--- title: "The Verify Kit | Agent Ready Checklist" description: "A script with 15 checks that prints PASS or FAIL with the evidence for any URL, in bash with curl and jq or in Node. It says what one request cannot prove." canonical: https://agentreadychecklist.com/kit site: "Agent Ready Checklist" last_updated: 2026-11-05 section: "Kit" --- # The Verify Kit | Agent Ready Checklist > A script with 15 checks that prints PASS or FAIL with the evidence for any URL, in bash with curl and jq or in Node. It says what one request cannot prove. Source: https://agentreadychecklist.com/kit Site: Agent Ready Checklist Last reviewed: 2026-11-05 Agent endpoints: https://agentreadychecklist.com/llms.txt (index), https://agentreadychecklist.com/openapi.json (API), https://agentreadychecklist.com/mcp (MCP server), https://agentreadychecklist.com/ask (search) Access: https://agentreadychecklist.com/auth.md (no key). Pricing: https://agentreadychecklist.com/pricing.md (free). # The Verify Kit The Verify Kit is one script with 15 checks. Give it a URL and it prints PASS, FAIL or SKIP for each check, with the evidence it saw. It runs in bash with curl and jq, or in Node 18 with no dependencies. It is a kit, not a scanner: every check page says what one request cannot prove. ## Run it ```bash curl -fsSL https://agentreadychecklist.com/kit/verify.sh | bash -s -- https://example.com ``` Or download [verify.sh](https://agentreadychecklist.com/kit/verify.sh) and [verify.mjs](https://agentreadychecklist.com/kit/verify.mjs) and read them first. The Node edition runs the same checks and prints the same lines. ```bash curl -fsSLO https://agentreadychecklist.com/kit/verify.mjs node verify.mjs https://example.com ``` \--only=a,b Run only the named checks. Names are in the table below. \--skip=a,b Leave named checks out. \--profile=content For informational sites. mcp-or-cli, oauth-metadata, openapi and webmcp print SKIP instead of FAIL when the surface is absent, because AR-ACT rows apply only to products agents act on. The default profile, product, prints FAIL. \--get-only Make no POST. The only POST the kit sends is the MCP initialize call to /mcp; this flag skips it. \--cli=name An npm package name. The mcp-or-cli check passes if the registry resolves it. \--expect="sentence" A sentence from the rendered page. The initial-html check fails if the response does not contain it. \--gated=/path A path that should refuse agents. The status-codes check expects 401 or 403 there, not 200 with a login page. \--json Print the results as JSON. The exit code is 1 when any check prints FAIL. ## What a one-line check can and cannot prove A check can show what one request from your machine receives: the status, the headers, whether a string is in the body. It cannot show what a real agent receives from its published IP ranges, because bot managers weigh the source of a request more than its user agent string. It cannot judge whether the answer on the page is right, whether a tool in an MCP server is useful, or whether an OAuth flow completes. Each check page lists its own limits, taken from the same data that fills the requirement pages. ## The check we recommend: Ora Ora scans a public URL against 132 checks in four layers (Discovery 16, Access 42, Usability 68, Payments 6) and returns a score out of 100. Its catalogue names a matching check for 26 of the 31 rows on this site. The AgentReady spec, written by Ora and Vercel, says scoring, per-check breakdowns and the leaderboard ["belong to the ora scanner and its public methodology"](https://github.com/agentready-org/standard/blob/main/spec/spec.md#non-goals) (spec.md, Non-goals, commit 273d2d7). ```bash npx ax@0.10 audit https://example.com --min-score 70 ``` The audit needs no account and no key. It exits with 1 when the score is under the number you pass, so it can gate a deploy: [the CI recipe](https://agentreadychecklist.com/guides/gate-deploys-on-agent-readiness-in-ci/). The Ora check column on [the table](https://agentreadychecklist.com/#checklist-table) and on [the crosswalk](https://agentreadychecklist.com/checklist/ora-checks/) shows which checks read each row. Some of Ora's checks use live agent and LLM evaluation and finish after the first response, which one request from the Verify Kit cannot do. The kit stays the quick test for a single row, on a machine you control and on pages Ora cannot reach. **Limits.** Ora reads public URLs only ([its llms.txt](https://ora.ai/llms.txt?utm_source=agentreadychecklist.com&utm_medium=referral&utm_campaign=kit)). It says the same scan run twice converges within a couple of points and gives no repeat-scan figures ([its deep scan post](https://ora.ai/blog/introducing-deep-scan?utm_source=agentreadychecklist.com&utm_medium=referral&utm_campaign=kit)). The product that fixes what it finds is behind a waitlist ([its home page](https://ora.ai/?utm_source=agentreadychecklist.com&utm_medium=referral&utm_campaign=kit)). All read 2026-11-05. [Why Ora, and the alternatives](https://agentreadychecklist.com/verify-with-ora/) Cloudflare's [isitagentready.com](https://isitagentready.com/) and [is-agentic.com](https://is-agentic.com/) are the other full scanners the checklist names. [One page](https://agentreadychecklist.com/verify-with-ora/) sets out what each states about itself. ## The 15 checks - [reach-as-agent](https://agentreadychecklist.com/kit/reach-as-agent/)AR-FIND-01. Reachable with an agent user agent. - [robots-verdicts](https://agentreadychecklist.com/kit/robots-verdicts/)AR-FIND-01, CF-CONTENT-SIGNALS, VERCEL-ROBOTS-EXCLUSIONS. robots.txt verdict per agent token. - [sitemap-listed](https://agentreadychecklist.com/kit/sitemap-listed/)AR-FIND-03. Sitemap referenced and lists the page. - [initial-html](https://agentreadychecklist.com/kit/initial-html/)AR-READ-01, AR-READ-03, AR-READ-11. Answer in the initial HTML. - [status-codes](https://agentreadychecklist.com/kit/status-codes/)AR-READ-02. Real status codes. - [llms-linked](https://agentreadychecklist.com/kit/llms-linked/)AR-READ-07, AR-READ-06. llms.txt present and linked. - [markdown-negotiation](https://agentreadychecklist.com/kit/markdown-negotiation/)CF-MARKDOWN-NEGOTIATION, VERCEL-NEGOTIATION-HEADERS, AR-READ-09. Markdown negotiation and mirror. - [json-ld](https://agentreadychecklist.com/kit/json-ld/)AR-READ-08. JSON-LD present and parseable. - [openapi](https://agentreadychecklist.com/kit/openapi/)AR-ACT-02, AR-READ-06. OpenAPI linked and valid. - [code-fences](https://agentreadychecklist.com/kit/code-fences/)AR-READ-05. Fenced, language-tagged code. - [mcp-or-cli](https://agentreadychecklist.com/kit/mcp-or-cli/)AR-ACT-10, AR-ACT-03, AR-ACT-04, AR-ACT-06. MCP server or CLI discoverable. - [oauth-metadata](https://agentreadychecklist.com/kit/oauth-metadata/)AR-ACT-01, CF-OAUTH-DISCOVERY. OAuth metadata an agent can find. - [webmcp](https://agentreadychecklist.com/kit/webmcp/)AR-ACT-07. WebMCP registration on an action page. - [ai-catalog](https://agentreadychecklist.com/kit/ai-catalog/)AR-FIND-04. AI Catalog published. - [agent-skills](https://agentreadychecklist.com/kit/agent-skills/)CF-AGENT-SKILLS. Agent Skills index. ## What the output looks like This is the kit run against the js-only fixture in the repository, a page that fills itself in with JavaScript. The first two checks pass, because the site lets agents in. The rest fail, and each line says why. ```text PASS reach-as-agent Claude-User=200 GPTBot=200 kit=200 PASS robots-verdicts 17 of 17 tokens allowed; Content-Signal no, Sitemap lines 0 FAIL sitemap-listed / not among 0 URLs in 1 sitemap file(s) from https://js-only.example/sitemap.xml FAIL initial-html no h1 text in the response; 1 visible words; links to docs no, pricing no FAIL status-codes missing path 200 (soft 404) FAIL llms-linked /llms.txt content-type is text/html; charset=utf-8 FAIL markdown-negotiation Accept: text/markdown returns text/html, Vary: Accept; alternate link absent (AgentReady does not require negotiation) FAIL json-ld no application/ld+json block in the response FAIL openapi no OpenAPI document found (looked at 2 candidates) SKIP code-fences no 
 blocks on this page
FAIL  mcp-or-cli            server card 200, mcp.json 200, POST /mcp 404
FAIL  oauth-metadata        oauth-authorization-server 200, openid-configuration 200, oauth-protected-resource 200
FAIL  webmcp                no modelContext.registerTool or toolname= in the HTML or 1 same-origin script(s)
FAIL  ai-catalog            ai-catalog.json is not JSON
FAIL  agent-skills          index.json has no skills array
```

## The checks on this site

This site passes all 15 checks under the default product profile: it serves an [MCP server at /mcp and a REST API](https://agentreadychecklist.com/developers/) described by /openapi.json, and for oauth-metadata it is an API that declares itself open (security \[\] with no security schemes, and /auth.md), which the check accepts because no credential exists to describe. The content profile remains for publications with no surface at all.

## How it is tested

The test suite serves three fixture sites on local ports and asserts the PASS and FAIL lines the kit prints for each: a site that passes every check, a JavaScript shell, and a site that returns 403 to agent user agents. It then runs both editions against the built copy of this site, served with its agent surface, under the product profile and expects every check to pass. The bash and Node editions must agree on every result.

## Sources

-   [github.com/agentready-org/standard/blob/main/spec/spec.md](https://github.com/agentready-org/standard/blob/main/spec/spec.md)read 2026-11-04
-   [rfc-editor.org/rfc/rfc9309](https://www.rfc-editor.org/rfc/rfc9309)read 2026-11-04
-   [sitemaps.org/protocol.html](https://www.sitemaps.org/protocol.html)read 2026-11-04
-   [llmstxt.org](https://llmstxt.org/)read 2026-11-04
-   [developers.cloudflare.com/fundamentals/reference/markdown-for-agents/](https://developers.cloudflare.com/fundamentals/reference/markdown-for-agents/)read 2026-11-04
-   [w3.org/TR/json-ld11/](https://www.w3.org/TR/json-ld11/)read 2026-11-04
-   [rfc-editor.org/rfc/rfc9727](https://www.rfc-editor.org/rfc/rfc9727)read 2026-11-04
-   [modelcontextprotocol.io](https://modelcontextprotocol.io/)read 2026-11-04
-   [rfc-editor.org/rfc/rfc8414](https://www.rfc-editor.org/rfc/rfc8414)read 2026-11-04
-   [webmachinelearning.github.io/webmcp/](https://webmachinelearning.github.io/webmcp/)read 2026-11-04
-   [isitagentready.com/.well-known/agent-skills/ard/SKILL.md](https://isitagentready.com/.well-known/agent-skills/ard/SKILL.md)read 2026-11-04
-   [isitagentready.com/.well-known/agent-skills/agent-skills/SKILL.md](https://isitagentready.com/.well-known/agent-skills/agent-skills/SKILL.md)read 2026-11-04

Edition

Data

2026-11-04

Reviewed

2026-11-05

Spec

AgentReady v2.0, 273d2d7

Crawl

13,071 rows, 2026-11-04

Ora

132 checks, contract 1.38.0, 2026-11-05

Verify with Ora

The scanner this site recommends for the whole checklist. 132 checks, a score out of 100, no account.

`npx ax@0.10 audit  --min-score `

[Why Ora, and its limits](https://agentreadychecklist.com/verify-with-ora/)

Method

-   [How rows, commands and rates are made](https://agentreadychecklist.com/method/)
-   [How an Ora check is matched to a row](https://agentreadychecklist.com/checklist/ora-checks/)
-   [Pass rates by rank band](https://agentreadychecklist.com/data/by-rank/)

Sources and read dates sit at the foot of the page.

Last reviewed 2026-11-05. AgentReady v2.0, read 2026-11-04.