title: 'agent-readiness-scan'
|
|
4
|
+
abstract: 'Open-source customs-house auditor for AI agents: scores 8 weighted dimensions covering crawler policy, agent-action surfaces (MCP/ACP), Product/Offer completeness, and brand identity corroboration. Generates a drop-in customs declaration (robots.txt + .well-known/ manifests).'
|
|
5
|
+
type: software
|
|
6
|
+
license: MIT
|
|
7
|
+
repository-code: 'https://github.com/KirkeLabs/agent-readiness-scan'
|
|
8
|
+
url: 'https://kirkelabs.github.io/agent-readiness-scan/'
|
|
9
|
+
version: 0.2.0
|
|
10
|
+
date-released: 2026-06-17
|
|
11
|
+
authors:
|
|
12
|
+
- given-names: Soleman
|
|
13
|
+
family-names: El Gelawi
|
|
14
|
+
email: soleman@kirkelabs.com
|
|
15
|
+
affiliation: 'Kirke Labs'
|
|
16
|
+
# sameAs: https://www.linkedin.com/in/soleman-gelawi/ , https://github.com/sgelawi
|
|
17
|
+
- given-names: Steve
|
|
18
|
+
family-names: Kirton
|
|
19
|
+
email: steve@kirkelabs.com
|
|
20
|
+
affiliation: 'Kirke Labs'
|
|
21
|
+
# sameAs: https://www.linkedin.com/in/stevekirton-kirkelabs/
|
|
22
|
+
keywords:
|
|
23
|
+
- ai-agents
|
|
24
|
+
- mcp
|
|
25
|
+
- acp
|
|
26
|
+
- agentic-commerce
|
|
27
|
+
- crawler-policy
|
|
28
|
+
- web-bot-auth
|
|
29
|
+
- schema-org
|
|
30
|
+
- algorand
|
package/README.md
CHANGED
|
@@ -1,142 +1,144 @@
|
|
|
1
|
-
# agent-readiness-scan
|
|
2
|
-
|
|
3
|
-
[](https://www.npmjs.com/package/@kirkelabs/agent-readiness-scan)
|
|
4
|
-
[](./LICENSE)
|
|
5
|
-
[](https://nodejs.org)
|
|
6
|
-
[](./.github/workflows/ci.yml)
|
|
7
|
-
|
|
8
|
-
**Is your brand ready for AI agents to act on it?** Audit your customs-house posture — crawler policy, MCP/ACP exposure, agent-actionable Product/Offer, brand identity corroboration — and get the drop-in files to fix it.
|
|
9
|
-
|
|
10
|
-
```bash
|
|
11
|
-
npx @kirkelabs/agent-readiness-scan https://your-site.com
|
|
12
|
-
```
|
|
13
|
-
|
|
14
|
-
No install. No account. No data leaves your machine.
|
|
15
|
-
|
|
16
|
-
> Built by Soleman El Gelawi (CTO, [Kirke Labs](https://www.kirkelabs.com)), with Steve Kirton — open-sourced as a gift to the Algorand ecosystem. MIT licensed. Use it, fork it, ship it.
|
|
17
|
-
|
|
18
|
-
---
|
|
19
|
-
|
|
20
|
-
## What is this?
|
|
21
|
-
|
|
22
|
-
The open web is becoming a customs house. AI search, agentic commerce (ACP, Universal Cart), bot authentication (Web Bot Auth), crawler policy (Cloudflare Content Signals), and the EU DSA / DMA all push in the same direction: every web property now needs a
|
|
23
|
-
|
|
24
|
-
`agent-readiness-scan` audits that posture. It fetches a URL plus seven `.well-known/*` paths plus `robots.txt`, and scores 8 dimensions covering:
|
|
25
|
-
|
|
26
|
-
- **Crawler policy** — does your `robots.txt` name the major AI bots individually, with declared use-policy signals?
|
|
27
|
-
- **Bot authentication** — is a Web Bot Auth key directory present?
|
|
28
|
-
- **Agent action surfaces** — MCP server card, Agentic Commerce Protocol manifest, Google Universal Cart manifest?
|
|
29
|
-
- **Commerce structured data** — are your Product/Offer JSON-LD blocks complete enough for agent-driven checkout?
|
|
30
|
-
- **Identity corroboration** — does the `sameAs` graph reach registry-grade sources (Wikidata, Crunchbase, Companies House, SEC EDGAR, GLEIF)?
|
|
31
|
-
- **Source operations & regulatory transparency** — dateModified, security.txt, T&Cs, contact, privacy.
|
|
32
|
-
|
|
33
|
-
Then it generates the files you need to fix the gaps — a drop-in `robots.txt`, `.well-known/security.txt`, MCP server card, and ACP manifest scaffolds.
|
|
34
|
-
|
|
35
|
-
Companion to [`@kirkelabs/ai-legibility-scan`](https://github.com/KirkeLabs/ai-legibility-scan): that one scores how
|
|
36
|
-
|
|
37
|
-
## Why?
|
|
38
|
-
|
|
39
|
-
The strategic paper this tool is built on — [
|
|
40
|
-
|
|
41
|
-
## Install
|
|
42
|
-
|
|
43
|
-
Nothing to install — use `npx`:
|
|
44
|
-
|
|
45
|
-
```bash
|
|
46
|
-
npx @kirkelabs/agent-readiness-scan https://your-site.com
|
|
47
|
-
```
|
|
48
|
-
|
|
49
|
-
Or add it to a project:
|
|
50
|
-
|
|
51
|
-
```bash
|
|
52
|
-
npm i -D @kirkelabs/agent-readiness-scan
|
|
53
|
-
```
|
|
54
|
-
|
|
55
|
-
Requires Node.js ≥ 20.
|
|
56
|
-
|
|
57
|
-
## Quickstart
|
|
58
|
-
|
|
59
|
-
```bash
|
|
60
|
-
# default scan
|
|
61
|
-
npx @kirkelabs/agent-readiness-scan https://your-site.com
|
|
62
|
-
|
|
63
|
-
# write artefacts to ./report
|
|
64
|
-
npx @kirkelabs/agent-readiness-scan https://your-site.com --out ./report
|
|
65
|
-
|
|
66
|
-
# machine-readable output for scripting
|
|
67
|
-
npx @kirkelabs/agent-readiness-scan https://your-site.com --json
|
|
68
|
-
```
|
|
69
|
-
|
|
70
|
-
Files land in the output directory (default `./agent-readiness-out/`):
|
|
71
|
-
|
|
72
|
-
| File / Directory
|
|
73
|
-
|
|
74
|
-
| `score.json`
|
|
75
|
-
| `report.md`
|
|
76
|
-
| `scorecard.html`
|
|
77
|
-
| `customs-declaration/robots.txt`
|
|
78
|
-
| `customs-declaration/.well-known/security.txt`
|
|
79
|
-
| `customs-declaration/.well-known/mcp/server-card.json` | MCP server card scaffold
|
|
80
|
-
| `customs-declaration/.well-known/acp/manifest.json`
|
|
81
|
-
|
|
82
|
-
## How it scores
|
|
83
|
-
|
|
84
|
-
Eight weighted dimensions, normalised to 0–100 and graded A–F:
|
|
85
|
-
|
|
86
|
-
| #
|
|
87
|
-
|
|
88
|
-
| 1
|
|
89
|
-
| 2
|
|
90
|
-
| 3
|
|
91
|
-
| 4
|
|
92
|
-
| 5
|
|
93
|
-
| 6
|
|
94
|
-
| 7
|
|
95
|
-
| 8
|
|
96
|
-
|
|
97
|
-
Full rubric, thresholds and rationale: **[docs/METHODOLOGY.md](./docs/METHODOLOGY.md)**.
|
|
98
|
-
|
|
99
|
-
## Use in CI
|
|
100
|
-
|
|
101
|
-
The CLI exits non-zero when the score drops below 50:
|
|
102
|
-
|
|
103
|
-
```yaml
|
|
104
|
-
# .github/workflows/agent-readiness.yml
|
|
105
|
-
- run: npx @kirkelabs/agent-readiness-scan https://staging.your-site.com
|
|
106
|
-
```
|
|
107
|
-
|
|
108
|
-
## Programmatic use
|
|
109
|
-
|
|
110
|
-
```js
|
|
111
|
-
import { scan } from '@kirkelabs/agent-readiness-scan';
|
|
112
|
-
|
|
113
|
-
const result = await scan('https://your-site.com');
|
|
114
|
-
console.log(result.score, result.grade);
|
|
115
|
-
```
|
|
116
|
-
|
|
117
|
-
## Limitations (read this)
|
|
118
|
-
|
|
119
|
-
This tool measures **heuristic indicators** of agent-readiness. A high score makes a site easier for an AI agent to discover, declare access to, and act on — it is **not a guarantee** of agent uptake, citation, or transaction. The weights are informed by 2026 standards work (MCP, ACP, UCP, Web Bot Auth, Content Signals) but are judgement calls, documented openly in [docs/METHODOLOGY.md](./docs/METHODOLOGY.md). See also [`SECURITY.md`](./SECURITY.md).
|
|
120
|
-
|
|
121
|
-
Most of the dimensions check standards that are
|
|
122
|
-
|
|
123
|
-
|
|
124
|
-
|
|
125
|
-
|
|
126
|
-
|
|
127
|
-
|
|
128
|
-
|
|
129
|
-
|
|
130
|
-
|
|
131
|
-
|
|
132
|
-
|
|
133
|
-
|
|
134
|
-
|
|
135
|
-
|
|
136
|
-
|
|
137
|
-
|
|
138
|
-
|
|
139
|
-
|
|
140
|
-
|
|
141
|
-
|
|
142
|
-
|
|
1
|
+
# agent-readiness-scan
|
|
2
|
+
|
|
3
|
+
[](https://www.npmjs.com/package/@kirkelabs/agent-readiness-scan)
|
|
4
|
+
[](./LICENSE)
|
|
5
|
+
[](https://nodejs.org)
|
|
6
|
+
[](./.github/workflows/ci.yml)
|
|
7
|
+
|
|
8
|
+
**Is your brand ready for AI agents to act on it?** Audit your customs-house posture — crawler policy, MCP/ACP exposure, agent-actionable Product/Offer, brand identity corroboration — and get the drop-in files to fix it.
|
|
9
|
+
|
|
10
|
+
```bash
|
|
11
|
+
npx @kirkelabs/agent-readiness-scan https://your-site.com
|
|
12
|
+
```
|
|
13
|
+
|
|
14
|
+
No install. No account. No data leaves your machine.
|
|
15
|
+
|
|
16
|
+
> Built by Soleman El Gelawi (CTO, [Kirke Labs](https://www.kirkelabs.com)), with Steve Kirton — open-sourced as a gift to the Algorand ecosystem. MIT licensed. Use it, fork it, ship it.
|
|
17
|
+
|
|
18
|
+
---
|
|
19
|
+
|
|
20
|
+
## What is this?
|
|
21
|
+
|
|
22
|
+
The open web is becoming a customs house. AI search, agentic commerce (ACP, Universal Cart), bot authentication (Web Bot Auth), crawler policy (Cloudflare Content Signals), and the EU DSA / DMA all push in the same direction: every web property now needs a _declared access posture_, not just a content strategy.
|
|
23
|
+
|
|
24
|
+
`agent-readiness-scan` audits that posture. It fetches a URL plus seven `.well-known/*` paths plus `robots.txt`, and scores 8 dimensions covering:
|
|
25
|
+
|
|
26
|
+
- **Crawler policy** — does your `robots.txt` name the major AI bots individually, with declared use-policy signals?
|
|
27
|
+
- **Bot authentication** — is a Web Bot Auth key directory present?
|
|
28
|
+
- **Agent action surfaces** — MCP server card, Agentic Commerce Protocol manifest, Google Universal Cart manifest, Open Agent Access + x402 policy?
|
|
29
|
+
- **Commerce structured data** — are your Product/Offer JSON-LD blocks complete enough for agent-driven checkout?
|
|
30
|
+
- **Identity corroboration** — does the `sameAs` graph reach registry-grade sources (Wikidata, Crunchbase, Companies House, SEC EDGAR, GLEIF)?
|
|
31
|
+
- **Source operations & regulatory transparency** — dateModified, security.txt, T&Cs, contact, privacy.
|
|
32
|
+
|
|
33
|
+
Then it generates the files you need to fix the gaps — a drop-in `robots.txt`, `.well-known/security.txt`, MCP server card, and ACP manifest scaffolds.
|
|
34
|
+
|
|
35
|
+
Companion to [`@kirkelabs/ai-legibility-scan`](https://github.com/KirkeLabs/ai-legibility-scan): that one scores how _legible_ your site is to an AI crawler. This one scores how _agent-ready_ it is once the crawler can read it.
|
|
36
|
+
|
|
37
|
+
## Why?
|
|
38
|
+
|
|
39
|
+
The strategic paper this tool is built on — [_The Web Becomes a Customs House_](https://www.kirkelabs.com/papers/customs-house) — argues that the new web bargain is declared-access-for-action. A page may be cited without being visited; a product may be transacted without a click. Existing "AI visibility" tools tell you you're invisible. This one is a free CLI that audits your _customs-house posture_ and hands you the drop-in declarations to fix it.
|
|
40
|
+
|
|
41
|
+
## Install
|
|
42
|
+
|
|
43
|
+
Nothing to install — use `npx`:
|
|
44
|
+
|
|
45
|
+
```bash
|
|
46
|
+
npx @kirkelabs/agent-readiness-scan https://your-site.com
|
|
47
|
+
```
|
|
48
|
+
|
|
49
|
+
Or add it to a project:
|
|
50
|
+
|
|
51
|
+
```bash
|
|
52
|
+
npm i -D @kirkelabs/agent-readiness-scan
|
|
53
|
+
```
|
|
54
|
+
|
|
55
|
+
Requires Node.js ≥ 20.
|
|
56
|
+
|
|
57
|
+
## Quickstart
|
|
58
|
+
|
|
59
|
+
```bash
|
|
60
|
+
# default scan
|
|
61
|
+
npx @kirkelabs/agent-readiness-scan https://your-site.com
|
|
62
|
+
|
|
63
|
+
# write artefacts to ./report
|
|
64
|
+
npx @kirkelabs/agent-readiness-scan https://your-site.com --out ./report
|
|
65
|
+
|
|
66
|
+
# machine-readable output for scripting
|
|
67
|
+
npx @kirkelabs/agent-readiness-scan https://your-site.com --json
|
|
68
|
+
```
|
|
69
|
+
|
|
70
|
+
Files land in the output directory (default `./agent-readiness-out/`):
|
|
71
|
+
|
|
72
|
+
| File / Directory | What it is |
|
|
73
|
+
| ------------------------------------------------------ | --------------------------------------------------------------------- |
|
|
74
|
+
| `score.json` | Machine-readable result — gate your CI on it |
|
|
75
|
+
| `report.md` | Human-readable findings |
|
|
76
|
+
| `scorecard.html` | Self-contained shareable scorecard |
|
|
77
|
+
| `customs-declaration/robots.txt` | Drop-in robots.txt with per-AI-bot rules + Cloudflare Content Signals |
|
|
78
|
+
| `customs-declaration/.well-known/security.txt` | RFC 9116 scaffold |
|
|
79
|
+
| `customs-declaration/.well-known/mcp/server-card.json` | MCP server card scaffold |
|
|
80
|
+
| `customs-declaration/.well-known/acp/manifest.json` | Agentic Commerce Protocol manifest scaffold |
|
|
81
|
+
|
|
82
|
+
## How it scores
|
|
83
|
+
|
|
84
|
+
Eight weighted dimensions, normalised to 0–100 and graded A–F:
|
|
85
|
+
|
|
86
|
+
| # | Dimension | Weight | What it checks |
|
|
87
|
+
| --- | ------------------------------ | ------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
88
|
+
| 1 | Per-bot crawler policy | 10 | robots.txt names individual AI bots (GPTBot, ClaudeBot, OAI-SearchBot, PerplexityBot, Google-Extended, anthropic-ai, Claude-Web, ChatGPT-User, Claude-User, CCBot, Bytespider, Amazonbot, Applebot-Extended, meta-externalagent) |
|
|
89
|
+
| 2 | Declared use-policy signals | 7 | Cloudflare Content Signals (search / ai-input / ai-train), `noai` / `noimageai` meta, `X-Robots-Tag` |
|
|
90
|
+
| 3 | Bot-Auth readiness | 5 | `/.well-known/http-message-signatures-directory` (Web Bot Auth, IETF draft) |
|
|
91
|
+
| 4 | MCP exposure | 7 | `/.well-known/mcp/server-card.json` + scoped auth via `/.well-known/oauth-protected-resource` with PKCE/S256 (NSA May-2026 guidance) **or** an Open Agent Access policy guard — accepted as equivalent postures |
|
|
92
|
+
| 5 | Agentic-commerce manifests | 7 | `/.well-known/acp/manifest.json` (OpenAI/Stripe), `/.well-known/ucp` (Google Universal Cart), and/or `/.well-known/agent-access.json` (Open Agent Access + x402 on Algorand) — accepted as standards-neutral alternatives |
|
|
93
|
+
| 6 | Agent-actionable Product/Offer | 7 | Product/Offer JSON-LD completeness (price, availability, priceValidUntil-future, shippingDetails, acceptedPaymentMethod, hasMerchantReturnPolicy, aggregateRating) |
|
|
94
|
+
| 7 | Brand identity corroboration | 8 | sameAs to registry-grade sources (Wikidata, Crunchbase, OpenCorporates, Companies House, SEC EDGAR, GLEIF, plus LinkedIn/GitHub) |
|
|
95
|
+
| 8 | Source provenance & regulatory | 5 | dateModified/datePublished, security.txt, T&Cs, contact, privacy policy |
|
|
96
|
+
|
|
97
|
+
Full rubric, thresholds and rationale: **[docs/METHODOLOGY.md](./docs/METHODOLOGY.md)**.
|
|
98
|
+
|
|
99
|
+
## Use in CI
|
|
100
|
+
|
|
101
|
+
The CLI exits non-zero when the score drops below 50:
|
|
102
|
+
|
|
103
|
+
```yaml
|
|
104
|
+
# .github/workflows/agent-readiness.yml
|
|
105
|
+
- run: npx @kirkelabs/agent-readiness-scan https://staging.your-site.com
|
|
106
|
+
```
|
|
107
|
+
|
|
108
|
+
## Programmatic use
|
|
109
|
+
|
|
110
|
+
```js
|
|
111
|
+
import { scan } from '@kirkelabs/agent-readiness-scan';
|
|
112
|
+
|
|
113
|
+
const result = await scan('https://your-site.com');
|
|
114
|
+
console.log(result.score, result.grade);
|
|
115
|
+
```
|
|
116
|
+
|
|
117
|
+
## Limitations (read this)
|
|
118
|
+
|
|
119
|
+
This tool measures **heuristic indicators** of agent-readiness. A high score makes a site easier for an AI agent to discover, declare access to, and act on — it is **not a guarantee** of agent uptake, citation, or transaction. The weights are informed by 2026 standards work (MCP, ACP, UCP, Web Bot Auth, Content Signals) but are judgement calls, documented openly in [docs/METHODOLOGY.md](./docs/METHODOLOGY.md). See also [`SECURITY.md`](./SECURITY.md).
|
|
120
|
+
|
|
121
|
+
Most of the dimensions check standards that are _emerging_, not universal. A score below 50 is normal today; a score above 80 puts you among the earliest customs-house operators. The bar will rise.
|
|
122
|
+
|
|
123
|
+
**Disclosure:** Open Agent Access (OAA), one of the recognized signals in the MCP-exposure and agentic-commerce dimensions, is implemented by Kirke Labs — the author of this tool. OAA is scored as _one of several_ live standards (alongside ACP, UCP, and OAuth), never privileged: weights are unchanged and detection is held to the same evidence bar as the others. A site using only ACP/UCP/OAuth scores exactly as it did before OAA was recognized. See [docs/METHODOLOGY.md](./docs/METHODOLOGY.md#open-agent-access-oaa--x402--recognized-signals).
|
|
124
|
+
|
|
125
|
+
## Audit, recon, fix — three steps to lift your score
|
|
126
|
+
|
|
127
|
+
Once the scanner has graded your site, two prompt templates let Claude Code in your source repo do the rest:
|
|
128
|
+
|
|
129
|
+
1. **[docs/RECON_PROMPT.md](./docs/RECON_PROMPT.md)** — read-only reconnaissance prompt that greps the codebase and returns a structured report of your framework, existing manifests, identity URLs, and routes.
|
|
130
|
+
2. **[docs/PROMPT_TEMPLATE.md](./docs/PROMPT_TEMPLATE.md)** — the fix prompt. Fill in the placeholders informed by the recon, paste into a new Claude Code session to ship the customs declaration.
|
|
131
|
+
|
|
132
|
+
## Companion tool
|
|
133
|
+
|
|
134
|
+
See also [`@kirkelabs/ai-legibility-scan`](https://github.com/KirkeLabs/ai-legibility-scan) — scores how legible your page is to AI _crawlers_ (the layer below this one). Together they cover the audit-recon-fix loop for both halves of the customs-house thesis: legibility + declared access.
|
|
135
|
+
|
|
136
|
+
## Contributing
|
|
137
|
+
|
|
138
|
+
Issues and PRs welcome — especially scoring false positives, new checks tracking emerging standards, and additional identity-registry coverage. See [CONTRIBUTING.md](./CONTRIBUTING.md) and the [Code of Conduct](./CODE_OF_CONDUCT.md).
|
|
139
|
+
|
|
140
|
+
## Licence
|
|
141
|
+
|
|
142
|
+
[MIT](./LICENSE) © 2026 Kirke Labs — Soleman El Gelawi and Steve Kirton. A genuine gift to the community — attribution appreciated, not required.
|
|
143
|
+
|
|
144
|
+
— [www.kirkelabs.com](https://www.kirkelabs.com)
|