Can agents find your site and its capabilities?
The page registers no tools via the WebMCP browser API (navigator.modelContext).
Fix: Expose your actions to AI agents with the WebMCP browser API: register tools via navigator.modelContext.registerTool. Optionally also publish a /.well-known/webmcp.json tool catalog as a discovery signpost.
Crawled 12 of 12 discovered pages beyond the homepage.
Built on WordPress.
Can agents understand your content?
Homepage returned 404 for Accept: text/markdown.
Only 77/133 images have width+height — large CLS risk.
Fix: Set width and height on every <img> so the browser reserves space before the image loads. A layout that shifts while loading makes an AI agent mis-click the element it targeted.
Only 0 internal links on the homepage.
Fix: Add at least 5-10 internal links pointing to your top product, pricing, docs, blog and about pages so an AI agent can navigate to them from the homepage.
2 of 12 pages are missing <title> and/or <h1>: /partners/45685, /resources/5-ways-to-improve-e-commerce-kpis.
Fix: Make sure every page sets a unique <title> and exactly one <h1>. The title is how an AI agent confirms it landed on the right page after navigating.
Homepage server response contains 830 words of visible text — content is reachable without executing JavaScript.
Homepage contains ~1364 elements.
37 headings, no level skips.
Language declared as "en".
133 of 133 <img> tags have alt attributes.
All four landmark elements present (main, header, footer, nav).
Exactly one <h1> on the homepage.
All 12 pages return ≥80 words of visible text without JavaScript.
Can agents actually operate the page?
4 of 13 agent-critical accessibility audits failed (Buttons do not have an accessible name, `[aria-*]` attributes do not match their roles, Elements with an ARIA `[role]` that require children to contain a specific `[role]` are missing some or all of those required children., `[aria-hidden="true"]` elements contain focusable descendents) — an agent may be unable to identify or operate the affected elements.
Fix: Fix the failing agent-accessibility audits listed below (accessible names on controls, valid ARIA roles/relationships, nothing interactive hidden from the tree).
Lighthouse flagged this audit — agents may be unable to perceive or operate the affected elements.
Fix: Remove ARIA attributes that aren't allowed on the element's role.
Lighthouse flagged this audit — agents may be unable to perceive or operate the affected elements.
Fix: Don't place focusable/interactive elements inside aria-hidden="true" containers.
Lighthouse flagged this audit — agents may be unable to perceive or operate the affected elements.
Fix: Ensure ARIA roles that need specific children contain them (e.g. list → listitem).
Lighthouse flagged this audit — agents may be unable to perceive or operate the affected elements.
Fix: Give every <button> discernible text or an aria-label so agents can identify it.
The page registers no tools via the navigator.modelContext browser API, so an AI agent has no structured way to operate it.
Fix: Expose your site’s actions to AI agents with the WebMCP browser API: call navigator.modelContext.registerTool({ name, description, inputSchema, execute }) from your page so an agent can invoke them. Implement it directly, or with a library like the @mcp-b polyfill (https://mcp-b.ai). Spec: https://github.com/webmachinelearning/webmcp.
Lighthouse accessibility score: 80/100. Agents read the page through its accessibility tree, so this is a proxy for how navigable your site is to an AI agent.
Fix: Resolve the failing accessibility audits below — each one removes an element or relationship an agent would otherwise be blind to.
Uses ARIA roles only on compatible elements passed.
`[aria-hidden="true"]` is not present on the document `<body>` passed.
`[role]`s have all required `[aria-*]` attributes passed.
`[role]`s are contained by their required parent element passed.
`[role]` values are valid passed.
`[aria-*]` attributes are valid and not misspelled passed.
`[aria-*]` attributes have valid values passed.
Document has a `<title>` element passed.
Links have a discernible name passed.
0.000 (field data from CrUX) — good.
558ms (field data from CrUX) — good.
No tool catalog was found at /.well-known/webmcp.json (or /.well-known/webmcp). The catalog is a community convention, not part of the WebMCP standard, so this does not affect WebMCP presence.
Fix: Consider also publishing a tool catalog at /.well-known/webmcp.json: a JSON document with a "spec" of "webmcp/0.1" and a "tools" array, where each tool declares a name and a clear description. It is a community convention (optional, not part of the WebMCP standard) that lets crawlers and agents discover your tools without executing JavaScript.
Can agents safely transact?
No Strict-Transport-Security header on the homepage.
Fix: Add `Strict-Transport-Security: max-age=15768000; includeSubDomains` so browsers and agents refuse to downgrade to http for at least six months.
/.well-known/oauth-authorization-server returned 500.
Fix: Publish /.well-known/oauth-authorization-server so AI agents discovering your OAuth setup can negotiate flows automatically. Required if your site offers an authenticated API.
/.well-known/oauth-protected-resource returned 500.
Fix: Publish /.well-known/oauth-protected-resource so AI agents discovering your OAuth setup can negotiate flows automatically. Required if your site offers an authenticated API.
No Web Bot Auth signature headers — sites can't verify agent identity.
Fix: Web Bot Auth (IETF HTTP Message Signatures over Signature / Signature-Input) lets you cryptographically verify which agent is hitting you. Several CDNs offer turn-key support; otherwise skip until vendor support matures.
No Referrer-Policy header on the homepage.
Fix: Add `Referrer-Policy: strict-origin-when-cross-origin` so outbound links don't leak full URLs (including query strings) to third parties.
No `X-Content-Type-Options: nosniff` header.
Fix: Add `X-Content-Type-Options: nosniff` to prevent browsers (and some agents) from re-interpreting your responses as a different content type.
cf-ray: a1eb772c4e04665c-AMS (Cloudflare); Server: cloudflare
CSP header present.
Homepage scheme is https:.
http://brevo.com → https://www.brevo.com/ (1 hop).
No stack-trace markers in the first 5KB.
Homepage HTML references no http:// resources.
Valid for 87 more days (Oct 16 17:57:25 2026 GMT, issuer: YE2).
Server / X-Powered-By headers don't leak product version.
CSP frame-ancestors directive present.