Hugging Face
relative to the checks that apply to this site; global measures it against a maximally agent-ready site.
Discoverability
3 / 4/robots.txt present SHOULD PASS
Goal: Publish robots.txt and state your crawl policy explicitly.
Result: Verified (https://huggingface.co/robots.txt -> 200)
/sitemap.xml present MAY PASS
Goal: Publish sitemap.xml so agents can enumerate your content URLs.
Result: Verified (https://huggingface.co/sitemap.xml -> 200)
Resources: sitemaps.org · Fix skill
Homepage sends RFC 8288 Link headers pointing at agent resources SHOULD MISSING
Goal: Advertise machine surfaces in a Link response header on / for header-only discovery.
Result: Not found (https://huggingface.co/ -> 200 (header link no match /rel="?(service-desc|describedby|api-catalog|service-doc)"?/))
Fix: Send a `Link` response header on `/` (RFC 8288) whose `rel` points at your machine surfaces, so an agent reading only response headers finds them without parsing HTML or probing `/.well-known`. Use the RFC 8631 service trio and the RFC 9727 catalog: `rel="service-desc"` at a machine-readable description (OpenAPI, or an MCP server card), `rel="service-doc"` at the human-readable doc, `rel="service-meta"` at the service-context declaration, and `rel="api-catalog"` at your `/.well-known/api-catalog` index. Example: `Link: </.well-known/api-catalog>; rel="api-catalog", </.well-known/mcp/server-card.json>; rel="service-desc"`.
Resources: RFC 8288 (Link) · RFC 8631 (service links) · RFC 9727 (api-catalog) · Fix skill
Root HTML links to machine surfaces via <link rel> SHOULD PASS
Goal: Point link rel elements at your machine surfaces from the root HTML head.
Result: Verified (https://huggingface.co/ -> 200)
Resources: RFC 8631 (service-desc/doc) · Fix skill
DNS for AI Discovery (DNS-AID) records under _agents (IETF draft) MAY N/A
Goal: Publish DNSSEC-signed SVCB records under _agents for DNS-level agent discovery.
Result: Not implemented, optional (no DNS-AID records)
Resources: DNS-AID draft · Fix skill
Content for agents
3 / 5/llms.txt present with a summary and link index SHOULD MISSING
Goal: Serve /llms.txt with a title, summary, and categorized link index.
Result: Not found (https://huggingface.co/llms.txt -> 404 (status 404 not in [200]))
Fix: Serve `/llms.txt` (llmstxt.org): an H1 title, a one-line summary blockquote, and a categorized index of links to your most important pages as markdown. It is the canonical entry point an agent fetches to understand what a site offers and where to look next.
Resources: llmstxt.org · Fix skill
/llms-full.txt present (single-fetch full corpus) MAY N/A
Goal: Serve the whole docs corpus as markdown at /llms-full.txt for one-fetch ingestion.
Result: Not applicable (not a docs/content site)
Resources: llmstxt.org · Fix skill
Per-section llms.txt files resolve under content subdirectories MAY N/A
Goal: Serve a scoped llms.txt inside each major content section.
Result: Not applicable (root llms.txt not present)
Resources: llmstxt.org · Fix skill
Per-section llms-full.txt files resolve under content subdirectories MAY N/A
Goal: Serve a scoped llms-full.txt corpus inside each major content section.
Result: Not applicable (root llms-full.txt not present)
Resources: llmstxt.org · Fix skill
Root HTML has a descriptive <meta name="description"> SHOULD PASS
Goal: Add a meta description naming what the service does and its agent entry points.
Result: Verified (https://huggingface.co/ -> 200)
Resources: MDN meta description · Fix skill
Root HTML embeds Schema.org JSON-LD MAY N/A
Goal: Embed Schema.org JSON-LD so agents get typed facts without inference.
Result: Not implemented, optional (https://huggingface.co/ -> 200 (body no match /application/ld\+json/))
Resources: Schema.org · Fix skill
Root HTML uses semantic landmarks MAY PASS
Goal: Use semantic landmarks so the HTML path is parseable structure, not div soup.
Result: Verified (https://huggingface.co/ -> 200)
Resources: MDN content sectioning · Fix skill
Root HTML has a <noscript> with machine entry points SHOULD PASS
Goal: Give non-JS agents a noscript block listing your machine entry points.
Result: Verified (https://huggingface.co/ -> 200)
Resources: MDN noscript · Fix skill
Accept text/markdown content negotiation returns markdown SHOULD MISSING
Goal: Honor Accept text/markdown on content URLs with raw markdown, not HTML chrome.
Result: Not found (https://huggingface.co/ -> 200 (content-type "text/html; charset=utf-8" !~ /markdown|text/plain/))
Fix: Honor `Accept: text/markdown` on content URLs and return raw markdown rather than HTML chrome. Agents parse markdown far more reliably than a JS-rendered page. Serve the markdown twin at the same URL via content negotiation, invisibly to crawlers.
Resources: RFC 7763 (text/markdown) · Fix skill
Bot & crawl policy
2 / 4robots.txt declares AI-crawler rules (RFC 9309) SHOULD PASS
Goal: State your AI-crawler policy in robots.txt with explicit User-agent rules.
Result: Verified (https://huggingface.co/robots.txt -> 200)
robots.txt declares Content-Signal AI-usage preferences SHOULD BROKEN
Goal: Declare Content-Signal AI-usage preferences in robots.txt.
Result: Present but broken (https://huggingface.co/robots.txt -> 200 (body no match /^\s*Content-Signal:\s*(ai-train|search|ai-input)/))
Fix: Add `Content-Signal` directives to `robots.txt` (contentsignals.org): `ai-train`, `search`, and `ai-input` set to `yes` or `no`. They express usage preferences at a finer grain than a blanket allow/deny.
Resources: contentsignals.org · Fix skill
/.well-known/security.txt present (RFC 9116) MAY PASS
Goal: Publish security.txt with a Contact and Expires field.
Result: Verified (https://huggingface.co/.well-known/security.txt -> 200)
Web Bot Auth signature directory present (informational) MAY BROKEN
Goal: Publish an HTTP Message Signatures directory if your site sends signed bot traffic.
Result: Present but broken (https://huggingface.co/.well-known/http-message-signatures-directory -> 401 (status 401 not in [200]))
Fix: Informational only. If your site sends authenticated bot traffic, publish an HTTP Message Signatures JWKS directory at `/.well-known/http-message-signatures-directory` so recipients can verify your bot's signatures. Skip it if you do not send signed bot requests.
Resources: Web Bot Auth draft · Fix skill
API
1 / 2An OpenAPI description is published MUST PASS
Goal: Publish an OpenAPI description so non-MCP agents can call your HTTP API.
Result: Verified (https://huggingface.co/.well-known/openapi.json -> 200)
Resources: OpenAPI 3.1 · Fix skill
/.well-known/api-catalog published (RFC 9727) MAY BROKEN
Goal: Serve an RFC 9727 api-catalog linkset indexing your API descriptions.
Result: Present but broken (https://huggingface.co/.well-known/api-catalog -> 401 (status 401 not in [200]))
Fix: Serve `/.well-known/api-catalog` (RFC 9727) as `application/linkset+json` with a `linkset[]` of anchor plus `service-desc` entries. It is the standard index that points agents at every API description you publish.
Referenced JSON Schemas resolve as application/schema+json MAY N/A
Goal: Serve the JSON Schemas your API references so agents can validate payloads pre-flight.
Result: Not implemented, optional (https://huggingface.co/api/schema/input.json -> 404 (status 404 not in [200]))
Resources: JSON Schema · Fix skill
MCP
5 / 8initialize handshake returns serverInfo + protocolVersion MUST PASS
Goal: Answer JSON-RPC initialize with serverInfo and protocolVersion so clients can begin a session.
Result: Verified (serverInfo @huggingface/mcp-services, protocol 2025-06-18)
Resources: MCP lifecycle · Fix skill
initialize advertises capabilities (tools / resources / prompts) SHOULD PASS
Goal: Advertise the capability groups your MCP server implements in the initialize result.
Result: Verified (serverInfo @huggingface/mcp-services, protocol 2025-06-18)
Resources: MCP lifecycle · Fix skill
tools/list returns a tools array with input schemas MUST BROKEN
Goal: Return tools/list entries with name, description, and a JSON inputSchema.
Result: Present but broken (no tools array)
Fix: Return `result.tools` as an array from the `tools/list` method. Each tool needs a `name`, a `description`, and a JSON Schema `inputSchema` so an agent can validate arguments before calling. A tool without an `inputSchema` forces the agent to guess argument shapes.
unknown JSON-RPC method returns -32601 SHOULD BROKEN
Goal: Reject unknown JSON-RPC methods with error -32601 instead of a hang or 500.
Result: Present but broken (error code -32600)
Fix: Reject an unknown JSON-RPC method with the standard error code `-32601` (Method not found), not a hang, a 500, or a silent empty body. Agents rely on `-32601` to distinguish "unsupported" from "failed"; anything else looks like an outage.
Resources: JSON-RPC 2.0 · Fix skill
GET on the MCP endpoint answers fast (not a held-open hang) SHOULD PASS
Goal: Answer GET on the MCP endpoint fast (a fast-fail status or a documented surface), never a held-open hang.
Result: Verified (https://huggingface.co/mcp -> 405)
Resources: MCP transports · Fix skill
Root HTML exposes WebMCP browser tools MAY N/A
Goal: Expose page tools to browser agents via WebMCP.
Result: Not implemented, optional (https://huggingface.co/ -> 200 (no WebMCP markers in root HTML))
Resources: WebMCP spec · Fix skill
POST response carries Access-Control-Allow-Origin SHOULD PASS
Goal: Echo Access-Control-Allow-Origin on the actual MCP POST response.
Result: Verified (allow-origin https://example.com)
CORS preflight (OPTIONS) succeeds with Access-Control-Allow-* headers SHOULD PASS
Goal: Answer OPTIONS preflights on the MCP endpoint with Access-Control-Allow-* headers.
Result: Verified (200 allow-origin https://example.com)
Resources: MDN CORS preflight · Fix skill
A human/agent usage doc for the server resolves MAY N/A
Goal: Publish a one-fetch markdown usage doc for your MCP server.
Result: Not implemented, optional (https://huggingface.co/mcp-skill.md -> 404 (status 404 not in [200]))
Resources: anc.dev example · Fix skill
A .well-known MCP server card is published (SEP-1649) SHOULD MISSING
Goal: Publish an MCP server card at the canonical SEP-1649 path and 301 the legacy aliases to it.
Result: Not found (https://huggingface.co/.well-known/mcp/server-card.json -> 404 (status 404 not in [200]))
Fix: Publish an MCP server card at `/.well-known/mcp/server-card.json` (SEP-1649) naming the endpoint, transport, and capabilities: include `mcp_endpoint` (or `url`, or `transport.endpoint`), `serverInfo`, and the transport type. Serve the legacy pointer paths (`/.well-known/mcp`, `/.well-known/mcp.json`, `/mcp.json`) as `301` redirects to the canonical, never as duplicate inline copies.
Agent discovery & auth
1 / 3OAuth/OIDC discovery metadata published MAY PASS
Goal: Publish OAuth/OIDC discovery metadata if agents authenticate to your service.
Result: Verified (https://huggingface.co/.well-known/openid-configuration -> 200)
OAuth Protected Resource Metadata published (RFC 9728) MAY N/A
Goal: Publish RFC 9728 protected-resource metadata for your authenticated MCP server.
Result: Not applicable (MCP endpoint does not challenge for auth)
A2A Agent Card published for agent-to-agent discovery MAY BROKEN
Goal: Publish an A2A Agent Card for agent-to-agent discovery.
Result: Present but broken (https://huggingface.co/.well-known/agent-card.json -> 401 (status 401 not in [200]))
Fix: Serve an A2A Agent Card at `/.well-known/agent-card.json` (a2a-protocol.org) with `name`, `version`, and `supportedInterfaces`. It lets other agents discover and interoperate with yours over the agent-to-agent protocol.
Resources: A2A protocol · Fix skill
Agent-skills discovery index published MAY N/A
Goal: Publish an agent-skills discovery index so agents can enumerate your skills.
Result: Not implemented, optional (https://huggingface.co/.well-known/agent-skills/index.json -> 404 (status 404 not in [200]))
Resources: Agent Skills Discovery · Fix skill
Agent auth/registration metadata doc published MAY BROKEN
Goal: Publish an auth.md telling agents how to obtain credentials.
Result: Present but broken (https://huggingface.co/.well-known/auth.md -> 401)
Fix: Publish an `auth.md` at `/.well-known/auth.md` (or `/auth.md`): a short markdown guide that tells an agent how to obtain credentials, including where to register, which OAuth flows are supported, token endpoints, and scopes. It turns "figure out our auth" into a one-fetch orientation.
Resources: anc.dev example · Fix skill
This scorecard reflects the target's public agent-facing surface at audit time. Re-run the audit from anc.dev/web-audit to refresh it, or call the audit_website MCP tool.