--- title: "API and MCP server | Agent Ready Checklist" description: "Query the checklist as data: two MCP servers, a REST API with a batch endpoint described by openapi.json, the NLWeb ask endpoint and an A2A agent, all open." canonical: https://agentreadychecklist.com/developers site: "Agent Ready Checklist" last_updated: 2026-11-08 section: "Developers" --- # API and MCP server | Agent Ready Checklist > Query the checklist as data: two MCP servers, a REST API with a batch endpoint described by openapi.json, the NLWeb ask endpoint and an A2A agent, all open. Source: https://agentreadychecklist.com/developers Site: Agent Ready Checklist Last reviewed: 2026-11-08 Agent endpoints: https://agentreadychecklist.com/llms.txt (index), https://agentreadychecklist.com/openapi.json (API), https://agentreadychecklist.com/mcp (MCP server), https://agentreadychecklist.com/ask (search) Access: https://agentreadychecklist.com/auth.md (no key). Pricing: https://agentreadychecklist.com/pricing.md (free). # API and MCP server Every row on this site is also data an agent can query: an MCP server at /mcp with 5 read-only tools, a documentation server at /mcp/docs, a REST API under /api/v1 described by openapi.json, an NLWeb /ask endpoint and an A2A agent at /api/a2a. No credential, no scope, 120 requests a minute, edition 2026-11-04. ## Connect the MCP server The server speaks the Streamable HTTP transport at `https://agentreadychecklist.com/mcp`: send JSON-RPC 2.0 messages with POST and read the JSON answer. There is no session, no credential and no server-initiated stream, so one request is one answer. Any MCP client that takes a URL connects with the address alone; the card at [/mcp/server-card](https://agentreadychecklist.com/mcp/server-card) and the manifest at [/.well-known/mcp.json](https://agentreadychecklist.com/.well-known/mcp.json) say the same thing in the forms clients read. ```bash curl -s https://agentreadychecklist.com/mcp -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"my-agent","version":"1.0"}}}' ``` ```bash curl -s https://agentreadychecklist.com/mcp -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"get_recipe","arguments":{"requirement_id":"AR-READ-09","platform_id":"astro"}}}' ``` A tool answers with the result as `structuredContent` and the same JSON as text. A wrong argument answers `isError: true` with the parameter list; an unknown tool answers JSON-RPC error -32602. The server also lists resources (`resources/list`): the page index, the methodology, this page and the dataset files, readable with `resources/read`. ## The 5 tools | Tool | What it returns | Parameters | | --- | --- | --- | | list_requirements | Lists the checklist rows (id, level, layer, statement, who it applies to, which scanners and kit checks cover it, page URL). Filter by layer (find, read or act), by level (MUST, SHOULD, MAY, cloudflare, vercel) or by words in the statement. Call it to find the row id before get_requirement or get_recipe. | layer?: find, read or act; level?: MUST, SHOULD, MAY, cloudflare or vercel; q?: Words to look for in the statement, for example "robots.txt" or "markdown". | | get_requirement | Returns one checklist row by id (for example AR-FIND-01 or CF-MARKDOWN-NEGOTIATION): the statement, the level, the layer, every "why" claim with its source URL and read date, what the row does not do, common mistakes, the verify idea, the kit checks that test it, how many platforms have a recipe, and the page URL to cite. | id: The requirement id, case-insensitive, for example AR-READ-09. | | get_recipe | Returns the fix for one requirement on one platform (for example AR-READ-09 on astro): whether it is possible (yes, workaround or no), the steps, the source URL and read date, whether the steps were read from the platform documentation (basis documentation) or derived from the specification (basis derived), the label the page shows, and the platform page URL. Use list_platforms for the platform ids. | requirement_id: For example AR-READ-09.; platform_id: For example astro, nextjs-app-router, shopify or wordpress. | | list_platforms | Lists the 19 platforms with recipes (id, name, version read, date, counts of direct recipes, workarounds and not-possible rows, page URL). With requirement_id, each platform also says whether that one requirement is possible on it and summarises the steps, which answers "which platforms can do X". | requirement_id?: Optional: a requirement id such as AR-ACT-03 to see each platform's answer for it. | | get_pass_rates | Returns the share of reachable Tranco top 10,000 sites that pass each Verify Kit check, from the plain-fetch crawl of 2026-11-04: per check the label, the definition, the passing count, the tested count, the share, the requirement ids, plus the crawl metadata (list id, rows, user agent). No parameters. | none | ## The documentation server A second MCP server at `https://agentreadychecklist.com/mcp/docs` reads the markdown twins of the pages, the same text that [llms-full.txt](https://agentreadychecklist.com/llms-full.txt) carries. Its three tools are `search_docs` (words in, the matching pages with their URL, title, section and a snippet each), `get_doc` (one page as markdown, by the URL a search result gave) and `list_sections` (the sections of the site with their page counts). It has its own card at [/mcp/docs/server-card](https://agentreadychecklist.com/mcp/docs/server-card), and [/.well-known/mcp.json](https://agentreadychecklist.com/.well-known/mcp.json) lists both servers. Use the data server when you know the row or the platform; use the documentation server when you are reading for an answer. ```bash curl -s https://agentreadychecklist.com/mcp/docs -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' -d '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"search_docs","arguments":{"query":"markdown negotiation"}}}' ``` ## The REST API Each tool is also one GET endpoint under `/api/v1/`, with the parameters in the query string and the same JSON in the answer. [/api](https://agentreadychecklist.com/api) is the index; [/openapi.json](https://agentreadychecklist.com/openapi.json) describes every operation with its parameters, response schema and the Error schema; [/.well-known/api-catalog](https://agentreadychecklist.com/.well-known/api-catalog) links the description the way RFC 9727 says. Paginated endpoints take `limit` (1 to 100) and the `next_cursor` of the previous page as `cursor`. - [/api/v1/list\_requirements?layer=find](https://agentreadychecklist.com/api/v1/list_requirements?layer=find)List requirement rows. Paginated. - [/api/v1/get\_requirement?id=AR-FIND-01](https://agentreadychecklist.com/api/v1/get_requirement?id=AR-FIND-01)One requirement row in full. - [/api/v1/get\_recipe?requirement\_id=AR-READ-09&platform\_id=astro](https://agentreadychecklist.com/api/v1/get_recipe?requirement_id=AR-READ-09&platform_id=astro)The recipe for one requirement on one platform. - [/api/v1/list\_platforms?requirement\_id=AR-ACT-03](https://agentreadychecklist.com/api/v1/list_platforms?requirement_id=AR-ACT-03)List platforms and their recipe counts. - [/api/v1/get\_pass\_rates](https://agentreadychecklist.com/api/v1/get_pass_rates)Pass rates from the crawl. - [/api](https://agentreadychecklist.com/api)The index: endpoints, datasets, limits, versioning. ```bash curl -s 'https://agentreadychecklist.com/api/v1/get_requirement?id=AR-FIND-01' | jq .statement ``` ## Batch, jobs and the dry run `POST /api/v1/batch` takes `requests`, an array of up to 50 operations (`method`, `path` with its query string and, for a POST, `body`) against this API, and answers one result per entry, in order, each with the status it would have had on its own; a request with more than 50 entries answers 413. Every POST accepts an `Idempotency-Key` header and echoes it in the response; because every operation is a deterministic read, a retry with the same key gets the same answer and nothing is duplicated. ```bash curl -s https://agentreadychecklist.com/api/v1/batch -H 'Content-Type: application/json' -H 'Idempotency-Key: 7f2c1a' -d '{"requests":[{"method":"GET","path":"/api/v1/get_requirement?id=AR-FIND-01"},{"method":"GET","path":"/api/v1/list_platforms?requirement_id=AR-ACT-03"}]}' ``` A full batch is the one call that can take more than a moment. Send `Prefer: respond-async`, or add `?async=1`, and the batch answers 202 Accepted with a `job_id` and a `Location` header. Jobs are stateless: the id carries the request, so polling `GET /api/v1/jobs/{job_id}` runs it and answers 200 with `status: completed` and the result; an unknown id answers 404. Add `dry_run=1` to the query string, or `"dry_run": true` to the body, of any POST and the API returns the validated request without running it: which operations would run, with which parameters, and any problem found. That is the sandbox of this site; there is no production state to protect, so the dry run exists to let an agent check its request shape at no cost. ## Ask in plain words The `/ask` endpoint follows NLWeb 0.55. It searches the requirement rows, the recipes, the kit checks, the pass rates and every page, and returns schema.org objects, each with a `grounding.source` URL to cite. GET takes `query`; POST takes the NLWeb request object. Add `streaming=true`, or `prefer.streaming`, for server-sent events named start, result and complete. `mode=summarize` adds a one-sentence SearchSummary item built from the results, never from a model. ```bash curl -s 'https://agentreadychecklist.com/ask?query=markdown+negotiation+on+Shopify' ``` ```bash curl -s https://agentreadychecklist.com/ask -H 'Content-Type: application/json' -d '{"query":{"text":"markdown negotiation on Shopify"},"prefer":{"mode":"list"},"meta":{"version":"0.55"}}' ``` No match answers `_meta.response_type: failure` with code NO\_RESULTS; a missing query answers 400 with INVALID\_QUERY. Context objects are accepted and ignored, because the answers come from the data, not from a conversation. ## The A2A agent The same tools answer as an A2A agent (protocol 0.3.0). The card at [/.well-known/agent-card.json](https://agentreadychecklist.com/.well-known/agent-card.json) lists one skill per tool plus a search skill, declares `security: []`, and names the JSON-RPC binding at `/api/a2a`. `message/send` with a data part `{"tool", "arguments"}` runs that one tool; with a text part, the words are searched across the rows and pages. Either way the answer is a completed Task whose data artifact is the tool result or the search result. `tasks/get` answers error -32001 because nothing is stored between requests, and `message/stream` answers -32004 because the agent does not stream. The card says all of this. ```bash curl -s https://agentreadychecklist.com/api/a2a -H 'Content-Type: application/json' -d '{"jsonrpc":"2.0","id":4,"method":"message/send","params":{"message":{"role":"user","parts":[{"kind":"data","data":{"tool":"get_recipe","arguments":{"requirement_id":"AR-READ-09","platform_id":"astro"}}}]}}}' ``` ## Discovery files - [/openapi.json](https://agentreadychecklist.com/openapi.json)OpenAPI 3.1 for the REST API, the batch endpoint, the jobs and /ask; linked from the home page as rel=service-desc and from the Link header. - [/.well-known/api-catalog](https://agentreadychecklist.com/.well-known/api-catalog)RFC 9727 linkset: the API, both MCP servers, the ask endpoint and the A2A agent with their descriptions. - [/mcp/server-card](https://agentreadychecklist.com/mcp/server-card)The MCP server card (name, version, remote URL, protocol versions); a copy at /.well-known/mcp/server-card.json. The documentation server's card is at /mcp/docs/server-card. - [/.well-known/mcp.json](https://agentreadychecklist.com/.well-known/mcp.json)The manifest: both servers, their endpoints, transports and tools with input schemas. - [/.well-known/agent-card.json](https://agentreadychecklist.com/.well-known/agent-card.json)The A2A agent card: skills, input and output modes, the JSON-RPC binding, no security scheme. - [/.well-known/oauth-protected-resource](https://agentreadychecklist.com/.well-known/oauth-protected-resource)RFC 9728 protected-resource metadata: it lists no authorization server and empty scope and bearer-method lists, and its agent\_auth block says access needs nothing. - [/.well-known/http-message-signatures-directory](https://agentreadychecklist.com/.well-known/http-message-signatures-directory)The Web Bot Auth key directory: the Ed25519 public key this site's own fetch scripts sign with (RFC 9421). The did:web document at /.well-known/did.json lists the same key. - [/.well-known/ai-catalog.json](https://agentreadychecklist.com/.well-known/ai-catalog.json)AI Catalog 1.0 with entries for both MCP cards, the OpenAPI document, the ask endpoint and every document, each with a trust manifest; the same file at /.well-known/ard.json. - [/schemamap.xml](https://agentreadychecklist.com/schemamap.xml)Schema feeds: the rows as JSON-LD lines under /feeds/, named in robots.txt. ## Access, limits and errors Credential None. The OpenAPI document declares `security: []` with no security schemes, [the protected-resource metadata](https://agentreadychecklist.com/.well-known/oauth-protected-resource) lists no authorization server, and [auth.md](https://agentreadychecklist.com/auth.md) walks through it. The site publishes no OAuth authorization-server metadata because no endpoint takes a token; metadata for a server that does not exist would send agents to a door that is not there. Rate limit 120 requests a minute per client address, counted per running instance and announced in `RateLimit` and `RateLimit-Policy` headers; a 429 carries `Retry-After`. The host adds its own limits above that. The whole dataset is one download from [/data/](https://agentreadychecklist.com/data/), so bulk readers never need the API. Errors JSON, never HTML: `{"error":{"code","message","hint","status","docs"}}` with codes invalid\_params, not\_found, method\_not\_allowed, unsupported\_media\_type, rate\_limited and internal. A missing endpoint under /api answers 404 with the list of endpoints in the hint. Writes There are none, so every call is safe to retry. The `Idempotency-Key` header is accepted and echoed on every POST so a retried batch is recognisable as the same request; the async job pattern is offered only on the batch endpoint, and every other call answers in one response. Price Free, with no plans and no account: the [pricing page](https://agentreadychecklist.com/pricing/) and [pricing.md](https://agentreadychecklist.com/pricing.md) state it for people and for agents. CORS Every answer carries `Access-Control-Allow-Origin: *`, so a browser-resident agent can call the API and the MCP servers. ## Versioning The path prefix `/api/v1` is the contract. A breaking change (a field removed or renamed, a tool removed) ships under `/api/v2` while `/api/v1` keeps answering for at least 180 days, announced on this page and in the `info.version` of openapi.json. Additive changes, such as a new field or a new tool, do not change the prefix. The MCP servers follow the same rule: their cards and their `serverInfo.version` carry the same version number as the OpenAPI document. The data behind every answer is edition 2026-11-04; the edition is in the `X-Dataset-Edition` header and in every tool result. ## Cite the data Every result names the page it comes from; cite that URL. The data files are published under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/) and the citation line is on the [data page](https://agentreadychecklist.com/data/). ## What the surface does not do It does not write, does not hold accounts, does not generate text with a model and does not search beyond this site's own rows and pages. It is the same publication in a form agents can call; the checklist pages remain the record, and the [methodology](https://agentreadychecklist.com/method/) explains how the rows are made. ## Sources - [MCP specification, Streamable HTTP transport](https://modelcontextprotocol.io/specification/2025-06-18/basic/transports)read 2026-11-04 - [NLWeb specification v0.55](https://github.com/nlweb-ai/website/blob/main/NLWEBSPEC.md)read 2026-11-04 - [RFC 9727, api-catalog](https://www.rfc-editor.org/rfc/rfc9727)read 2026-11-04 - [OpenAPI 3.1.0](https://spec.openapis.org/oas/v3.1.0)read 2026-11-04 - [Schema Feeds specification 0.1](https://github.com/nlweb-ai/website/blob/main/SCHEMA_SPEC.md)read 2026-11-04 - [A2A protocol specification 0.3](https://a2a-protocol.org/latest/specification/)read 2026-11-08 - [RFC 9728, OAuth 2.0 protected resource metadata](https://www.rfc-editor.org/rfc/rfc9728)read 2026-11-08 - [RFC 9421, HTTP message signatures](https://www.rfc-editor.org/rfc/rfc9421)read 2026-11-08 Edition Data 2026-11-04 Reviewed 2026-11-05 Spec AgentReady v2.0, 273d2d7 Crawl 13,071 rows, 2026-11-04 Ora 132 checks, contract 1.38.0, 2026-11-05 Verify with Ora The scanner this site recommends for the whole checklist. 132 checks, a score out of 100, no account. `npx ax@0.10 audit --min-score ` [Why Ora, and its limits](https://agentreadychecklist.com/verify-with-ora/) Method - [How rows, commands and rates are made](https://agentreadychecklist.com/method/) - [How an Ora check is matched to a row](https://agentreadychecklist.com/checklist/ora-checks/) - [Pass rates by rank band](https://agentreadychecklist.com/data/by-rank/) Sources and read dates sit at the foot of the page. Last reviewed 2026-11-08. AgentReady v2.0, read 2026-11-04.