Agentic audit #3
chroxifyAnnotations
5 errors and 8 warnings
|
audit
Process completed with exit code 1.
|
|
OAuth 2.0 support
Implement OAuth 2.0 for API authentication. Publish your authorization server metadata at /.well-known/oauth-authorization-server.
|
|
Scoped permissions
Declare scoped API permissions where machines can read them: named OAuth scopes in your OpenAPI security schemes, or scopes_supported in RFC 9728 protected-resource metadata. Prose descriptions of roles help humans, but agents need the machine-readable declaration to request least-privilege access.
|
|
Content without JavaScript
Serve at least 500 characters of meaningful homepage content in raw HTML. Add a clear H1, keep deeper heading levels sequential, and remove excessive non-content markup.
|
|
Agent-friendly 404s
Return a real HTTP 404 (or 410) status for nonexistent paths - never a 200 with your app shell, which makes agents believe every path exists. For full credit, give the 404 response a short markdown body pointing agents at your sitemap, llms.txt, or docs index. Verify with `curl -s -o /dev/null -w "%{http_code}" https://yourdomain.com/some-path-that-does-not-exist` - it must print 404.
|
|
audit
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/setup-node@v4, actions/upload-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
Public API/docs linked from homepage
Publish API documentation at a discoverable URL (/docs, /api, /developers). Include authentication, endpoints, and example requests.
|
|
REST versioning / deprecation policy
Declare a versioning policy agents can rely on: version your API (in the URL path or a version header) and publish how you signal deprecation (a Sunset/Deprecation header or a documented timeline). Agents avoid integrating against a surface that can change without warning.
|
|
Organization schema completeness
Add Organization JSON-LD that includes both contactPoint (with email/phone and contactType) and address (PostalAddress). This lets AI verify your business legitimacy and answer contact queries.
|
|
Agent onboarding friction
Offer a free tier or trial, self-serve API key generation, and a sandbox environment. Agents can't fill out 'contact sales' forms.
|
|
Developer resource discoverability
Make your developer resources (API docs, OpenAPI spec, auth docs, developer portal, MCP server) discoverable by name. Publish them at predictable URLs, list them in llms.txt, and include your product name in page titles and headings so search engines surface them for name-based queries.
|
|
Rate limit response headers
Return standard rate-limit headers on your API responses (the RFC RateLimit headers, plus Retry-After on a 429) so agents can self-throttle in real time, and document the conventions alongside your API.
|
|
Brand name discoverability
Make sure a clean search for your brand name returns your own domain in the top results. If it does not, your brand may be too generic, conflict with a more established term, or not yet indexed. Strengthen brand-name search by claiming consistent NAP across listings, earning press mentions that link to the canonical domain, and avoiding redirect chains that mask the apex domain in search results.
|
Artifacts
Produced during runtime
| Name | Size | Digest | |
|---|---|---|---|
|
agentic-audit-34026761914
|
2.51 KB |
sha256:e1bf4079761d63b8f3f3bb7e2f92684c13dde3841154a7ea4adf63324756c2d1
|
|