---
target: "docs.zapier.com"
lane: web
tier: cache
scorecard_url: "https://anc.dev/score/docs.zapier.com"
markdown_url: "https://anc.dev/score/docs.zapier.com/md"
json_url: "https://anc.dev/score/docs.zapier.com/json"
negotiate: "Accept: text/markdown or Accept: application/json on https://anc.dev/score/docs.zapier.com serve the twin and the JSON"
---

# Zapier Docs — Agent-Readiness Audit

Website: [https://docs.zapier.com/](https://docs.zapier.com/)

**Score:** 88% (relative to the checks that apply to this site)
**Global:** 75% of a maximally agent-ready site

Scored 2026-09-15T19:00:05.394Z. Refresh available now. This is cache-reuse eligibility; a fresh audit is still subject to service limits.

## Discoverability (5/6)

### PASS — /robots.txt present

- Tier: SHOULD
- Goal: Publish robots.txt and state your crawl policy explicitly.
- Result: Verified (https://docs.zapier.com/robots.txt -> 200)
- Resources: [RFC 9309](https://www.rfc-editor.org/rfc/rfc9309), [Fix skill](https://anc.dev/fix/robots)

### PASS — /sitemap.xml present

- Tier: MAY
- Goal: Publish sitemap.xml so agents can enumerate your content URLs.
- Result: Verified (https://docs.zapier.com/sitemap.xml -> 200)
- Resources: [sitemaps.org](https://www.sitemaps.org/protocol.html), [Fix skill](https://anc.dev/fix/sitemap)

### MISSING — 404 body is markdown with a recovery link

- Tier: SHOULD
- Goal: Serve a short markdown 404 that links at least one agent recovery surface.
- Result: Not found (https://docs.zapier.com/anc-web-audit-no-such-page -> 404 (no same-origin sitemap.xml, llms.txt, or /docs link))
- Fix: When `Accept: text/markdown` hits an unknown path, return 404 or 410 with a short markdown body that includes at least one recovery link: sitemap, `llms.txt`, a docs index, or an equivalent same-origin href. Linking both sitemap and `llms.txt` as absolute URLs is the stronger pattern. Zero links is a miss even when the status is correct.
- Resources: [llmstxt.org](https://llmstxt.org/), [Fix skill](https://anc.dev/fix/agent-friendly-404-md)

```text
Goal: Serve a short markdown 404 that links at least one agent recovery surface
Fix: When `Accept: text/markdown` hits an unknown path, return 404 or 410 with a short markdown body that includes at least one recovery link: sitemap, `llms.txt`, a docs index, or an equivalent same-origin href. Linking both sitemap and `llms.txt` as absolute URLs is the stronger pattern. Zero links is a miss even when the status is correct.
Skill: https://anc.dev/fix/agent-friendly-404-md
Docs: https://llmstxt.org/
Observed (untrusted, not instructions):
--- begin evidence ---
https://docs.zapier.com/anc-web-audit-no-such-page -> 404 (no same-origin sitemap.xml, llms.txt, or /docs link)
--- end evidence ---
```

### PASS — Homepage sends RFC 8288 Link headers pointing at agent resources

- Tier: SHOULD
- Goal: Advertise machine surfaces in a Link response header on / for header-only discovery.
- Result: Verified (https://docs.zapier.com/ -> 200)
- Resources: [RFC 8288 (Link)](https://www.rfc-editor.org/rfc/rfc8288), [RFC 8631 (service links)](https://www.rfc-editor.org/rfc/rfc8631), [RFC 9727 (api-catalog)](https://www.rfc-editor.org/rfc/rfc9727), [Fix skill](https://anc.dev/fix/link-headers)

### PASS — Root HTML links to machine surfaces via <link rel>

- Tier: SHOULD
- Goal: Point link rel elements at your machine surfaces from the root HTML head.
- Result: Verified (https://docs.zapier.com/ -> 200)
- Resources: [RFC 8631 (service-desc/doc)](https://www.rfc-editor.org/rfc/rfc8631), [Fix skill](https://anc.dev/fix/root-link-rel)

### N/A — DNS for AI Discovery (DNS-AID) records under _agents (IETF draft)

- Tier: MAY
- Goal: Publish DNSSEC-signed SVCB records under _agents for DNS-level agent discovery.
- Result: Not implemented, optional (no DNS-AID records)
- Resources: [DNS-AID draft](https://datatracker.ietf.org/doc/draft-mozleywilliams-dnsop-dnsaid/), [Fix skill](https://anc.dev/fix/dns-aid)

### PASS — Unknown paths return HTTP 404 or 410

- Tier: SHOULD
- Goal: Return a real HTTP 404 or 410 for unknown paths instead of a 200 SPA shell.
- Result: Verified (https://docs.zapier.com/anc-web-audit-no-such-page -> 404)
- Resources: [RFC 9110 status codes](https://www.rfc-editor.org/rfc/rfc9110#name-status-codes), [Fix skill](https://anc.dev/fix/agent-friendly-404)

## Content for agents (13/14)

### PASS — /llms.txt present with a summary and link index

- Tier: SHOULD
- Goal: Serve /llms.txt with a title, summary, and categorized link index.
- Result: Verified (https://docs.zapier.com/llms.txt -> 200)
- Resources: [llmstxt.org](https://llmstxt.org/), [Fix skill](https://anc.dev/fix/llms-txt)

### PASS — /llms-full.txt present (single-fetch full corpus)

- Tier: MAY
- Goal: Serve the whole docs corpus as markdown at /llms-full.txt for one-fetch ingestion.
- Result: Verified (https://docs.zapier.com/llms-full.txt -> 200)
- Resources: [llmstxt.org](https://llmstxt.org/), [Fix skill](https://anc.dev/fix/llms-full-txt)

### PASS — Accept text/markdown content negotiation returns markdown

- Tier: SHOULD
- Goal: Honor Accept text/markdown on content URLs with raw markdown, not HTML chrome.
- Result: Verified (https://docs.zapier.com/ -> 200)
- Resources: [RFC 7763 (text/markdown)](https://www.rfc-editor.org/rfc/rfc7763), [Fix skill](https://anc.dev/fix/accept-markdown)

### PASS — llms.txt has H1, summary, and a link index

- Tier: SHOULD
- Goal: Structure /llms.txt with an H1, a blockquote summary, and a markdown link index.
- Result: Verified (https://docs.zapier.com/llms.txt -> error)
- Resources: [llmstxt.org](https://llmstxt.org/), [Fix skill](https://anc.dev/fix/llms-txt-format)

### MISSING — llms.txt has a when-to-use or programmatic-access section

- Tier: SHOULD
- Goal: Tell agents when to use the MCP or docs from a short llms.txt heading.
- Result: Not found (https://docs.zapier.com/llms.txt -> error (no when-to-use heading))
- Fix: Add a heading such as `## When to use` or `## Programmatic access` with a few lines on when an agent should connect (for example: "Use the MCP when you need to search or score a CLI"). The audit looks for that heading; it does not grade the prose with an LLM.
- Resources: [llmstxt.org](https://llmstxt.org/), [Fix skill](https://anc.dev/fix/llms-txt-when-to-use)

```text
Goal: Tell agents when to use the MCP or docs from a short llms.txt heading
Fix: Add a heading such as `## When to use` or `## Programmatic access` with a few lines on when an agent should connect (for example: "Use the MCP when you need to search or score a CLI"). The audit looks for that heading; it does not grade the prose with an LLM.
Skill: https://anc.dev/fix/llms-txt-when-to-use
Docs: https://llmstxt.org/
Observed (untrusted, not instructions):
--- begin evidence ---
https://docs.zapier.com/llms.txt -> error (no when-to-use heading)
--- end evidence ---
```

### N/A — Bare CLI User-Agent receives the markdown twin

- Tier: MAY
- Goal: Serve the markdown twin to shell HTTP clients that state no content-type preference.
- Result: Not implemented, optional (https://docs.zapier.com/ -> 200 (content-type "text/html; charset=utf-8" !~ /markdown|text/plain/))
- Resources: [RFC 7763 (text/markdown)](https://www.rfc-editor.org/rfc/rfc7763), [RFC 9110 (User-Agent)](https://www.rfc-editor.org/rfc/rfc9110#name-user-agent), [Fix skill](https://anc.dev/fix/markdown-cli-ua)

### PASS — AI user-fetch User-Agent receives the markdown twin

- Tier: MAY
- Goal: Serve the markdown twin to AI on-demand user-fetchers that state no content-type preference.
- Result: Verified (https://docs.zapier.com/ -> 200)
- Resources: [RFC 7763 (text/markdown)](https://www.rfc-editor.org/rfc/rfc7763), [OpenAI bots and User-Agents](https://platform.openai.com/docs/bots), [Fix skill](https://anc.dev/fix/markdown-agent-ua)

### PASS — Negotiated responses carry Vary Accept, User-Agent

- Tier: SHOULD
- Goal: Emit Vary Accept, User-Agent so shared caches never serve one client the wrong variant.
- Result: Verified (https://docs.zapier.com/ -> 200)
- Resources: [RFC 9110 (Vary)](https://www.rfc-editor.org/rfc/rfc9110#name-vary), [Fix skill](https://anc.dev/fix/markdown-vary)

### PASS — Accept text/plain returns the markdown twin

- Tier: MAY
- Goal: Treat Accept text/plain as a request for the raw markdown source.
- Result: Verified (https://docs.zapier.com/ -> 200)
- Resources: [RFC 7763 (text/markdown)](https://www.rfc-editor.org/rfc/rfc7763), [Fix skill](https://anc.dev/fix/markdown-accept-plain)

### PASS — Root HTML has a descriptive <meta name="description">

- Tier: SHOULD
- Goal: Add a meta description naming what the service does and its agent entry points.
- Result: Verified (https://docs.zapier.com/ -> 200)
- Resources: [MDN meta description](https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/meta/name), [Fix skill](https://anc.dev/fix/root-meta-description)

### PASS — Root HTML embeds Schema.org JSON-LD

- Tier: MAY
- Goal: Embed Schema.org JSON-LD so agents get typed facts without inference.
- Result: Verified (https://docs.zapier.com/ -> 200)
- Resources: [Schema.org](https://schema.org/docs/gs.html), [Fix skill](https://anc.dev/fix/schema-org-jsonld)

### PASS — Root HTML has an H1 and readable text without JavaScript

- Tier: SHOULD
- Goal: Put an H1 and enough visible text in the raw root HTML that a non-JS agent can read the page.
- Result: Verified (https://docs.zapier.com/ -> 200)
- Resources: [llmstxt.org](https://llmstxt.org/), [Fix skill](https://anc.dev/fix/content-without-js)

### PASS — Root HTML uses semantic landmarks

- Tier: MAY
- Goal: Use semantic landmarks so the HTML path is parseable structure, not div soup.
- Result: Verified (https://docs.zapier.com/ -> 200)
- Resources: [MDN content sectioning](https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements#content_sectioning), [Fix skill](https://anc.dev/fix/semantic-html)

### PASS — Root HTML has a <noscript> with machine entry points

- Tier: SHOULD
- Goal: Give non-JS agents a noscript block listing your machine entry points.
- Result: Verified (https://docs.zapier.com/ -> 200)
- Resources: [MDN noscript](https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/noscript), [Fix skill](https://anc.dev/fix/noscript-fallback)

### N/A — Markdown twin carries YAML frontmatter

- Tier: MAY
- Goal: Prefix the markdown twin with a YAML frontmatter block so agents read page metadata without parsing the body.
- Result: Not implemented, optional (https://docs.zapier.com/ -> 200 (no leading frontmatter fence))
- Resources: [YAML front matter (Jekyll)](https://jekyllrb.com/docs/front-matter/), [RFC 7763 (text/markdown)](https://www.rfc-editor.org/rfc/rfc7763), [Fix skill](https://anc.dev/fix/markdown-frontmatter)

### PASS — llms.txt links resolve

- Tier: SHOULD
- Goal: Make every markdown href in /llms.txt fetchable.
- Result: Verified (https://zapier.com/llms.txt -> 200)
- Resources: [llmstxt.org](https://llmstxt.org/), [Fix skill](https://anc.dev/fix/llms-txt-links)

### N/A — Per-section llms-full.txt files resolve under content subdirectories

- Tier: MAY
- Goal: Serve a scoped llms-full.txt corpus inside each major content section.
- Result: Not implemented, optional (https://docs.zapier.com/mcp/llms-full.txt -> 404)
- Resources: [llmstxt.org](https://llmstxt.org/), [Fix skill](https://anc.dev/fix/llms-full-txt-scoped)

### N/A — Per-section llms.txt files resolve under content subdirectories

- Tier: MAY
- Goal: Serve a scoped llms.txt inside each major content section.
- Result: Not implemented, optional (https://docs.zapier.com/mcp/llms.txt -> 404)
- Resources: [llmstxt.org](https://llmstxt.org/), [Fix skill](https://anc.dev/fix/llms-txt-scoped)

## Bot & crawl policy (3/3)

### PASS — AI user-fetch User-Agent can reach the homepage

- Tier: SHOULD
- Goal: Let on-demand user-fetchers GET / with Accept */* and receive 2xx, not a challenge page.
- Result: Verified (https://docs.zapier.com/ -> 200)
- Resources: [OpenAI user-fetchers](https://platform.openai.com/docs/bots), [Fix skill](https://anc.dev/fix/agent-ua-reachable)

### PASS — robots.txt declares AI-crawler rules (RFC 9309)

- Tier: SHOULD
- Goal: State your AI-crawler policy in robots.txt with explicit User-agent rules.
- Result: Verified (https://docs.zapier.com/robots.txt -> 200)
- Resources: [RFC 9309](https://www.rfc-editor.org/rfc/rfc9309), [Fix skill](https://anc.dev/fix/robots-ai-rules)

### PASS — robots.txt declares Content-Signal AI-usage preferences

- Tier: SHOULD
- Goal: Declare Content-Signal AI-usage preferences in robots.txt.
- Result: Verified (https://docs.zapier.com/robots.txt -> 200)
- Resources: [contentsignals.org](https://contentsignals.org/), [Fix skill](https://anc.dev/fix/content-signals)

### N/A — Web Bot Auth signature directory present (informational)

- Tier: MAY
- Goal: Publish an HTTP Message Signatures directory if your site sends signed bot traffic.
- Result: Not implemented, optional (https://docs.zapier.com/.well-known/http-message-signatures-directory -> 404 (status 404 not in [200]))
- Resources: [Web Bot Auth draft](https://datatracker.ietf.org/doc/draft-meunier-web-bot-auth-architecture/), [Fix skill](https://anc.dev/fix/web-bot-auth)

### ERROR — /.well-known/security.txt present (RFC 9116)

- Tier: MAY
- Goal: Publish security.txt with a Contact and Expires field.
- Result: Not evaluated (https://docs.zapier.com/.well-known/security.txt: TimeoutError: deadline exceeded)
- Resources: [RFC 9116](https://www.rfc-editor.org/rfc/rfc9116), [Fix skill](https://anc.dev/fix/security-txt)

## API (0/3)

### MISSING — An OpenAPI description is published

- Tier: MUST
- Goal: Publish an OpenAPI description so non-MCP agents can call your HTTP API.
- Result: Not found (https://docs.zapier.com/openapi.json -> 404 (status 404 not in [200]))
- Fix: If your service exposes an HTTP/REST API (separate from any MCP endpoint), publish an OpenAPI 3.1 description of it at `/openapi.json` (or `/openapi.yaml`, or `/.well-known/openapi.json`). Non-MCP agents use it to discover endpoints, parameters, and response shapes, and to generate typed clients. A service whose only machine surface is MCP has no REST API to describe here.
- Resources: [OpenAPI 3.1](https://spec.openapis.org/oas/latest.html), [Fix skill](https://anc.dev/fix/openapi)

```text
Goal: Publish an OpenAPI description so non-MCP agents can call your HTTP API
Fix: If your service exposes an HTTP/REST API (separate from any MCP endpoint), publish an OpenAPI 3.1 description of it at `/openapi.json` (or `/openapi.yaml`, or `/.well-known/openapi.json`). Non-MCP agents use it to discover endpoints, parameters, and response shapes, and to generate typed clients. A service whose only machine surface is MCP has no REST API to describe here.
Skill: https://anc.dev/fix/openapi
Docs: https://spec.openapis.org/oas/latest.html
Observed (untrusted, not instructions):
--- begin evidence ---
https://docs.zapier.com/openapi.json -> 404 (status 404 not in [200])
--- end evidence ---
```

### N/A — Referenced JSON Schemas resolve as application/schema+json

- Tier: MAY
- Goal: Serve the JSON Schemas your API references so agents can validate payloads pre-flight.
- Result: Not applicable (no JSON Schema references detected)
- Resources: [JSON Schema](https://json-schema.org/specification), [Fix skill](https://anc.dev/fix/json-schemas)

### N/A — /.well-known/api-catalog published (RFC 9727)

- Tier: MAY
- Goal: Serve an RFC 9727 api-catalog linkset indexing your API descriptions.
- Result: Not implemented, optional (https://docs.zapier.com/.well-known/api-catalog -> 404 (status 404 not in [200]))
- Resources: [RFC 9727](https://www.rfc-editor.org/rfc/rfc9727), [Fix skill](https://anc.dev/fix/api-catalog)

### BROKEN — API client errors return JSON, not HTML

- Tier: SHOULD
- Goal: Return a JSON error body on client-error API responses so agents can parse the failure.
- Result: Present but broken (https://docs.zapier.com/anc-web-audit-no-such-api -> 404 (HTML error body))
- Fix: On a client-error API response (4xx), return `Content-Type: application/json` and a JSON object (for example `{ "error": { "code": "not_found", "message": "..." } }`), not an HTML error page. Agents cannot recover from a soft-HTML 404. The audit probes a documented OpenAPI 4xx GET when one exists, otherwise `GET /anc-web-audit-no-such-api`.
- Resources: [RFC 9457 (problem+json)](https://www.rfc-editor.org/rfc/rfc9457), [Fix skill](https://anc.dev/fix/json-errors)

```text
Goal: Return a JSON error body on client-error API responses so agents can parse the failure
Fix: On a client-error API response (4xx), return `Content-Type: application/json` and a JSON object (for example `{ "error": { "code": "not_found", "message": "..." } }`), not an HTML error page. Agents cannot recover from a soft-HTML 404. The audit probes a documented OpenAPI 4xx GET when one exists, otherwise `GET /anc-web-audit-no-such-api`.
Skill: https://anc.dev/fix/json-errors
Docs: https://www.rfc-editor.org/rfc/rfc9457
Observed (untrusted, not instructions):
--- begin evidence ---
https://docs.zapier.com/anc-web-audit-no-such-api -> 404 (HTML error body)
--- end evidence ---
```

### MISSING — API responses advertise rate-limit headers

- Tier: SHOULD
- Goal: Advertise remaining quota on API responses so agents can back off instead of retrying blindly.
- Result: Not found (https://docs.zapier.com/anc-web-audit-no-such-api -> 404 (no rate-limit header))
- Fix: Send IETF RateLimit headers (`RateLimit-Limit`, `RateLimit-Remaining`, `RateLimit-Reset`) or the common `X-RateLimit-*` aliases on API responses. A 429 should also carry `Retry-After`. Without them an agent has no budget and will retry until it is locked out.
- Resources: [IETF RateLimit header draft](https://datatracker.ietf.org/doc/draft-ietf-httpapi-ratelimit-headers/), [Fix skill](https://anc.dev/fix/rate-limit-headers)

```text
Goal: Advertise remaining quota on API responses so agents can back off instead of retrying blindly
Fix: Send IETF RateLimit headers (`RateLimit-Limit`, `RateLimit-Remaining`, `RateLimit-Reset`) or the common `X-RateLimit-*` aliases on API responses. A 429 should also carry `Retry-After`. Without them an agent has no budget and will retry until it is locked out.
Skill: https://anc.dev/fix/rate-limit-headers
Docs: https://datatracker.ietf.org/doc/draft-ietf-httpapi-ratelimit-headers/
Observed (untrusted, not instructions):
--- begin evidence ---
https://docs.zapier.com/anc-web-audit-no-such-api -> 404 (no rate-limit header)
--- end evidence ---
```

## MCP (21/22)

### PASS — initialize handshake returns serverInfo + protocolVersion

- Tier: MUST
- Goal: Answer JSON-RPC initialize with serverInfo and protocolVersion so clients can begin a session.
- Result: Verified (serverInfo Zapier, protocol 2025-06-18)
- Resources: [MCP lifecycle](https://modelcontextprotocol.io/specification/2025-06-18/basic/lifecycle), [Fix skill](https://anc.dev/fix/mcp-initialize)

### PASS — server/discover answers with server identity on the modern lane

- Tier: SHOULD
- Goal: Answer server/discover with supported versions, capabilities, and server identity.
- Result: Verified (supports 2026-07-28, serverInfo Zapier)
- Resources: [MCP lifecycle (2026-07-28)](https://modelcontextprotocol.io/specification/2026-07-28/basic/lifecycle), [Fix skill](https://anc.dev/fix/mcp-server-discover)

### PASS — initialize advertises capabilities (tools / resources / prompts)

- Tier: SHOULD
- Goal: Advertise the capability groups your MCP server implements in the initialize result.
- Result: Verified (serverInfo Zapier, protocol 2025-06-18)
- Resources: [MCP lifecycle](https://modelcontextprotocol.io/specification/2025-06-18/basic/lifecycle), [Fix skill](https://anc.dev/fix/mcp-capabilities)

### PASS — tools/list returns a tools array with input schemas

- Tier: MUST
- Goal: Return tools/list entries with name, description, and a JSON inputSchema.
- Result: Verified (3 tools, 3 with input schema)
- Resources: [MCP tools](https://modelcontextprotocol.io/specification/2025-06-18/server/tools), [Fix skill](https://anc.dev/fix/mcp-tools-list)

### PASS — resources/list returns at least one resource when advertised

- Tier: SHOULD
- Goal: Honor capabilities.resources with a non-empty resources/list result.
- Result: Verified (https://docs.zapier.com/mcp -> 200)
- Resources: [MCP resources](https://modelcontextprotocol.io/specification/2025-06-18/server/resources), [Fix skill](https://anc.dev/fix/mcp-resources-list)

### PASS — unknown JSON-RPC method returns -32601

- Tier: SHOULD
- Goal: Reject unknown JSON-RPC methods with error -32601 instead of a hang or 500.
- Result: Verified (error code -32601)
- Resources: [JSON-RPC 2.0](https://www.jsonrpc.org/specification#error_object), [Fix skill](https://anc.dev/fix/mcp-unknown-method)

### PASS — a non-JSON body draws -32700 (or a typed HTTP 400/415 refusal)

- Tier: SHOULD
- Goal: Refuse an unparseable request body with a parse-error envelope or a typed HTTP refusal.
- Result: Verified (error code -32700)
- Resources: [JSON-RPC 2.0](https://www.jsonrpc.org/specification#error_object), [Fix skill](https://anc.dev/fix/mcp-malformed-body)

### PASS — header-routed tools/list (2026-07-28) returns tools without initialize

- Tier: MUST
- Goal: Answer a modern header-routed tools/list without requiring an initialize handshake.
- Result: Verified (3 tools, 3 with input schema)
- Resources: [MCP lifecycle (2026-07-28)](https://modelcontextprotocol.io/specification/2026-07-28/basic/lifecycle), [MCP tools (2026-07-28)](https://modelcontextprotocol.io/specification/2026-07-28/server/tools), [Fix skill](https://anc.dev/fix/mcp-modern-tools-list)

### PASS — a batch carrying a modern-envelope request is rejected -32600

- Tier: SHOULD
- Goal: Refuse JSON array batches that carry modern-era envelopes with -32600.
- Result: Verified (error code -32600)
- Resources: [JSON-RPC 2.0](https://www.jsonrpc.org/specification#error_object), [MCP transports (2026-07-28)](https://modelcontextprotocol.io/specification/2026-07-28/basic/transports), [Fix skill](https://anc.dev/fix/mcp-batch-reject)

### PASS — tools/call with an unknown tool name returns -32602

- Tier: SHOULD
- Goal: Reject an unknown tool name with -32602 instead of a hang, a 500, or a fake result.
- Result: Verified (error code -32602)
- Resources: [MCP tools](https://modelcontextprotocol.io/specification/2025-06-18/server/tools), [JSON-RPC 2.0](https://www.jsonrpc.org/specification#error_object), [Fix skill](https://anc.dev/fix/mcp-unknown-tool)

### PASS — an unknown method on the modern lane returns -32601

- Tier: SHOULD
- Goal: Reject unknown header-routed methods with -32601 on the 2026-07-28 lane.
- Result: Verified (error code -32601)
- Resources: [JSON-RPC 2.0](https://www.jsonrpc.org/specification#error_object), [MCP lifecycle (2026-07-28)](https://modelcontextprotocol.io/specification/2026-07-28/basic/lifecycle), [Fix skill](https://anc.dev/fix/mcp-modern-unknown-method)

### PASS — _meta missing clientCapabilities is rejected (-32602 or -32600)

- Tier: SHOULD
- Goal: Enforce the mandatory clientCapabilities key on every modern request.
- Result: Verified (error code -32602)
- Resources: [MCP lifecycle (2026-07-28)](https://modelcontextprotocol.io/specification/2026-07-28/basic/lifecycle), [Fix skill](https://anc.dev/fix/mcp-modern-clientcaps)

### PASS — an Mcp-Method header disagreeing with the body method draws -32020

- Tier: SHOULD
- Goal: Validate the SEP-2243 header mirror between Mcp-Method and the body method.
- Result: Verified (error code -32020)
- Resources: [MCP lifecycle (2026-07-28)](https://modelcontextprotocol.io/specification/2026-07-28/basic/lifecycle), [Fix skill](https://anc.dev/fix/mcp-modern-header-mismatch)

### PASS — an unsupported protocol version is rejected -32022 with data.supported

- Tier: SHOULD
- Goal: Refuse unsupported protocol version claims with -32022 and advertise the served revisions.
- Result: Verified (error code -32022)
- Resources: [MCP lifecycle (2026-07-28)](https://modelcontextprotocol.io/specification/2026-07-28/basic/lifecycle), [Fix skill](https://anc.dev/fix/mcp-modern-version-reject)

### PASS — a JSON-only Accept is answered without SSE framing

- Tier: SHOULD
- Goal: Serve a single application/json response to a client whose Accept names only application/json.
- Result: Verified (https://docs.zapier.com/mcp -> 406)
- Resources: [MCP transports](https://modelcontextprotocol.io/specification/2025-06-18/basic/transports), [RFC 9110 section 12.5.1 (Accept)](https://www.rfc-editor.org/rfc/rfc9110#name-accept), [Fix skill](https://anc.dev/fix/mcp-accept-json)

### PASS — an unsatisfiable Accept draws a 406 rather than an unasked-for type

- Tier: SHOULD
- Goal: Refuse an Accept you cannot satisfy with 406, never a 200 carrying a type the client did not request.
- Result: Verified (https://docs.zapier.com/mcp -> 406)
- Resources: [RFC 9110 section 15.5.7 (406 Not Acceptable)](https://www.rfc-editor.org/rfc/rfc9110#name-406-not-acceptable), [MCP transports](https://modelcontextprotocol.io/specification/2025-06-18/basic/transports), [Fix skill](https://anc.dev/fix/mcp-accept-unsatisfiable)

### PASS — GET on the MCP endpoint answers fast (not a held-open hang)

- Tier: SHOULD
- Goal: Answer GET on the MCP endpoint fast (a fast-fail status or a documented surface), never a held-open hang.
- Result: Verified (https://docs.zapier.com/mcp -> 405)
- Resources: [MCP transports](https://modelcontextprotocol.io/specification/2025-06-18/basic/transports), [Fix skill](https://anc.dev/fix/mcp-get-fast-fail)

### N/A — CORS preflight (OPTIONS) succeeds with Access-Control-Allow-* headers

- Tier: SHOULD
- Goal: Serve one consistent CORS posture on the MCP endpoint, full preflight support or none.
- Result: Deliberate posture, not scored (no Allow-Origin on the preflight or the POST: consistent no-CORS posture)
- Resources: [MDN CORS preflight](https://developer.mozilla.org/en-US/docs/Glossary/Preflight_request), [Fix skill](https://anc.dev/fix/mcp-cors-preflight)

### PASS — Root HTML exposes WebMCP browser tools

- Tier: MAY
- Goal: Expose page tools to browser agents via WebMCP.
- Result: Verified (https://docs.zapier.com/ -> 200 (modelContext API reference))
- Resources: [WebMCP spec](https://webmachinelearning.github.io/webmcp/), [Fix skill](https://anc.dev/fix/webmcp)

### PASS — A .well-known MCP server card is published (SEP-1649)

- Tier: SHOULD
- Goal: Publish an MCP server card at the canonical SEP-1649 path.
- Result: Verified (https://docs.zapier.com/.well-known/mcp/server-card.json -> 200)
- Resources: [SEP-1649](https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2127), [Fix skill](https://anc.dev/fix/well-known-mcp-card)

### N/A — POST response carries Access-Control-Allow-Origin

- Tier: SHOULD
- Goal: Mirror the declared CORS posture on the actual MCP POST response.
- Result: Deliberate posture, not scored (no Allow-Origin on the preflight or the POST: consistent no-CORS posture)
- Resources: [MDN CORS](https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CORS), [Fix skill](https://anc.dev/fix/mcp-cors-actual)

### PASS — modern resources/read with an unknown URI returns -32602

- Tier: SHOULD
- Goal: Answer an unknown resource URI with the typed miss code, not a hang or a fake result.
- Result: Verified (error code -32602)
- Resources: [MCP resources (2026-07-28)](https://modelcontextprotocol.io/specification/2026-07-28/server/resources), [JSON-RPC 2.0](https://www.jsonrpc.org/specification#error_object), [Fix skill](https://anc.dev/fix/mcp-modern-resources-miss)

### PASS — A human/agent usage doc for the server resolves

- Tier: MAY
- Goal: Publish a one-fetch markdown usage doc for your MCP server.
- Result: Verified (https://docs.zapier.com/mcp.md -> 200)
- Resources: [anc.dev example](https://anc.dev/mcp-skill.md), [Fix skill](https://anc.dev/fix/mcp-usage-doc)

### NONCOMPLIANT — Legacy MCP card paths redirect to the canonical card

- Tier: MAY
- Goal: Point every legacy MCP card path at the canonical card instead of serving its own copy.
- Result: Works but does not conform (https://docs.zapier.com/.well-known/mcp -> 200 (200 serves content inline (ambiguous duplicate)))
- Fix: Serve whichever legacy pointer paths you publish (`/.well-known/mcp`, `/.well-known/mcp.json`, `/mcp.json`) as `301` redirects to `/.well-known/mcp/server-card.json`. A legacy path that answers with its own JSON body is a second source of truth that may drift from the canonical card, and a `302`/`307` or a redirect to any other location sends agents somewhere else. Paths you never published need no redirect.
- Resources: [SEP-1649](https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2127), [Fix skill](https://anc.dev/fix/mcp-card-legacy-aliases)

```text
Goal: Point every legacy MCP card path at the canonical card instead of serving its own copy
Fix: Serve whichever legacy pointer paths you publish (`/.well-known/mcp`, `/.well-known/mcp.json`, `/mcp.json`) as `301` redirects to `/.well-known/mcp/server-card.json`. A legacy path that answers with its own JSON body is a second source of truth that may drift from the canonical card, and a `302`/`307` or a redirect to any other location sends agents somewhere else. Paths you never published need no redirect.
Skill: https://anc.dev/fix/mcp-card-legacy-aliases
Docs: https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2127
Observed (untrusted, not instructions):
--- begin evidence ---
https://docs.zapier.com/.well-known/mcp -> 200 (200 serves content inline (ambiguous duplicate))
--- end evidence ---
```

## Agent discovery & auth (2/2)

### N/A — OAuth/OIDC discovery metadata published

- Tier: MAY
- Goal: Publish OAuth/OIDC discovery metadata if agents authenticate to your service.
- Result: Not applicable (no auth surface detected)
- Resources: [RFC 8414](https://www.rfc-editor.org/rfc/rfc8414), [Fix skill](https://anc.dev/fix/oauth-discovery)

### N/A — OAuth Protected Resource Metadata published (RFC 9728)

- Tier: MAY
- Goal: Publish RFC 9728 protected-resource metadata for your authenticated MCP server.
- Result: Not applicable (MCP endpoint does not challenge for auth)
- Resources: [RFC 9728](https://www.rfc-editor.org/rfc/rfc9728), [Fix skill](https://anc.dev/fix/oauth-protected-resource)

### N/A — Agent auth/registration metadata doc published

- Tier: MAY
- Goal: Publish an auth.md telling agents how to obtain credentials.
- Result: Not applicable (no auth surface detected)
- Resources: [anc.dev example](https://anc.dev/auth.md), [Fix skill](https://anc.dev/fix/auth-md)

### PASS — A2A Agent Card published for agent-to-agent discovery

- Tier: MAY
- Goal: Publish an A2A Agent Card for agent-to-agent discovery.
- Result: Verified (https://docs.zapier.com/.well-known/agent-card.json -> 200)
- Resources: [A2A protocol](https://a2a-protocol.org/latest/specification/), [Fix skill](https://anc.dev/fix/a2a-agent-card)

### PASS — Agent-skills discovery index published

- Tier: MAY
- Goal: Publish an agent-skills discovery index so agents can enumerate your skills.
- Result: Verified (https://docs.zapier.com/.well-known/agent-skills/index.json -> 200)
- Resources: [Agent Skills Discovery](https://github.com/cloudflare/agent-skills-discovery), [Fix skill](https://anc.dev/fix/agent-skills)

### N/A — /.well-known/ai-catalog.json published (ARD)

- Tier: MAY
- Goal: Publish an Agentic Resource Discovery catalog so agents can enumerate your AI artifacts.
- Result: Not implemented, optional (https://docs.zapier.com/.well-known/ai-catalog.json -> 404 (status 404 not in [200]))
- Resources: [AI Catalog](https://agenticresourcediscovery.org/ai_catalog_spec/), [Fix skill](https://anc.dev/fix/ai-catalog)

## Re-run this audit

Re-audit from [https://anc.dev/audit?lane=web&target=docs.zapier.com](https://anc.dev/audit?lane=web&target=docs.zapier.com), or call the `audit_website` MCP tool.