--- title: "Gate deploys on agent readiness in CI | Agent Ready Checklist" description: "Gate deploys on agent readiness in CI. Ora's CLI as the gate, with the workflow file and the exit codes. The budget arithmetic and when to use the kit instead." canonical: https://agentreadychecklist.com/guides/gate-deploys-on-agent-readiness-in-ci site: "Agent Ready Checklist" last_updated: 2026-11-05 date: 2026-11-05 section: "Guides" --- # Gate deploys on agent readiness in CI | Agent Ready Checklist > Gate deploys on agent readiness in CI. Ora's CLI as the gate, with the workflow file and the exit codes. The budget arithmetic and when to use the kit instead. Source: https://agentreadychecklist.com/guides/gate-deploys-on-agent-readiness-in-ci Site: Agent Ready Checklist Last reviewed: 2026-11-05 Agent endpoints: https://agentreadychecklist.com/llms.txt (index), https://agentreadychecklist.com/openapi.json (API), https://agentreadychecklist.com/mcp (MCP server), https://agentreadychecklist.com/ask (search) Access: https://agentreadychecklist.com/auth.md (no key). Pricing: https://agentreadychecklist.com/pricing.md (free). # Gate deploys on agent readiness in CI Run Ora's CLI against every pull request preview with a score floor, and the job fails when the score drops: npx ax audit with --min-score. Use Agent Ready's GitHub Action instead when the gate must follow the Vercel spec score. Keep the Verify Kit for the rows no scanner reads. ## Before you start You need a public URL for every pull request or staging build, because Ora scans public URLs only, and a CI job that can run Node. If the build only exists on the runner, put a tunnel in front of it, as the last step below shows. The existing guide on [keeping a site agent ready in CI](https://agentreadychecklist.com/guides/keep-a-site-agent-ready-in-ci/) covers the kit; this one adds a score gate on top. ## Pick the gate | Gate | Fails the job when | Needs | Use it for | | --- | --- | --- | --- | | Ora CLI, ax audit | The Ora score is below --min-score (exit code 1). | Node and a public URL. No account and no key. | The default. One number over 132 checks, with the ranked fixes in the log. | | Agent Ready GitHub Action | The Vercel score is below min-vercel-score. | A Pro API key in a repository secret. | A gate that follows the Vercel Agent Readability Spec and llmstxt.org checks. | | Verify Kit | Any check prints FAIL (exit code 1). | bash, curl and jq, or Node 18. Reaches pages Ora cannot. | Named rows, such as the MUSTs, and the rows Ora has no check for: AR-READ-06, CF-CONTENT-SIGNALS. | ## The Ora gate One step runs the audit against the preview URL and fails the job under the floor. The workflow file below assumes an earlier step puts the preview URL in the PREVIEW\_URL environment variable. ```yaml name: Agent readiness on: pull_request jobs: audit: runs-on: ubuntu-latest steps: - name: Agent-readiness gate run: npx ax@0.10 audit "$PREVIEW_URL" --min-score 70 ``` The exit code is the contract. 0 means the audit ran and the score is at or above the floor. 1 means the score is below it. 2 is a usage error, such as a malformed URL or a local target without a tunnel. 3 means Ora could not be reached, timed out or ran out of rate limit, so a flaky network fails the job rather than passing it. ### Choose the number Audit production once, read the score, and set the floor a few points under it. Ora says two scans of the same site converge within a couple of points and gives no repeat-scan figures, so a floor that sits right on today's score will flake. Raise it as fixes land, one pull request at a time. Run `npx ax@0.10 audit https://example.com --json` to see the raw payload the gate reads. ### Mind the budget Ora allows 30 scans and 6 forced scans per rolling 24 hours per IP, with a burst limit of 10 a minute. A result that comes from its cache costs nothing, and a preview URL Ora has not scanned has nothing cached, so each new preview spends one scan. Because the limits are per IP, a team whose jobs reach Ora from one address and open more than 30 previews in 24 hours can hit the limit and see exit code 3. Ora issues scan API keys that lift the limits, by hand and without self-serve signup. Keep --force for the run after a deploy, when you need to know a fix registered. ### Gate a local build ```bash npx ax@0.10 audit localhost:3000 --min-score 70 --tunnel-cmd 'ngrok http 3000 --log stdout' ``` The command runs your tunnel, audits the public address it prints and shuts the tunnel down. The result is ephemeral and excluded from Ora's rankings, and the off-site checks, such as registry listings, usually fail for a throwaway hostname, so use it to guard the on-site surface and set a lower floor than production. ## The Agent Ready alternative Agent Ready (agent-ready.dev) documents a GitHub Action that comments a summary on each pull request and fails the check under a threshold. It scores 72 checks mapped to the Vercel Agent Readability Spec and llmstxt.org, so choose it when that spec is the standard you answer to. This is the example from its API documentation, read 2026-11-05; the first step is a third-party action that waits for the Vercel preview. ```yaml name: Agent Ready scan on: pull_request: jobs: scan: runs-on: ubuntu-latest permissions: pull-requests: write steps: - name: Wait for Vercel preview id: preview uses: patrickedqvist/wait-for-vercel-preview@v1.3.2 with: token: ${{ secrets.GITHUB_TOKEN }} max_timeout: 300 - name: Agent Ready scan uses: mlava/agent-ready-action@v1 with: api-key: ${{ secrets.AGENT_READY_API_KEY }} url: ${{ steps.preview.outputs.url }} min-vercel-score: "70" ``` The Action sits on the 19 USD a month Pro plan, whose API keys are limited to 10 scan starts a minute and 200 a day. The Ora gate costs nothing and carries per-IP limits of 30 scans a day. Run both when you want a score under each standard; they read different check lists and their numbers are not comparable. ## Keep the kit for the rest A score hides which row broke. The Verify Kit names the row and prints the evidence, and it reaches staging sites behind a login. Ora's catalogue has no check for [AR-READ-06](https://agentreadychecklist.com/checklist/ar-read-06/), [CF-CONTENT-SIGNALS](https://agentreadychecklist.com/checklist/cf-content-signals/), so only the kit gates them. After a failed gate, [re-verify the one row](https://agentreadychecklist.com/guides/re-verify-one-fix-with-ora/) instead of running the whole audit again. [Why this site recommends Ora](https://agentreadychecklist.com/verify-with-ora/) and [which check reads which row](https://agentreadychecklist.com/checklist/ora-checks/). ## How you know it is done Open a pull request that deletes llms.txt, and another that disallows PerplexityBot in robots.txt. Read the score in each job log. The job fails with exit code 1 once a change takes the score under your floor, and the next push that restores the file brings it back over. ## The facts behind it - The ax command line client (npm package ax, version 0.10.3, MIT) runs Ora's hosted audit with `ax audit `; the audit needs no account and no API key, and the README says `--min-score` gates CI.primary source: [registry.npmjs.org/ax](https://registry.npmjs.org/ax), read 2026-11-05 - The ax README defines the exit codes of `audit`: 0 for success and a score at or above --min-score, 1 for a score below it, 2 for a usage error such as a bad flag, a malformed URL or a local target without a tunnel, and 3 when the API is unreachable, times out or the rate limit is exhausted.primary source: [registry.npmjs.org/ax](https://registry.npmjs.org/ax), read 2026-11-05 - The ax README says Ora allows 30 scans and 6 --force scans per rolling 24 hours per IP, plus a 10 a minute burst limit; a result served from the freshness cache costs nothing, --max-age sets how old a cached result may be, and --force is for verifying a fix you just deployed.vendor claim: [registry.npmjs.org/ax](https://registry.npmjs.org/ax), read 2026-11-05 - Ora cannot reach localhost. The ax README offers --tunnel-cmd, which runs any command that exposes the local server and prints its public https URL; such a result is stored as ephemeral, excluded from rankings and deleted after 7 days, and off-site checks usually fail for a throwaway tunnel hostname.primary source: [registry.npmjs.org/ax](https://registry.npmjs.org/ax), read 2026-11-05 - Agent Ready (agent-ready.dev) documents a GitHub Action, mlava/agent-ready-action@v1, that posts a summary comment on every pull request and fails the check when the Vercel score drops below a threshold set with min-vercel-score; it reads an Agent Ready API key from a repository secret.primary source: [agent-ready.dev/docs/api](https://agent-ready.dev/docs/api), read 2026-11-05 - Agent Ready's pricing page lists the GitHub Action for CI/CD gating with the Pro plan, which it prices at 19 USD a month; its API documentation limits each Pro key to 10 scan starts a minute and 200 a day.primary source: [agent-ready.dev/pricing](https://agent-ready.dev/pricing), read 2026-11-05 - Agent Ready's methodology page describes 72 checks in four categories, mapped to the Vercel Agent Readability Spec and the llmstxt.org standard.primary source: [agent-ready.dev/methodology](https://agent-ready.dev/methodology), read 2026-11-05 - Ora's post on deep scan says the same scan run twice converges within a couple of points and that a held-out set of sites with known scores catches drift after each pipeline change; the post gives no repeat-scan figures.vendor claim: [ora.ai/blog/introducing-deep-scan](https://ora.ai/blog/introducing-deep-scan?utm_source=agentreadychecklist.com&utm_medium=referral&utm_campaign=guide), read 2026-11-05 ## Sources - [registry.npmjs.org/ax, the ax README](https://registry.npmjs.org/ax)read 2026-11-05 - [ora.ai/llms.txt](https://ora.ai/llms.txt?utm_source=agentreadychecklist.com&utm_medium=referral&utm_campaign=guide)read 2026-11-05 - [ora.ai/blog/introducing-deep-scan](https://ora.ai/blog/introducing-deep-scan?utm_source=agentreadychecklist.com&utm_medium=referral&utm_campaign=guide)read 2026-11-05 - [agent-ready.dev/docs/api](https://agent-ready.dev/docs/api)read 2026-11-05 - [agent-ready.dev/pricing](https://agent-ready.dev/pricing)read 2026-11-05 - [agent-ready.dev/methodology](https://agent-ready.dev/methodology)read 2026-11-05 Edition Data 2026-11-04 Reviewed 2026-11-05 Spec AgentReady v2.0, 273d2d7 Crawl 13,071 rows, 2026-11-04 Ora 132 checks, contract 1.38.0, 2026-11-05 Verify with Ora The scanner this site recommends for the whole checklist. 132 checks, a score out of 100, no account. `npx ax@0.10 audit --min-score ` [Why Ora, and its limits](https://agentreadychecklist.com/verify-with-ora/) Method - [How rows, commands and rates are made](https://agentreadychecklist.com/method/) - [How an Ora check is matched to a row](https://agentreadychecklist.com/checklist/ora-checks/) - [Pass rates by rank band](https://agentreadychecklist.com/data/by-rank/) Sources and read dates sit at the foot of the page. Last reviewed 2026-11-05. AgentReady v2.0, read 2026-11-04.