Can agents find your site and its capabilities?
The page registers no tools via the WebMCP browser API (navigator.modelContext).
Fix: Expose your actions to AI agents with the WebMCP browser API: register tools via navigator.modelContext.registerTool. Optionally also publish a /.well-known/webmcp.json tool catalog as a discovery signpost.
Crawled 11 of 12 discovered pages beyond the homepage.
Could not identify a known website platform (custom stack or unrecognised).
Can agents understand your content?
Homepage returned 403 — couldn't analyse structure.
Homepage returned 403 for Accept: text/markdown.
Homepage returned 403.
11 of 11 pages are missing <title> and/or <h1>: /contact, /pricing, /plans, /about, /about-us, /services, /products, /blog, /news, /faq, /help.
Fix: Make sure every page sets a unique <title> and exactly one <h1>. The title is how an AI agent confirms it landed on the right page after navigating.
All 11 pages return ≥80 words of visible text without JavaScript.
Can agents actually operate the page?
3 of 13 agent-critical accessibility audits failed (Links do not have a discernible name, Elements with an ARIA `[role]` that require children to contain a specific `[role]` are missing some or all of those required children., `[role]`s are not contained by their required parent element) — an agent may be unable to identify or operate the affected elements.
Fix: Fix the failing agent-accessibility audits listed below (accessible names on controls, valid ARIA roles/relationships, nothing interactive hidden from the tree).
Lighthouse flagged this audit — agents may be unable to perceive or operate the affected elements.
Fix: Ensure ARIA roles that need specific children contain them (e.g. list → listitem).
Lighthouse flagged this audit — agents may be unable to perceive or operate the affected elements.
Fix: Ensure ARIA child roles are nested inside their required parent role.
Lighthouse flagged this audit — agents may be unable to perceive or operate the affected elements.
Fix: Give every link discernible text (avoid bare icons / "click here") so agents know where it goes.
The page registers no tools via the navigator.modelContext browser API, so an AI agent has no structured way to operate it.
Fix: Expose your site’s actions to AI agents with the WebMCP browser API: call navigator.modelContext.registerTool({ name, description, inputSchema, execute }) from your page so an agent can invoke them. Implement it directly, or with a library like the @mcp-b polyfill (https://mcp-b.ai). Spec: https://github.com/webmachinelearning/webmcp.
Lighthouse accessibility score: 85/100. Agents read the page through its accessibility tree, so this is a proxy for how navigable your site is to an AI agent.
Fix: Resolve the failing accessibility audits below — each one removes an element or relationship an agent would otherwise be blind to.
0.160 (field data from CrUX) — needs improvement.
Fix: A layout that shifts while loading makes an AI agent mis-click the element it targeted. Eliminate CLS by setting explicit width/height on images and embeds, avoiding inserted content above existing content, and reserving space for ad slots.
`[aria-*]` attributes match their roles passed.
`[aria-hidden="true"]` is not present on the document `<body>` passed.
`[aria-hidden="true"]` elements do not contain focusable descendents passed.
`[role]`s have all required `[aria-*]` attributes passed.
`[role]` values are valid passed.
ARIA toggle fields have accessible names passed.
`[aria-*]` attributes are valid and not misspelled passed.
`[aria-*]` attributes have valid values passed.
Buttons have an accessible name passed.
Document has a `<title>` element passed.
240ms (field data from CrUX) — good.
No tool catalog was found at /.well-known/webmcp.json (or /.well-known/webmcp). The catalog is a community convention, not part of the WebMCP standard, so this does not affect WebMCP presence.
Fix: Consider also publishing a tool catalog at /.well-known/webmcp.json: a JSON document with a "spec" of "webmcp/0.1" and a "tools" array, where each tool declares a name and a clear description. It is a community convention (optional, not part of the WebMCP standard) that lets crawlers and agents discover your tools without executing JavaScript.
Can agents safely transact?
/.well-known/oauth-authorization-server returned the site's HTML app shell — treating as not published.
Fix: Publish /.well-known/oauth-authorization-server so AI agents discovering your OAuth setup can negotiate flows automatically. Required if your site offers an authenticated API.
/.well-known/oauth-protected-resource returned the site's HTML app shell — treating as not published.
Fix: Publish /.well-known/oauth-protected-resource so AI agents discovering your OAuth setup can negotiate flows automatically. Required if your site offers an authenticated API.
Homepage returned 403.
No Content-Security-Policy header on the homepage.
Fix: Add a Content-Security-Policy. Even a strict default-src directive cuts XSS blast radius dramatically. Start in report-only mode to find violations.
HSTS configured (max-age=31536000) but missing includeSubDomains.
Fix: Add `includeSubDomains` so subdomains inherit the policy.
Homepage returned 403 — couldn't scan for error markers.
Homepage returned 403 — couldn't scan for mixed content.
cf-ray: a1eb5890ed556696-AMS (Cloudflare); Server: cloudflare
Homepage scheme is https:.
http://mediamarkt.de → https://www.mediamarkt.de/ (1 hop).
Referrer-Policy: same-origin.
Valid for 216 more days (Feb 22 23:59:59 2027 GMT, issuer: GeoTrust TLS RSA CA G1).
Server / X-Powered-By headers don't leak product version.
X-Content-Type-Options: nosniff.
X-Frame-Options: SAMEORIGIN.