anc.dev the agent-native standard
Install ▸

paulstamatiou.com Website

CachedScored . Refresh available now. This is cache-reuse eligibility; a fresh audit is still subject to service limits.Markdown · JSON
89site score

66 global-ready

relative to the checks that apply to this site; global measures it against a maximally agent-ready site. Website https://paulstamatiou.com/.

Declared hosts: none declared.

Checks by category

  1. C1

    Discoverability

    6 / 7 checks pass

    /robots.txt present SHOULD PASS

    Goal: Publish robots.txt and state your crawl policy explicitly.

    Result: Verified (https://paulstamatiou.com/robots.txt -> 200)

    Resources: RFC 9309 · Fix skill

    /sitemap.xml present MAY PASS

    Goal: Publish sitemap.xml so agents can enumerate your content URLs.

    Result: Verified (https://paulstamatiou.com/sitemap.xml -> 200)

    Resources: sitemaps.org · Fix skill

    Unknown paths return HTTP 404 or 410 SHOULD PASS

    Goal: Return a real HTTP 404 or 410 for unknown paths instead of a 200 SPA shell.

    Result: Verified (https://paulstamatiou.com/anc-web-audit-no-such-page -> 404)

    Resources: RFC 9110 status codes · Fix skill

    Homepage sends RFC 8288 Link headers pointing at agent resources SHOULD PASS

    Goal: Advertise machine surfaces in a Link response header on / for header-only discovery.

    Result: Verified (https://paulstamatiou.com/ -> 200)

    Resources: RFC 8288 (Link) · RFC 8631 (service links) · RFC 9727 (api-catalog) · Fix skill

    Root HTML links to machine surfaces via <link rel> SHOULD PASS

    Goal: Point link rel elements at your machine surfaces from the root HTML head.

    Result: Verified (https://paulstamatiou.com/ -> 200)

    Resources: RFC 8631 (service-desc/doc) · Fix skill

    DNS for AI Discovery (DNS-AID) records under _agents (IETF draft) MAY PASS

    Goal: Publish DNSSEC-signed SVCB records under _agents for DNS-level agent discovery.

    Result: Verified (_mcp._agents.paulstamatiou.com: 1 record(s) via https://cloudflare-dns.com/dns-query)

    Resources: DNS-AID draft · Fix skill

    404 body is markdown with a recovery link SHOULD MISSING

    Goal: Serve a short markdown 404 that links at least one agent recovery surface.

    Result: Not found (https://paulstamatiou.com/anc-web-audit-no-such-page -> 404 (content-type "text/html; charset=utf-8" !~ /markdown|text/plain/))

    Fix: When `Accept: text/markdown` hits an unknown path, return 404 or 410 with a short markdown body that includes at least one recovery link: sitemap, `llms.txt`, a docs index, or an equivalent same-origin href. Linking both sitemap and `llms.txt` as absolute URLs is the stronger pattern. Zero links is a miss even when the status is correct.

    Resources: llmstxt.org · Fix skill

    partial
  2. C2

    Content for agents

    5 / 8 checks pass

    /llms.txt present with a summary and link index SHOULD MISSING

    Goal: Serve /llms.txt with a title, summary, and categorized link index.

    Result: Not found (https://paulstamatiou.com/llms.txt -> 404 (status 404 not in [200]))

    Fix: Serve `/llms.txt` (llmstxt.org): an H1 title, a one-line summary blockquote, and a categorized index of links to your most important pages as markdown. It is the canonical entry point an agent fetches to understand what a site offers and where to look next.

    Resources: llmstxt.org · Fix skill

    /llms-full.txt present (single-fetch full corpus) MAY N/A

    Goal: Serve the whole docs corpus as markdown at /llms-full.txt for one-fetch ingestion.

    Result: Not applicable (not a docs/content site)

    Resources: llmstxt.org · Fix skill

    Accept text/markdown content negotiation returns markdown SHOULD PASS

    Goal: Honor Accept text/markdown on content URLs with raw markdown, not HTML chrome.

    Result: Verified (https://paulstamatiou.com/ -> 200)

    Resources: RFC 7763 (text/markdown) · Fix skill

    llms.txt has H1, summary, and a link index SHOULD N/A

    Goal: Structure /llms.txt with an H1, a blockquote summary, and a markdown link index.

    Result: Not applicable (root llms.txt not present)

    Resources: llmstxt.org · Fix skill

    llms.txt links resolve SHOULD N/A

    Goal: Make every markdown href in /llms.txt https and fetchable.

    Result: Not applicable (root llms.txt not present)

    Resources: llmstxt.org · Fix skill

    llms.txt has a when-to-use or programmatic-access section SHOULD N/A

    Goal: Tell agents when to use the MCP or docs from a short llms.txt heading.

    Result: Not applicable (root llms.txt not present)

    Resources: llmstxt.org · Fix skill

    Per-section llms.txt files resolve under content subdirectories MAY N/A

    Goal: Serve a scoped llms.txt inside each major content section.

    Result: Not applicable (root llms.txt not present)

    Resources: llmstxt.org · Fix skill

    Per-section llms-full.txt files resolve under content subdirectories MAY N/A

    Goal: Serve a scoped llms-full.txt corpus inside each major content section.

    Result: Not applicable (root llms-full.txt not present)

    Resources: llmstxt.org · Fix skill

    AI user-fetch User-Agent receives the markdown twin MAY N/A

    Goal: Serve the markdown twin to AI on-demand user-fetchers that state no content-type preference.

    Result: Not implemented, optional (https://paulstamatiou.com/ -> 200 (content-type "text/html; charset=utf-8" !~ /markdown|text/plain/))

    Resources: RFC 7763 (text/markdown) · OpenAI bots and User-Agents · Fix skill

    Negotiated responses carry Vary Accept SHOULD MISSING

    Goal: Name every negotiated request header in Vary so shared caches never serve one client the wrong variant.

    Result: Not found (https://paulstamatiou.com/ -> 200 (header vary no match /(?:^|[\s,])(?:accept|\*)(?:[\s,]|$)/))

    Fix: When the same URL serves HTML or markdown depending on the request, emit a `Vary` header on every response that names each request header the choice depends on: `Vary: Accept` when you negotiate on `Accept` alone, and `Vary: Accept, User-Agent` when agent User-Agents also receive the markdown twin. Without it a shared cache (a CDN or a corporate proxy) can store the markdown twin under the bare URL and then hand it to a browser, or the reverse. If the CDN ignores or strips Vary (Cloudflare's zone cache historically keeps only `Accept-Encoding`), do not give that cache a long `s-maxage` on negotiated responses: HIT replies would then reach clients with no Vary, and the check still fails.

    Resources: RFC 9110 (Vary) · Fix skill

    Markdown twin carries YAML frontmatter MAY PASS

    Goal: Prefix the markdown twin with a YAML frontmatter block so agents read page metadata without parsing the body.

    Result: Verified (https://paulstamatiou.com/ -> 200)

    Resources: YAML front matter (Jekyll) · RFC 7763 (text/markdown) · Fix skill

    Root HTML has a descriptive <meta name="description"> SHOULD PASS

    Goal: Add a meta description naming what the service does and its agent entry points.

    Result: Verified (https://paulstamatiou.com/ -> 200)

    Resources: MDN meta description · Fix skill

    Root HTML embeds Schema.org JSON-LD MAY N/A

    Goal: Embed Schema.org JSON-LD so agents get typed facts without inference.

    Result: Not implemented, optional (https://paulstamatiou.com/ -> 200 (body no match /application/ld\+json/))

    Resources: Schema.org · Fix skill

    Root HTML has an H1 and readable text without JavaScript SHOULD PASS

    Goal: Put an H1 and enough visible text in the raw root HTML that a non-JS agent can read the page.

    Result: Verified (https://paulstamatiou.com/ -> 200)

    Resources: llmstxt.org · Fix skill

    Root HTML uses semantic landmarks MAY PASS

    Goal: Use semantic landmarks so the HTML path is parseable structure, not div soup.

    Result: Verified (https://paulstamatiou.com/ -> 200)

    Resources: MDN content sectioning · Fix skill

    Root HTML has a <noscript> with machine entry points SHOULD MISSING

    Goal: Give non-JS agents a noscript block listing your machine entry points.

    Result: Not found (https://paulstamatiou.com/ -> 200 (body no match /<noscript/))

    Fix: Add a `<noscript>` block to your root HTML that links your machine entry points: `llms.txt`, your OpenAPI or MCP endpoint, and any `.well-known` cards. It hands a fetch-only crawler or a non-JS agent a concrete, in-body list of where the structured surfaces live, so it never has to run the client bundle or infer them from the visible page.

    Resources: MDN noscript · Fix skill

    Bare CLI User-Agent receives the markdown twin MAY N/A

    Goal: Serve the markdown twin to shell HTTP clients that state no content-type preference.

    Result: Not implemented, optional (https://paulstamatiou.com/ -> 200 (content-type "text/html; charset=utf-8" !~ /markdown|text/plain/))

    Resources: RFC 7763 (text/markdown) · RFC 9110 (User-Agent) · Fix skill

    Accept text/plain returns the markdown twin MAY N/A

    Goal: Treat Accept text/plain as a request for the raw markdown source.

    Result: Not implemented, optional (https://paulstamatiou.com/ -> 200 (content-type "text/html; charset=utf-8" !~ /markdown|text/plain/))

    Resources: RFC 7763 (text/markdown) · Fix skill

    partial
  3. C3

    Bot & crawl policy

    3 / 3 checks pass

    AI user-fetch User-Agent can reach the homepage SHOULD PASS

    Goal: Let on-demand user-fetchers GET / with Accept */* and receive 2xx, not a challenge page.

    Result: Verified (https://paulstamatiou.com/ -> 200)

    Resources: OpenAI user-fetchers · Fix skill

    robots.txt declares AI-crawler rules (RFC 9309) SHOULD PASS

    Goal: State your AI-crawler policy in robots.txt with explicit User-agent rules.

    Result: Verified (https://paulstamatiou.com/robots.txt -> 200)

    Resources: RFC 9309 · Fix skill

    robots.txt declares Content-Signal AI-usage preferences SHOULD PASS

    Goal: Declare Content-Signal AI-usage preferences in robots.txt.

    Result: Verified (https://paulstamatiou.com/robots.txt -> 200)

    Resources: contentsignals.org · Fix skill

    Web Bot Auth signature directory present (informational) MAY N/A

    Goal: Publish an HTTP Message Signatures directory if your site sends signed bot traffic.

    Result: Not implemented, optional (https://paulstamatiou.com/.well-known/http-message-signatures-directory -> 404 (status 404 not in [200]))

    Resources: Web Bot Auth draft · Fix skill

    /.well-known/security.txt present (RFC 9116) MAY N/A

    Goal: Publish security.txt with a Contact and Expires field.

    Result: Not implemented, optional (https://paulstamatiou.com/.well-known/security.txt -> 404 (status 404 not in [200]))

    Resources: RFC 9116 · Fix skill

    pass
  4. C4

    API

    2 / 4 checks pass

    An OpenAPI description is published MUST PASS

    Goal: Publish an OpenAPI description so non-MCP agents can call your HTTP API.

    Result: Verified (https://paulstamatiou.com/openapi.json -> 200)

    Resources: OpenAPI 3.1 · Fix skill

    /.well-known/api-catalog published (RFC 9727) MAY PASS

    Goal: Serve an RFC 9727 api-catalog linkset indexing your API descriptions.

    Result: Verified (https://paulstamatiou.com/.well-known/api-catalog -> 200)

    Resources: RFC 9727 · Fix skill

    API client errors return JSON, not HTML SHOULD BROKEN

    Goal: Return a JSON error body on client-error API responses so agents can parse the failure.

    Result: Present but broken (https://paulstamatiou.com/photostream/feed/anc-web-audit-no-such -> 404 (non-JSON error body))

    Fix: On a client-error API response (4xx), return `Content-Type: application/json` and a JSON object (for example `{ "error": { "code": "not_found", "message": "..." } }`), not an HTML error page. Agents cannot recover from a soft-HTML 404. The audit probes a documented OpenAPI 4xx GET when one exists, otherwise `GET /anc-web-audit-no-such-api`.

    Resources: RFC 9457 (problem+json) · Fix skill

    API responses advertise rate-limit headers SHOULD MISSING

    Goal: Advertise remaining quota on API responses so agents can back off instead of retrying blindly.

    Result: Not found (https://paulstamatiou.com/photostream/feed/anc-web-audit-no-such -> 404 (no rate-limit header))

    Fix: Send IETF RateLimit headers (`RateLimit-Limit`, `RateLimit-Remaining`, `RateLimit-Reset`) or the common `X-RateLimit-*` aliases on API responses. A 429 should also carry `Retry-After`. Without them an agent has no budget and will retry until it is locked out.

    Resources: IETF RateLimit header draft · Fix skill

    Referenced JSON Schemas resolve as application/schema+json MAY N/A

    Goal: Serve the JSON Schemas your API references so agents can validate payloads pre-flight.

    Result: Not implemented, optional (https://paulstamatiou.com/api/schema/input.json -> 404 (status 404 not in [200]))

    Resources: JSON Schema · Fix skill

    partial
  5. C5

    MCP

    19 / 19 checks pass

    Every MCP server

    4 / 4 pass

    transport, discovery, and card checks that apply whichever protocol the server speaks

    GET on the MCP endpoint answers fast (not a held-open hang) SHOULD PASS

    Goal: Answer GET with 405 or an SSE stream, never a document and never a held-open hang.

    Result: Verified (https://paulstamatiou.com/mcp -> 405)

    Resources: MCP transports · Fix skill

    CORS preflight (OPTIONS) succeeds with Access-Control-Allow-* headers SHOULD PASS

    Goal: Serve one consistent CORS posture on the MCP endpoint, full preflight support or none.

    Result: Verified (preflight 204 allow-origin *; post 200 allow-origin *)

    Resources: MDN CORS preflight · Fix skill

    POST response carries Access-Control-Allow-Origin SHOULD PASS

    Goal: Mirror the declared CORS posture on the actual MCP POST response.

    Result: Verified (preflight 204 allow-origin *; post 200 allow-origin *)

    Resources: MDN CORS · Fix skill

    An MCP server card is published SHOULD PASS

    Goal: Publish a SEP-2127 server card for your MCP server and list it in your AI catalog.

    Result: Verified (https://paulstamatiou.com/mcp/server-card -> 200)

    Resources: SEP-2127 · Server card discovery · AI catalog · Fix skill

    Legacy MCP card paths redirect to the canonical card MAY N/A

    Goal: Point every legacy MCP card path at the canonical card instead of serving its own copy.

    Result: Not implemented, optional (https://paulstamatiou.com/.well-known/mcp -> 404 (404 alias not published))

    Resources: SEP-1649 · Fix skill

    A human/agent usage doc for the server resolves MAY N/A

    Goal: Publish a one-fetch markdown usage doc for your MCP server.

    Result: Not implemented, optional (https://paulstamatiou.com/mcp-skill.md -> 404 (status 404 not in [200]))

    Resources: anc.dev example · Fix skill

    a 401 names the RFC 9728 metadata in its WWW-Authenticate challenge MAY N/A

    Goal: Name your protected-resource metadata in the WWW-Authenticate challenge of every 401.

    Result: Not applicable (MCP endpoint does not require sign-in)

    Resources: MCP authorization · RFC 9728 section 5.1 · Fix skill

    protected-resource metadata lists public https authorization_servers MAY N/A

    Goal: List the authorization servers that issue tokens for your MCP server in its RFC 9728 metadata.

    Result: Not applicable (MCP endpoint does not require sign-in)

    Resources: RFC 9728 section 2 · MCP authorization · Fix skill

    a tools/list without an access token is refused with 401 MAY N/A

    Goal: Refuse every MCP request that carries no access token with 401.

    Result: Not applicable (MCP endpoint does not require sign-in)

    Resources: MCP authorization · Fix skill

    Legacy lane · 2025-06-18

    9 / 9 pass

    initialize, then a session

    initialize handshake returns serverInfo + protocolVersion MUST PASS

    Goal: Answer JSON-RPC initialize with serverInfo and protocolVersion so clients can begin a session.

    Result: Verified (serverInfo paulstamatiou.com, protocol 2025-06-18)

    Resources: MCP lifecycle · Fix skill

    initialize advertises capabilities (tools / resources / prompts) SHOULD PASS

    Goal: Advertise the capability groups your MCP server implements in the initialize result.

    Result: Verified (serverInfo paulstamatiou.com, protocol 2025-06-18)

    Resources: MCP lifecycle · Fix skill

    tools/list returns a tools array with input schemas MUST PASS

    Goal: Return tools/list entries with name, description, and a JSON inputSchema.

    Result: Verified (10 tools, 10 with input schema)

    Resources: MCP tools · Fix skill

    resources/list returns at least one resource when advertised SHOULD N/A

    Goal: Honor capabilities.resources with a non-empty resources/list result.

    Result: Not applicable (neither initialize nor server/discover advertises capabilities.resources)

    Resources: MCP resources · Fix skill

    unknown JSON-RPC method returns -32601 SHOULD PASS

    Goal: Reject unknown JSON-RPC methods with error -32601 instead of a hang or 500.

    Result: Verified (error code -32601)

    Resources: JSON-RPC 2.0 · Fix skill

    a non-JSON body draws -32700 (or a typed HTTP 400/415 refusal) SHOULD PASS

    Goal: Refuse an unparseable request body with a parse-error envelope or a typed HTTP refusal.

    Result: Verified (error code -32700)

    Resources: JSON-RPC 2.0 · Fix skill

    a batch carrying a modern-envelope request is rejected -32600 SHOULD PASS

    Goal: Refuse JSON array batches that carry modern-era envelopes with -32600.

    Result: Verified (error code -32600)

    Resources: JSON-RPC 2.0 · MCP transports (2026-07-28) · Fix skill

    tools/call with an unknown tool name returns -32602 SHOULD PASS

    Goal: Reject an unknown tool name with -32602 instead of a hang, a 500, or a fake result.

    Result: Verified (error code -32602)

    Resources: MCP tools · JSON-RPC 2.0 · Fix skill

    a JSON-only Accept is answered without SSE framing SHOULD PASS

    Goal: Serve a single application/json response to a client whose Accept names only application/json.

    Result: Verified (https://paulstamatiou.com/mcp -> 406)

    Resources: MCP transports · RFC 9110 section 12.5.1 (Accept) · Fix skill

    an unsatisfiable Accept draws a 406 rather than an unasked-for type SHOULD PASS

    Goal: Refuse an Accept you cannot satisfy with 406, never a 200 carrying a type the client did not request.

    Result: Verified (https://paulstamatiou.com/mcp -> 406)

    Resources: RFC 9110 section 15.5.7 (406 Not Acceptable) · MCP transports · Fix skill

    Modern lane · 2026-07-28

    6 / 6 pass

    header-routed and stateless; no initialize or session

    header-routed tools/list (2026-07-28) returns tools without initialize MUST PASS

    Goal: Answer a modern header-routed tools/list without requiring an initialize handshake.

    Result: Verified (10 tools, 10 with input schema)

    Resources: MCP lifecycle (2026-07-28) · MCP tools (2026-07-28) · Fix skill

    server/discover answers with server identity on the modern lane SHOULD PASS

    Goal: Answer server/discover with supported versions, capabilities, and server identity.

    Result: Verified (supports 2026-07-28, serverInfo paulstamatiou.com)

    Resources: MCP lifecycle (2026-07-28) · Fix skill

    an unknown method on the modern lane returns -32601 SHOULD PASS

    Goal: Reject unknown header-routed methods with -32601 on the 2026-07-28 lane.

    Result: Verified (error code -32601)

    Resources: JSON-RPC 2.0 · MCP lifecycle (2026-07-28) · Fix skill

    _meta missing clientCapabilities is rejected (-32602 or -32600) SHOULD PASS

    Goal: Enforce the mandatory clientCapabilities key on every modern request.

    Result: Verified (error code -32602)

    Resources: MCP lifecycle (2026-07-28) · Fix skill

    an Mcp-Method header disagreeing with the body method draws -32020 SHOULD PASS

    Goal: Validate the SEP-2243 header mirror between Mcp-Method and the body method.

    Result: Verified (error code -32020)

    Resources: MCP lifecycle (2026-07-28) · Fix skill

    an unsupported protocol version is rejected -32022 with data.supported SHOULD PASS

    Goal: Refuse unsupported protocol version claims with -32022 and advertise the served revisions.

    Result: Verified (error code -32022)

    Resources: MCP lifecycle (2026-07-28) · Fix skill

    modern resources/read with an unknown URI returns -32602 SHOULD N/A

    Goal: Answer an unknown resource URI with the typed miss code, not a hang or a fake result.

    Result: Not applicable (neither initialize nor server/discover advertises capabilities.resources)

    Resources: MCP resources (2026-07-28) · JSON-RPC 2.0 · Fix skill

    In-page tools · WebMCP

    browser tools exposed by the site's HTML, not by the MCP server

    Root HTML exposes WebMCP browser tools MAY N/A

    Goal: Expose page tools to browser agents via WebMCP.

    Result: Not implemented, optional (https://paulstamatiou.com/ -> 200 (no WebMCP markers in root HTML))

    Resources: WebMCP spec · Fix skill

    pass
  6. C6

    Agent discovery & auth

    2 / 2 checks pass

    OAuth/OIDC discovery metadata published MAY N/A

    Goal: Publish OAuth/OIDC discovery metadata if agents authenticate to your service.

    Result: Not applicable (no auth surface detected)

    Resources: RFC 8414 · Fix skill

    OAuth Protected Resource Metadata published (RFC 9728) MAY N/A

    Goal: Publish RFC 9728 protected-resource metadata for your authenticated MCP server.

    Result: Not applicable (MCP endpoint does not challenge for auth)

    Resources: RFC 9728 · Fix skill

    Agent auth/registration metadata doc published MAY N/A

    Goal: Publish an auth.md telling agents how to obtain credentials.

    Result: Not applicable (no auth surface detected)

    Resources: anc.dev example · Fix skill

    A2A Agent Card published for agent-to-agent discovery MAY N/A

    Goal: Publish an A2A Agent Card for agent-to-agent discovery.

    Result: Not implemented, optional (https://paulstamatiou.com/.well-known/agent-card.json -> 404 (status 404 not in [200]))

    Resources: A2A protocol · Fix skill

    /.well-known/ai-catalog.json published (ARD) MAY PASS

    Goal: Publish an Agentic Resource Discovery catalog so agents can enumerate your AI artifacts.

    Result: Verified (https://paulstamatiou.com/.well-known/ai-catalog.json -> 200)

    Resources: AI Catalog · Fix skill

    Agent-skills discovery index published MAY PASS

    Goal: Publish an agent-skills discovery index so agents can enumerate your skills.

    Result: Verified (https://paulstamatiou.com/.well-known/agent-skills/index.json -> 200)

    Resources: Agent Skills Discovery · Fix skill

    pass

Scored against registry c06f1efd281b.

This scorecard reflects the target's public agent-facing surface at audit time. Re-audit from the control above to refresh it, or call the audit_website MCP tool.