# Agent Ready Cloudflare

> >

- **Type:** Skill
- **Install:** `agentstack add skill-fabricioctelles-skills-agent-ready-cloudflare`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [fabricioctelles](https://agentstack.voostack.com/s/fabricioctelles)
- **Installs:** 0
- **Category:** [Cloud & Infrastructure](https://agentstack.voostack.com/c/cloud-infrastructure)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [fabricioctelles](https://github.com/fabricioctelles)
- **Source:** https://github.com/fabricioctelles/skills/tree/main/skills/agent-ready-cloudflare
- **Website:** https://skill.dev.br

## Install

```sh
agentstack add skill-fabricioctelles-skills-agent-ready-cloudflare
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Agent Ready — Cloudflare Scanner

Audit any website for AI agent readiness, generate actionable fix prompts, and
implement improvements to increase the agent-ready score.

---

## 0. Operational Flow

Follow this flow every time this skill is activated:

### Step 1 — Get the domain

If the user did not provide a domain, ask:

> Which domain do you want to scan on isitagentready.com?

### Step 2 — Scan via API

```bash
curl -s -X POST 'https://isitagentready.com/api/scan' \
  -H 'Content-Type: application/json' \
  -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36' \
  -H 'Referer: https://isitagentready.com/' \
  -H 'Origin: https://isitagentready.com' \
  -d '{"url":"https://DOMAIN/","enabledChecks":["robotsTxt","sitemap","linkHeaders","dnsAid","markdownNegotiation","robotsTxtAiRules","contentSignals","webBotAuth","apiCatalog","oauthDiscovery","oauthProtectedResource","authMd","mcpServerCard","a2aAgentCard","agentSkills","webMcp","x402","mpp","ucp","acp","ap2"]}'
```

Replace `DOMAIN` with the target domain.

### Step 3 — Generate the Markdown report

Use the API response to build a report with this structure:

```markdown
# Agent Ready Scan — {domain}

> **Score:** Level {level} — {levelName}
> **Scanned:** {scannedAt}
> **Link:** [View online](https://isitagentready.com/{domain})

## Summary

| Category | Score |
|----------|-------|
| Discoverability | {passed}/{total} |
| Content | {passed}/{total} |
| Bot Access Control | {passed}/{total} |
| API, Auth, MCP & Skill Discovery | {passed}/{total} |
| Commerce (Optional) | {passed}/{total} |

## Details

### Discoverability ({passed}/{total})

- ✅ **robots.txt** — {message}
- ❌ **sitemap.xml** — {message}
  (... for each check ...)

### (... repeat for each category ...)

## 🔧 How to Implement — Agent Prompts

(... one block per failing check, see Step 4 ...)

## Next Level

**Level {nextLevel.target} — {nextLevel.name}**

To reach the next level, implement:
- {nextLevel.requirements[].description}
```

### Step 4 — Generate "How to Implement" prompts

For every check with `status: "fail"` or `status: "neutral"`, generate a prompt
block using the **Prompt Templates** in Section 8 below. The prompt combines:

1. The **Goal** and **Fix** from the template (static per check)
2. The **Issue** from the API response (`checks.{category}.{check}.message`)
3. The **Skill URL** pointing to the sub-skill
4. The **Docs** links to the relevant RFCs/specs

Format each prompt as a fenced code block the user can copy-paste into a coding agent:

````markdown
#### ❌ {check name}

**Issue:** {message from API}

```
Goal: {goal from template}

Issue: {message from API}

Fix: {fix from template}

Skill: https://isitagentready.com/.well-known/agent-skills/{skill-folder}/SKILL.md

Docs: {docs URLs from template}
```

> 📖 Reference: [{skill-folder}/SKILL.md]({skill-folder}/SKILL.md)
````

### Step 5 — Deliver

Present the full Markdown report to the user. If they want to save it to a file,
write it to the requested path.

---

## 1. What It Checks

### Discoverability (4 checks)
| Check | API Key | Pass criteria |
|-------|---------|---------------|
| robots.txt | `robotsTxt` | Returns 200 with `text/plain` containing at least one `User-agent` directive |
| sitemap.xml | `sitemap` | `/sitemap.xml` returns valid XML, or `Sitemap` directive found in robots.txt |
| Link headers | `linkHeaders` | Homepage includes `Link` headers with agent-useful relations (`service-desc`, `api-catalog`, etc.) |
| DNS-AID | `dnsAid` | SVCB/HTTPS records found under `_agents` namespace via DNS-over-HTTPS (Cloudflare → Google fallback) |

### Content (1 check)
| Check | API Key | Pass criteria |
|-------|---------|---------------|
| Markdown for Agents | `markdownNegotiation` | `Accept: text/markdown` returns `Content-Type: text/markdown` |

### Bot Access Control (3 checks)
| Check | API Key | Pass criteria |
|-------|---------|---------------|
| AI bot rules | `robotsTxtAiRules` | robots.txt contains `User-agent` entries for known AI bots (GPTBot, Claude-Web, Google-Extended, etc.) |
| Content Signals | `contentSignals` | robots.txt contains `Content-Signal` directives with ai-train/search/ai-input |
| Web Bot Auth | `webBotAuth` | `/.well-known/http-message-signatures-directory` exists with valid JWKS (informational — neutral does not affect score) |

### API, Auth, MCP & Skill Discovery (8 checks)
| Check | API Key | Pass criteria |
|-------|---------|---------------|
| API Catalog | `apiCatalog` | `/.well-known/api-catalog` returns valid `linkset+json` with API entries |
| OAuth/OIDC | `oauthDiscovery` | `/.well-known/openid-configuration` or `oauth-authorization-server` with valid OAuth metadata |
| OAuth Protected Resource | `oauthProtectedResource` | `/.well-known/oauth-protected-resource` with `resource` and `authorization_servers` |
| Auth.md | `authMd` | `/auth.md` exists with valid H1 heading containing "auth.md"; optionally PRM + AS metadata |
| MCP Server Card | `mcpServerCard` | Valid card at `/.well-known/mcp/server-card.json`, `server-cards.json`, or `mcp.json` with `serverInfo.name` |
| A2A Agent Card | `a2aAgentCard` | `/.well-known/agent-card.json` with `name`, `version`, and `supportedInterfaces` |
| Agent Skills Index | `agentSkills` | `/.well-known/agent-skills/index.json` with valid `skills` array (legacy `/.well-known/skills/` also accepted) |
| WebMCP | `webMcp` | Page exposes MCP tools via `navigator.modelContext.provideContext()` |

### Commerce — Optional (5 checks, scored only if e-commerce signals detected)
| Check | API Key | Pass criteria |
|-------|---------|---------------|
| x402 | `x402` | API routes return HTTP 402 with valid x402 payment headers |
| MPP | `mpp` | `/openapi.json` with `x-payment-info` extensions on payable operations (Machine Payment Protocol) |
| UCP | `ucp` | `/.well-known/ucp` with `protocol_version` and `services` |
| ACP | `acp` | `/.well-known/acp.json` with `protocol.name`, `api_base_url`, `transports`, `capabilities.services` |
| AP2 | `ap2` | A2A Agent Card includes AP2 extension with role information |

---

## 2. Levels

| Level | Name | Requirements |
|-------|------|-------------|
| 0 | Not Ready | Does not meet Level 1 criteria |
| 1 | Basic Web Presence | Pass 2 of 3: robots.txt, sitemap, link headers |
| 2 | Bot-Aware | Level 1 + both: AI bot rules AND Content Signals in robots.txt |
| 3 | Agent-Readable | Level 2 + markdown content negotiation |
| 4 | Agent-Integrated | Level 3 + 1 of 4: MCP Server Card, A2A Agent Card, Agent Skills, API Catalog |
| 5 | Agent-Native | Level 4 + 2 of 3: Web Bot Auth, all four integration checks, auth metadata (OAuth discovery or OAuth Protected Resource) |

---

## 3. API Reference

### Endpoint

```
POST https://isitagentready.com/api/scan
Content-Type: application/json
```

### Required Headers (Cloudflare protection)

```
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer: https://isitagentready.com/
Origin: https://isitagentready.com
```

### Request Body

```json
{
  "url": "https://example.com/",
  "enabledChecks": [
    "robotsTxt", "sitemap", "linkHeaders", "dnsAid",
    "markdownNegotiation",
    "robotsTxtAiRules", "contentSignals", "webBotAuth",
    "apiCatalog", "oauthDiscovery", "oauthProtectedResource", "authMd",
    "mcpServerCard", "a2aAgentCard", "agentSkills", "webMcp",
    "x402", "mpp", "ucp", "acp", "ap2"
  ]
}
```

All checks are optional — pass only the ones you want to run.

Set `"format": "agent"` to get a markdown response with fix instructions instead
of JSON (useful for piping directly to an LLM).

### MCP Server

The scanner is also available as an MCP server:

```
https://isitagentready.com/mcp
```

Call the `scan_site` tool with a `url` parameter. See [scan-site/SKILL.md](scan-site/SKILL.md).

### Discovered Endpoints (isitagentready.com itself)

The scanner practices what it preaches. These are its own agent-ready endpoints:

| Endpoint | Content |
|----------|---------|
| `/.well-known/api-catalog` | RFC 9727 linkset with scan API and MCP server entries |
| `/.well-known/mcp/server-card.json` | MCP Server Card (Streamable HTTP transport) |
| `/.well-known/mcp.json` | Same MCP Server Card (alternate path) |
| `/.well-known/agent-skills/index.json` | 23 skills in Agent Skills Discovery v0.2.0 format |
| `/llms.txt` | LLM-friendly overview of the scanner |
| `/llms-full.txt` | Full documentation — canonical reference for all 18 checks, pass criteria, and level system |
| `/api/health` | Health check (`{"status":"ok"}`) |
| `/mcp` | Streamable HTTP MCP server with `scan_site` tool |

The API Catalog links the scan API to its documentation (`/llms-full.txt`),
its service description (`/.well-known/mcp/server-card.json`), and its health
endpoint (`/api/health`).

### Response Structure

```json
{
  "url": "https://example.com",
  "scannedAt": "2026-04-18T13:10:58.788Z",
  "level": 1,
  "levelName": "Basic Web Presence",
  "isCommerce": false,
  "commerceSignals": [],
  "nextLevel": {
    "target": 2,
    "name": "Bot-Aware",
    "requirements": [
      {
        "check": "contentSignals",
        "description": "...",
        "shortPrompt": "...",
        "prompt": "Full implementation prompt...",
        "specUrls": ["https://..."],
        "skillUrl": "https://isitagentready.com/.well-known/agent-skills/.../SKILL.md"
      }
    ]
  },
  "checks": {
    "": {
      "": {
        "status": "pass|fail|neutral",
        "message": "Human-readable conclusion",
        "durationMs": 42,
        "evidence": [
          {
            "action": "fetch|parse|conclude",
            "label": "GET /robots.txt",
            "request": { "url": "...", "method": "GET" },
            "response": {
              "status": 200,
              "headers": { "content-type": "..." },
              "bodyPreview": "..."
            },
            "finding": {
              "outcome": "positive|negative|neutral",
              "summary": "..."
            }
          }
        ]
      }
    }
  }
}
```

### Status Values

| Status | Icon | Meaning |
|--------|------|---------|
| `pass` | ✅ | Check passed |
| `fail` | ❌ | Action needed |
| `neutral` | ⬜ | Not applicable / informational |

---

## 4. Web Interface vs API

| Feature | API | Web UI |
|---------|-----|--------|
| Score & Level | ✅ | ✅ |
| Check status + message | ✅ | ✅ |
| Evidence (audit details) | ✅ Full | ✅ Same |
| "How to implement" prompts | ⚠️ Only `nextLevel` (1 prompt) | ✅ All failing checks |
| Skill URLs | ⚠️ Only `nextLevel` | ✅ All checks |

This is why this skill includes the full prompt templates below — to reconstruct
the web-quality prompts from API data.

---

## 5. Batch Scanning

For multiple domains, add a 2-second delay between requests. Write results
incrementally to avoid data loss:

```python
import json, time, urllib.request

HEADERS = {
    "Content-Type": "application/json",
    "User-Agent": "Mozilla/5.0 ...",
    "Referer": "https://isitagentready.com/",
    "Origin": "https://isitagentready.com"
}
CHECKS = ["robotsTxt","sitemap","linkHeaders","dnsAid","markdownNegotiation",
          "robotsTxtAiRules","contentSignals","webBotAuth","apiCatalog",
          "oauthDiscovery","oauthProtectedResource","authMd","mcpServerCard",
          "a2aAgentCard","agentSkills","webMcp","x402","mpp","ucp","acp","ap2"]

for domain in domains:
    body = json.dumps({"url": f"https://{domain}/", "enabledChecks": CHECKS}).encode()
    req = urllib.request.Request("https://isitagentready.com/api/scan",
                                data=body, headers=HEADERS)
    with urllib.request.urlopen(req, timeout=90) as resp:
        data = json.loads(resp.read())
    # process data...
    time.sleep(2)
```

---

## 6. Sub-Skills (Implementation Guides)

### Discoverability
- [robots-txt/SKILL.md](robots-txt/SKILL.md) — Publish `/robots.txt` (RFC 9309)
- [sitemap/SKILL.md](sitemap/SKILL.md) — Publish `/sitemap.xml`
- [link-headers/SKILL.md](link-headers/SKILL.md) — Add `Link` response headers (RFC 8288)
- [dns-aid/SKILL.md](dns-aid/SKILL.md) — Publish DNS-AID SVCB records for agent discovery (draft-mozleywilliams-dnsop-dnsaid)
- [llms-txt/SKILL.md](llms-txt/SKILL.md) — Publish `/llms.txt` (llmstxt.org)
- [llms-full-txt/SKILL.md](llms-full-txt/SKILL.md) — Publish `/llms-full.txt`

### Content
- [markdown-negotiation/SKILL.md](markdown-negotiation/SKILL.md) — Return markdown on `Accept: text/markdown`

### Bot Access Control
- [ai-rules/SKILL.md](ai-rules/SKILL.md) — AI bot `User-agent` rules in robots.txt
- [content-signals/SKILL.md](content-signals/SKILL.md) — `Content-Signal` directives
- [web-bot-auth/SKILL.md](web-bot-auth/SKILL.md) — JWKS for request signing

### API, Auth, MCP & Skill Discovery
- [api-catalog/SKILL.md](api-catalog/SKILL.md) — API Catalog (RFC 9727)
- [oauth-discovery/SKILL.md](oauth-discovery/SKILL.md) — OAuth/OIDC discovery (RFC 8414)
- [oauth-protected-resource/SKILL.md](oauth-protected-resource/SKILL.md) — Protected Resource Metadata (RFC 9728)
- [auth-md/SKILL.md](auth-md/SKILL.md) — Auth.md agent registration discovery (auth-md.com)
- [mcp-server-card/SKILL.md](mcp-server-card/SKILL.md) — MCP Server Card (SEP-1649)
- [a2a-agent-card/SKILL.md](a2a-agent-card/SKILL.md) — A2A Agent Card (Google A2A Protocol)
- [agent-skills/SKILL.md](agent-skills/SKILL.md) — Agent Skills Discovery Index
- [webmcp/SKILL.md](webmcp/SKILL.md) — WebMCP browser API

### Commerce (Optional)
- [x402/SKILL.md](x402/SKILL.md) — x402 HTTP payment protocol
- [mpp/SKILL.md](mpp/SKILL.md) — Machine Payment Protocol (mpp.dev)
- [ucp/SKILL.md](ucp/SKILL.md) — Universal Commerce Protocol
- [acp/SKILL.md](acp/SKILL.md) — Agent Commerce Protocol

### Meta
- [scan-site/SKILL.md](scan-site/SKILL.md) — Scan any site for agent readiness (includes MCP server endpoint)

---

## 7. Priority Order for Maximum Impact

1. `robots.txt` + `sitemap.xml` → Level 1
2. `Content Signals` in robots.txt → Level 2
3. `Markdown for Agents` + `Link headers` → toward Level 3
4. `MCP Server Card` + `Agent Skills Index` → toward Level 4
5. `OAuth discovery` + `API Catalog` → full agent interoperability

---

## 8. Prompt Templates per Check

These templates replicate the "How to implement — paste into your coding agent"
prompts from the web UI. When generating the report (Step 4), use the `{issue}`
placeholder with the actual `message` from the API response.

### `robotsTxt`

```
Goal: Publish /robots.txt with clear crawl rules

Issue: {issue}

Fix: Create /robots.txt at the site root with explicit User-agent directives and allow/disallow rules for key paths. Ensure it is plain text and returns 200.

Skill: https://isitagentready.com/.well-known/agent-skills/robots-txt/SKILL.md

Docs: https://www.rfc-editor.org/rfc/rfc9309
```

Sub-skill: [robots-txt/SKILL.md](robots-txt/SKILL.md)

### `sitemap`

```
Goal: Publish /sitemap.xml with canonical URLs

Issue: {issue}

Fix: Generate /sitemap.xml listing canonical URLs, keep it updated on publish, and reference it from /robots.txt.

Skill: https://isitagentready.com/.well-known/agent-skills/sitemap/SKILL.md

Docs: https://www.sitemaps.org/protocol.html
```

Sub-skill: [sitemap/SKILL.md](sitemap/SKILL.md)

### `linkHeaders`

```
Goal: Include Link response headers for agent discovery (RFC 8288)

Issue: {issue}

Fix: Add Link response headers to your homepage that point agents to useful resources. For example: Link: ; rel="api-catalog" to advertise your API catalog, or Link: ; rel="service-doc" for API documentation. See RFC 8288 for the Link header format and IANA Link Relations for registered relation types.

Skill: https://isitagentready.com/.well-known/agent-skills/link-headers/SKILL.md

Docs: https://www.rfc-editor.org/rfc/rfc8288, https://www.rfc-editor.org/rfc/rfc9727#section-3
```

Sub-skill: [link-headers/SKILL.md](link-headers/SKILL.md)

### `markdownNegotiation

…

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [fabricioctelles](https://github.com/fabricioctelles)
- **Source:** [fabricioctelles/skills](https://github.com/fabricioctelles/skills)
- **License:** Apache-2.0
- **Homepage:** https://skill.dev.br

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** yes
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-fabricioctelles-skills-agent-ready-cloudflare
- Seller: https://agentstack.voostack.com/s/fabricioctelles
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.