Can agents find your site and its capabilities?
The page registers no tools via the WebMCP browser API (navigator.modelContext).
Fix: Expose your actions to AI agents with the WebMCP browser API: register tools via navigator.modelContext.registerTool. Optionally also publish a /.well-known/webmcp.json tool catalog as a discovery signpost.
Crawled 11 of 12 discovered pages beyond the homepage.
Could not identify a known website platform (custom stack or unrecognised).
Can agents understand your content?
Homepage ignored Accept: text/markdown and returned HTML.
Fix: Serve a markdown version of high-value pages when the client asks for text/markdown. AI summarisers, chatbots and IDE agents prefer markdown — fewer tokens, no DOM noise.
Homepage server response contains only 66 words of visible text. AI agents that don't execute JavaScript may see an empty page.
Fix: Consider pre-rendering or server-rendering the homepage so AI crawlers (which typically don't run JS) can see the content. Frameworks: Next.js (Server Components), Nuxt SSR, Astro, or Vite SSG.
Only 0/2 images have width+height — large CLS risk.
Fix: Set width and height on every <img> so the browser reserves space before the image loads. A layout that shifts while loading makes an AI agent mis-click the element it targeted.
Only 3 internal links on the homepage.
Fix: Add at least 5-10 internal links pointing to your top product, pricing, docs, blog and about pages so an AI agent can navigate to them from the homepage.
Missing landmark elements: header, footer, nav.
1 of 11 pages are missing <title> and/or <h1>: /legal.
Fix: Make sure every page sets a unique <title> and exactly one <h1>. The title is how an AI agent confirms it landed on the right page after navigating.
1 of 11 pages return <80 words of visible text — agents without JavaScript see an empty page: /legal (2w).
Fix: Pre-render or server-render these pages so AI crawlers (which usually don't execute JS) can read them. Frameworks: Next.js Server Components, Nuxt SSR, Astro, or build-time prerendering.
Homepage contains ~72 elements.
1 headings, no level skips.
Language declared as "en".
2 of 2 <img> tags have alt attributes.
Exactly one <h1> on the homepage.
Can agents actually operate the page?
Lighthouse flagged this audit — agents may be unable to perceive or operate the affected elements.
Fix: Add the ARIA attributes each role requires.
The page registers no tools via the navigator.modelContext browser API, so an AI agent has no structured way to operate it.
Fix: Expose your site’s actions to AI agents with the WebMCP browser API: call navigator.modelContext.registerTool({ name, description, inputSchema, execute }) from your page so an agent can invoke them. Implement it directly, or with a library like the @mcp-b polyfill (https://mcp-b.ai). Spec: https://github.com/webmachinelearning/webmcp.
1 of 11 agent-critical accessibility audits failed (`[role]`s do not have all required `[aria-*]` attributes) — an agent may be unable to identify or operate the affected elements.
Fix: Fix the failing agent-accessibility audits listed below (accessible names on controls, valid ARIA roles/relationships, nothing interactive hidden from the tree).
1.13s (field data from CrUX) — needs improvement.
Fix: Every request an AI agent makes pays this server latency, and agents make many requests per task. Reduce TTFB with edge caching, a CDN, and shipping less server-side work per request.
`[aria-*]` attributes match their roles passed.
`button`, `link`, and `menuitem` elements have accessible names passed.
`[aria-hidden="true"]` is not present on the document `<body>` passed.
`[aria-hidden="true"]` elements do not contain focusable descendents passed.
`[role]` values are valid passed.
`[aria-*]` attributes are valid and not misspelled passed.
`[aria-*]` attributes have valid values passed.
Buttons have an accessible name passed.
Document has a `<title>` element passed.
Links have a discernible name passed.
Lighthouse accessibility score: 92/100. Agents read the page through its accessibility tree, so this is a proxy for how navigable your site is to an AI agent.
0.000 (field data from CrUX) — good.
No tool catalog was found at /.well-known/webmcp.json (or /.well-known/webmcp). The catalog is a community convention, not part of the WebMCP standard, so this does not affect WebMCP presence.
Fix: Consider also publishing a tool catalog at /.well-known/webmcp.json: a JSON document with a "spec" of "webmcp/0.1" and a "tools" array, where each tool declares a name and a clear description. It is a community convention (optional, not part of the WebMCP standard) that lets crawlers and agents discover your tools without executing JavaScript.
Can agents safely transact?
No Strict-Transport-Security header on the homepage.
Fix: Add `Strict-Transport-Security: max-age=15768000; includeSubDomains` so browsers and agents refuse to downgrade to http for at least six months.
/.well-known/oauth-authorization-server returned 404.
Fix: Publish /.well-known/oauth-authorization-server so AI agents discovering your OAuth setup can negotiate flows automatically. Required if your site offers an authenticated API.
/.well-known/oauth-protected-resource returned 404.
Fix: Publish /.well-known/oauth-protected-resource so AI agents discovering your OAuth setup can negotiate flows automatically. Required if your site offers an authenticated API.
No Web Bot Auth signature headers — sites can't verify agent identity.
Fix: Web Bot Auth (IETF HTTP Message Signatures over Signature / Signature-Input) lets you cryptographically verify which agent is hitting you. Several CDNs offer turn-key support; otherwise skip until vendor support matures.
No Content-Security-Policy header on the homepage.
Fix: Add a Content-Security-Policy. Even a strict default-src directive cuts XSS blast radius dramatically. Start in report-only mode to find violations.
http://yandex.com redirects to http://yandex.com/showcaptcha?cc=1&form-fb-hint=2.46&mt=7A775040EEEAF0441B45D250410EEA5900A6ACEDCF200FAFF753927AE2466938325BBF96DC99A9423BC7A96AAA0723AAEBBBF1F7FDF58D4123540127F8AB2748083D2919B92790956728F24A3933C00DF93C814006C1856B5217C390CAB536B745E350E94CFD2C19269AC4EF5EBDB5CB087E580A97BB50241BCC5B4E95ABD81E369A0C4E691834727310CD00137B2C271911F5323F9D8FFD33B99071CF0CA34290889152C01F2BF3D3D817E70605252E2D7DD37ACE516B5E0D25D1AE57CBDD3BB51EADEBD4DB72A09C1369ABB03751F1EEE8D4E047D67E7C5B67EC7CD5CDE556965335B551631052F40C75A7153D39F9BFCDC3&retpath=aHR0cDovL3lhbmRleC5jb20v_f7566d2cc786c3fd1ee946413958335a&t=2%252F1784642404%252F4174118d02acdc5dda61919dbfdf1a27&u=9084859952050140856&s=76f4d95784b4c5aeeba787e440d0db3b — never reaching https.
Fix: Redirect every http:// request to the https:// equivalent of the same URL.
No Referrer-Policy header on the homepage.
Fix: Add `Referrer-Policy: strict-origin-when-cross-origin` so outbound links don't leak full URLs (including query strings) to third parties.
No X-Frame-Options header and no CSP frame-ancestors directive.
Fix: Add `X-Frame-Options: SAMEORIGIN` (or a CSP frame-ancestors directive) to prevent your site being framed by a phishing host.
Homepage scheme is https:.
No stack-trace markers in the first 5KB.
Homepage HTML references no http:// resources.
Valid for 161 more days (Dec 29 20:59:59 2026 GMT, issuer: GlobalSign ECC OV SSL CA 2018).
Server / X-Powered-By headers don't leak product version.
X-Content-Type-Options: nosniff.