Website for Agents Audit

See how well AI assistants, crawlers, and software agents can discover and understand your public website. The Actor performs a deterministic, robots-aware audit and returns prioritized findings, category scores, and practical machine-readiness evidence.

What it checks

• HTTP reachability, redirects, canonical identity, and crawlability
• robots.txt, sitemaps, llms.txt, and machine-readable discovery links
• OpenAPI 3.0/3.1 descriptions and documented authentication
• MCP and tool-discovery references
• JSON-LD, OpenGraph, Twitter metadata, documentation, product, and pricing discovery
• Accidental public exposure of metrics, debug output, and infrastructure details

The Actor does not execute JavaScript, call discovered APIs or tools, perform an MCP handshake, bypass robots.txt, or crawl other origins.

Pricing

This is a paid, pay-per-event Actor: $0.10 per completed website audit.

Exactly one event is charged per run, only after a real audit result exists — a success or a useful partial finding. There is no charge for invalid input, a target blocked by the public-network policy, a target that could not be resolved, or a run that fails before an audit result is produced.

Input

Provide one public HTTP or HTTPS site root, such as https://example.com/. Targets containing credentials, queries, or fragments are rejected. Private, local, link-local, CGNAT, metadata-service, and mixed public/private DNS destinations are blocked.

Advanced: you can optionally adjust the resource limit, request timeout, standard probes, and strict operational configuration. Audits inspect at most 50 resources and 25 MiB in total.

Output

Each run writes one bounded dataset result and a RUN_SUMMARY. Selected artifacts are available from the run key-value store:

• REPORT.json — complete machine-readable report
• REPORT.md — human-readable findings and scores
• FINDINGS.csv — tabular finding export

Useful partial, restricted, and unreachable audits are reported explicitly. Reports never include response bodies, extracted page text, credentials, query values, sensitive header values, or resolved private addresses.

Safety and reproducibility

Requests are DNS-pinned and revalidated before every redirect. HTTPS-to-HTTP downgrades are rejected, concurrency and redirects are bounded, and transient retries are deterministic. Scoring rules and report schemas are independently versioned so identical captured observations produce stable ordering and scores.

For support or reproducible bug reports, open an issue in the API-IFY repository and include the Actor run ID. Do not include credentials or private site data.