Can agents find your site and its capabilities?
The page registers no tools via the WebMCP browser API (navigator.modelContext).
Fix: Expose your actions to AI agents with the WebMCP browser API: register tools via navigator.modelContext.registerTool. Optionally also publish a /.well-known/webmcp.json tool catalog as a discovery signpost.
Crawled 12 of 12 discovered pages beyond the homepage.
Built on Drupal.
Can agents understand your content?
Homepage ignored Accept: text/markdown and returned HTML.
Fix: Serve a markdown version of high-value pages when the client asks for text/markdown. AI summarisers, chatbots and IDE agents prefer markdown — fewer tokens, no DOM noise.
6/7 images have explicit width+height.
Fix: Add width and height to every <img>. Without them the browser doesn't know the aspect ratio and reflows the page on load (CLS).
Missing landmark elements: header.
12 of 12 pages are missing <title> and/or <h1>: /publications/02118-part-b-outpatient-services.pdf, /publications/02118-s-part-b-outpatient-services.pdf, /publications/02154-medicare-hospice-benefits.pdf, /publications/02173-getting-a-second-opinion-before-surgery.pdf, /publications/02173-s-getting-a-second-opinion-before-surgery.pdf, /publications/02174-your-guide-to-choosing-a-nursing-home, /publications/02179-how-medicare-works-with-other-insurance.pdf, /publications/02179-s-how-medicare-works-with-other-insurance508.pdf, /publications/02174-s-your-guide-to-choosing-a-nursing-home.pdf, /publications/10050-le-medicare-and-you.pdf, /publications/10111-protecting-yourself-from-fraud.pdf, /publications/10110-s-your-guide-to-preventive-services.pdf.
Fix: Make sure every page sets a unique <title> and exactly one <h1>. The title is how an AI agent confirms it landed on the right page after navigating.
Homepage server response contains 403 words of visible text — content is reachable without executing JavaScript.
Detected 1 cookie-banner element but none look agent-hostile (small, dismissible, or offer a reject option).
Homepage contains ~413 elements.
14 headings, no level skips.
Language declared as "en".
7 of 7 <img> tags have alt attributes.
22 internal links found.
Exactly one <h1> on the homepage.
All 12 pages return ≥80 words of visible text without JavaScript.
Can agents actually operate the page?
Lighthouse flagged this audit — agents may be unable to perceive or operate the affected elements.
Fix: Add a title to every <iframe> so agents can identify embedded content.
The page registers no tools via the navigator.modelContext browser API, so an AI agent has no structured way to operate it.
Fix: Expose your site’s actions to AI agents with the WebMCP browser API: call navigator.modelContext.registerTool({ name, description, inputSchema, execute }) from your page so an agent can invoke them. Implement it directly, or with a library like the @mcp-b polyfill (https://mcp-b.ai). Spec: https://github.com/webmachinelearning/webmcp.
1 of 15 agent-critical accessibility audits failed (`<frame>` or `<iframe>` elements do not have a title) — an agent may be unable to identify or operate the affected elements.
Fix: Fix the failing agent-accessibility audits listed below (accessible names on controls, valid ARIA roles/relationships, nothing interactive hidden from the tree).
No autocomplete attributes on any data-collecting form field.
Fix: Add autocomplete hints (email, tel, name, etc.) so form-filling agents and browsers can populate fields without guessing.
0/1 data-collecting forms expose errors via ARIA attributes.
Fix: Wire inputs to their error containers with `aria-describedby` and toggle `aria-invalid` on validation failure. Agents that can't see styled error text rely on these attributes.
`[aria-*]` attributes match their roles passed.
`button`, `link`, and `menuitem` elements have accessible names passed.
`[aria-hidden="true"]` is not present on the document `<body>` passed.
`[aria-hidden="true"]` elements do not contain focusable descendents passed.
`[role]`s have all required `[aria-*]` attributes passed.
Elements with an ARIA `[role]` that require children to contain a specific `[role]` have all required children. passed.
`[role]`s are contained by their required parent element passed.
`[role]` values are valid passed.
`[aria-*]` attributes are valid and not misspelled passed.
`[aria-*]` attributes have valid values passed.
Buttons have an accessible name passed.
Document has a `<title>` element passed.
Input buttons have discernible text. passed.
Links have a discernible name passed.
Lighthouse accessibility score: 97/100. Agents read the page through its accessibility tree, so this is a proxy for how navigable your site is to an AI agent.
3 of 3 visible interactive form fields have labels.
1/1 data-collecting forms mark required fields.
All 1 data-collecting forms include pattern/min/max constraints.
0.060 (field data from CrUX) — good.
429ms (field data from CrUX) — good.
No tool catalog was found at /.well-known/webmcp.json (or /.well-known/webmcp). The catalog is a community convention, not part of the WebMCP standard, so this does not affect WebMCP presence.
Fix: Consider also publishing a tool catalog at /.well-known/webmcp.json: a JSON document with a "spec" of "webmcp/0.1" and a "tools" array, where each tool declares a name and a clear description. It is a community convention (optional, not part of the WebMCP standard) that lets crawlers and agents discover your tools without executing JavaScript.
Can agents safely transact?
Found 1 http:// reference in the homepage HTML — browsers will block these resources.
Fix: Update every http:// resource URL to https:// (or use protocol-relative `//`). Common offenders: image CDNs and legacy embed snippets.
/.well-known/oauth-authorization-server returned 404.
Fix: Publish /.well-known/oauth-authorization-server so AI agents discovering your OAuth setup can negotiate flows automatically. Required if your site offers an authenticated API.
/.well-known/oauth-protected-resource returned 404.
Fix: Publish /.well-known/oauth-protected-resource so AI agents discovering your OAuth setup can negotiate flows automatically. Required if your site offers an authenticated API.
No Web Bot Auth signature headers — sites can't verify agent identity.
Fix: Web Bot Auth (IETF HTTP Message Signatures over Signature / Signature-Input) lets you cryptographically verify which agent is hitting you. Several CDNs offer turn-key support; otherwise skip until vendor support matures.
No Content-Security-Policy header on the homepage.
Fix: Add a Content-Security-Policy. Even a strict default-src directive cuts XSS blast radius dramatically. Start in report-only mode to find violations.
No Referrer-Policy header on the homepage.
Fix: Add `Referrer-Policy: strict-origin-when-cross-origin` so outbound links don't leak full URLs (including query strings) to third parties.
x-akamai-transformed: l 98675 0 - (Akamai)
max-age=31536000, includeSubDomains=true, preload=true.
Homepage scheme is https:.
http://medicare.gov → https://www.medicare.gov/ (2 hops).
No stack-trace markers in the first 5KB.
Valid for 119 more days (Nov 17 23:59:59 2026 GMT, issuer: GeoTrust TLS RSA CA G1).
Server / X-Powered-By headers don't leak product version.
X-Content-Type-Options: nosniff.
X-Frame-Options: SAMEORIGIN.