No useful agent discovery Link headers were found.

Link headers let automated clients discover API catalogs, documentation, and machine-readable alternates without parsing page markup first.

Content-Type "text/html; charset=utf-8" is not valid for an RFC 9727 API catalog.

API catalogs help agents find API endpoints, service descriptions, documentation, status resources, auth metadata, and related machine-readable contracts without guessing entry points.

auth.md response did not match Auth.md v1 agent registration guidance. Content-Type "text/html; charset=utf-8" is not Markdown or text/plain; missing registration instructions; missing OAuth Protected Resource Metadata discovery guidance; missing OAuth authorization-server metadata guidance; missing Auth.md credential type guidance; missing agent_verified/user_claimed or claim ceremony guidance.

Human login and signup flows are often opaque to agents. Auth.md gives automated clients a stable registration contract instead of forcing them to scrape docs, automate browser forms, or guess credential flows.

MCP Server Card response is not valid JSON.

MCP server cards give agents a stable, public pre-connection discovery surface for server identity, remote transports, protocol compatibility, and safe routing without guessing endpoints.

Discovered WebMCP static metadata was fetchable but invalid.

WebMCP gives agents structured page and browser tool hints so they can understand actions without relying only on screen scraping.

OpenAPI candidate was not parseable as JSON or YAML-like OpenAPI.

OpenAPI documents let agents understand operations, schemas, authentication, servers, and request/response formats before calling an API.

UCP profile content type "text/html; charset=utf-8" is not JSON-compatible.

UCP discovery lets agents identify commerce capabilities, service transports, payment handlers, and signing keys without scraping human checkout flows.

ACP discovery content type "text/html; charset=utf-8" is not JSON-compatible.

ACP discovery lets agents find the seller's ACP API base URL, supported versions, transports, and stable services before attempting authenticated checkout-session negotiation.

No Organization or Organization subtype was found in Schema.org structured data. No WebSite entity was found in Schema.org structured data. Missing identity field(s): Organization.name, Organization.url, WebSite.name, WebSite.url. WebSite.publisher is missing. Organization schema is missing logo and sameAs or public contact evidence.

Organization and WebSite schema help agents identify the publisher, canonical site identity, logo, and related profiles for attribution.

No JSON-LD, Microdata, or RDFa structured data was found.

Structured data gives agents explicit entities, relationships, and page meaning that are harder to infer reliably from visual layout alone.

Response is not valid JSON.

TDMRep is a W3C Community Group protocol and IANA-registered well-known URI for declaring text and data mining reservation policy on applicable content.

agents.json response is not valid JSON.

Wildcard agents.json gives agents workflow-level context beyond plain OpenAPI, including flows, links, examples, and API action structure. It is an emerging OpenAPI-adjacent proposal, so scanners should validate the contract shape without treating it as an A2A or IETF standard.

Best candidate returned Content-Type "text/html; charset=utf-8" instead of text/markdown.

Markdown representations give agents a cleaner page form while preserving normal HTML for browsers and cache-safe representation handling.

Response is not valid JSON.

Protected-resource metadata tells agents which API/resource is locked, which authorization servers can issue tokens for it, and how a 401 challenge maps back to the correct resource.

x402 candidate routes were found, but none returned HTTP 402 before payment.

x402 lets agents discover paid HTTP resources through ordinary 402 responses, understand accepted schemes and networks, and retry with a signed payment payload without scraping checkout flows.

Response is not valid JSON.

OAuth and OIDC discovery let agents and API clients find authorization, token, and key endpoints programmatically instead of scraping login pages or guessing provider setup.

The discovered JSON document does not match a supported A2A Agent Card version family.

A2A Agent Cards provide protocol-specific discovery for agent identity, skills, input and output modes, transport bindings, capabilities, and security requirements. Legacy A2A also used /.well-known/agent.json, so scanners must classify the card shape before reporting readiness.

No DNS-AID HTTPS/SVCB records were found under _agents.

DNS-AID lets agents discover index, A2A, and other agent entrypoints before fetching HTTP metadata. HTTPS/SVCB records provide the service-binding substrate, while DNSSEC can authenticate the discovery answer when available.

Applicable HTML response is missing an enforcing Content-Security-Policy header.

Content Security Policy reduces the impact of injection bugs by limiting where scripts, styles, frames, forms, and other browser resources can load or execute.

Referrer-Policy header is missing.

Referrer-Policy controls how much URL context is sent to other origins, limiting accidental leakage of paths, queries, and identifiers.

No explicit User-agent rules were found for major AI crawler tokens.

AI crawler product tokens have different meanings. Explicit robots.txt groups make training, search, and retrieval access policy auditable for compliant crawler operators.

Agent Skills index was not served with a JSON-compatible Content-Type.

An Agent Skills index lets agents discover task-specific instructions through a small trusted index, then verify and load only the skill artifacts they need.

ai.txt appears to be an HTML page or error document rather than a plain-text policy.

ai.txt is a fragmented emerging convention. It can communicate human-readable AI crawling, training, attribution, restriction, and contact guidance, but it is not a standard access-control mechanism and absence should not be penalized.

Content-Type "text/html; charset=utf-8" is not valid for a Web Bot Auth signing key directory.

Web Bot Auth lets bot and agent operators publish HTTP Message Signatures keys so receiving websites can verify signed automated requests without relying only on user-agent strings, IP lists, or reverse DNS.

llms.txt did not provide the minimum expected Markdown discovery shape.

llms.txt is an emerging Markdown convention for giving language-model clients curated context and links before they crawl broadly. Broken, private, or low-signal links make the file much less useful even when it exists.

No Content-Usage or Content-Signal declarations were found.

Content usage preference signals communicate intended downstream AI use separately from robots.txt crawl permission. They can express training and search preferences for compliant systems without replacing access-control rules.

No RSL declarations were found.

Really Simple Licensing is an emerging rights-expression layer for communicating content usage and licensing terms separately from robots.txt crawl permission.

Semantic HTML is incomplete: invalid h1 structure (visible h1 count 0); 1 links missing accessible names; 1 controls missing accessible names.

Semantic HTML gives browsers, assistive technology, search systems, and agents reliable landmarks, headings, controls, form semantics, and image context.

No named author or publisher identity could be extracted.

Author attribution helps agents cite content responsibly, assess source credibility, and distinguish editorial pages from anonymous marketing copy.

14 section(s) bury or omit a concise opening answer.

Answer engines need visible answer passages, clear question and heading structure, entity definitions, evidence, and trust signals. These signals improve extraction and attribution, but they do not guarantee answer-engine citations or search features.

Missing answer evidence or trust signals: author, publisher, freshnessDate, sameAs.

Answer engines need visible answer passages, clear question and heading structure, entity definitions, evidence, and trust signals. These signals improve extraction and attribution, but they do not guarantee answer-engine citations or search features.

No evidence-backed, citation-length explanatory paragraph was found.

Generative answer systems work best with visible, self-contained, evidence-backed content, clear entities, trustworthy attribution, structured page sections, and crawler-accessible HTML. These signals improve machine understanding even though they do not guarantee AI citations.

Missing AIO trust signals: author, publisher, freshnessDate.

Google AI Overviews and AI Mode depend on normal Google Search eligibility, snippet permissions, useful visible content, consistent structured data, trust signals, and page experience basics. These signals help Google understand and preview a page, but they do not guarantee selection.

Missing source or trust signals: authorOrOwner, freshnessDate, entityLinks.

Generative answer systems work best with visible, self-contained, evidence-backed content, clear entities, trustworthy attribution, structured page sections, and crawler-accessible HTML. These signals improve machine understanding even though they do not guarantee AI citations.

Frame protection relies only on X-Frame-Options; CSP frame-ancestors is the modern control.

Frame protection blocks hostile sites from embedding pages in deceptive frames, reducing clickjacking and UI redressing risk.

Heading structure issues were detected.

Answer engines need visible answer passages, clear question and heading structure, entity definitions, evidence, and trust signals. These signals improve extraction and attribution, but they do not guarantee answer-engine citations or search features.

Missing or weak extraction signals: clean heading hierarchy, summary or key takeaways, typed JSON-LD structured data.

Generative answer systems work best with visible, self-contained, evidence-backed content, clear entities, trustworthy attribution, structured page sections, and crawler-accessible HTML. These signals improve machine understanding even though they do not guarantee AI citations.

25 image(s) are missing width/height attributes.

Google AI Overviews and AI Mode depend on normal Google Search eligibility, snippet permissions, useful visible content, consistent structured data, trust signals, and page experience basics. These signals help Google understand and preview a page, but they do not guarantee selection.

Title/H1 terms missing from description: permit, permissions, era, permissionsfor, theai.

Generative answer systems work best with visible, self-contained, evidence-backed content, clear entities, trustworthy attribution, structured page sections, and crawler-accessible HTML. These signals improve machine understanding even though they do not guarantee AI citations.

One or more same-origin active resources observed by Chrome did not emit X-Content-Type-Options: nosniff.

X-Content-Type-Options tells browsers to trust declared media types instead of sniffing content, reducing the risk that mislabeled files execute as active content.

14 section(s) may benefit from clearer answer-first openings. Heading outline issues were detected.

Google AI Overviews and AI Mode depend on normal Google Search eligibility, snippet permissions, useful visible content, consistent structured data, trust signals, and page experience basics. These signals help Google understand and preview a page, but they do not guarantee selection.

HSTS is valid, but includeSubDomains is absent.

HSTS tells browsers to keep using HTTPS after the first secure visit, reducing downgrade, SSL-stripping, and mixed-transport risk for repeat users.