# Hugging Face — Agent-Readiness Audit

Website: [https://huggingface.co/](https://huggingface.co/)

**Score:** 48% (relative to the checks that apply to this site)
**Global:** 38% of a maximally agent-ready site

## Discoverability (3/4)

### PASS — /robots.txt present

- Tier: SHOULD
- Goal: Publish robots.txt and state your crawl policy explicitly.
- Result: Verified (https://huggingface.co/robots.txt -> 200)
- Resources: [RFC 9309](https://www.rfc-editor.org/rfc/rfc9309), [Fix skill](https://www.anc.dev/web-audit/skill/robots)

### PASS — /sitemap.xml present

- Tier: MAY
- Goal: Publish sitemap.xml so agents can enumerate your content URLs.
- Result: Verified (https://huggingface.co/sitemap.xml -> 200)
- Resources: [sitemaps.org](https://www.sitemaps.org/protocol.html), [Fix skill](https://www.anc.dev/web-audit/skill/sitemap)

### MISSING — Homepage sends RFC 8288 Link headers pointing at agent resources

- Tier: SHOULD
- Goal: Advertise machine surfaces in a Link response header on / for header-only discovery.
- Result: Not found (https://huggingface.co/ -> 200 (header link no match /rel="?(service-desc|describedby|api-catalog|service-doc)"?/))
- Fix: Send a `Link` response header on `/` (RFC 8288) whose `rel` points at your machine surfaces, so an agent reading only response headers finds them without parsing HTML or probing `/.well-known`. Use the RFC 8631 service trio and the RFC 9727 catalog: `rel="service-desc"` at a machine-readable description (OpenAPI, or an MCP server card), `rel="service-doc"` at the human-readable doc, `rel="service-meta"` at the service-context declaration, and `rel="api-catalog"` at your `/.well-known/api-catalog` index. Example: `Link: </.well-known/api-catalog>; rel="api-catalog", </.well-known/mcp/server-card.json>; rel="service-desc"`.
- Resources: [RFC 8288 (Link)](https://www.rfc-editor.org/rfc/rfc8288), [RFC 8631 (service links)](https://www.rfc-editor.org/rfc/rfc8631), [RFC 9727 (api-catalog)](https://www.rfc-editor.org/rfc/rfc9727), [Fix skill](https://www.anc.dev/web-audit/skill/link-headers)

```text
Goal: Advertise machine surfaces in a Link response header on / for header-only discovery
Issue: https://huggingface.co/ -> 200 (header link no match /rel="?(service-desc|describedby|api-catalog|service-doc)"?/)
Fix: Send a `Link` response header on `/` (RFC 8288) whose `rel` points at your machine surfaces, so an agent reading only response headers finds them without parsing HTML or probing `/.well-known`. Use the RFC 8631 service trio and the RFC 9727 catalog: `rel="service-desc"` at a machine-readable description (OpenAPI, or an MCP server card), `rel="service-doc"` at the human-readable doc, `rel="service-meta"` at the service-context declaration, and `rel="api-catalog"` at your `/.well-known/api-catalog` index. Example: `Link: </.well-known/api-catalog>; rel="api-catalog", </.well-known/mcp/server-card.json>; rel="service-desc"`.
Skill: https://www.anc.dev/web-audit/skill/link-headers
Docs: https://www.rfc-editor.org/rfc/rfc8288, https://www.rfc-editor.org/rfc/rfc8631, https://www.rfc-editor.org/rfc/rfc9727
```

### PASS — Root HTML links to machine surfaces via <link rel>

- Tier: SHOULD
- Goal: Point link rel elements at your machine surfaces from the root HTML head.
- Result: Verified (https://huggingface.co/ -> 200)
- Resources: [RFC 8631 (service-desc/doc)](https://www.rfc-editor.org/rfc/rfc8631), [Fix skill](https://www.anc.dev/web-audit/skill/root-link-rel)

### N/A — DNS for AI Discovery (DNS-AID) records under _agents (IETF draft)

- Tier: MAY
- Goal: Publish DNSSEC-signed SVCB records under _agents for DNS-level agent discovery.
- Result: Not implemented, optional (no DNS-AID records)
- Resources: [DNS-AID draft](https://datatracker.ietf.org/doc/draft-mozleywilliams-dnsop-dnsaid/), [Fix skill](https://www.anc.dev/web-audit/skill/dns-aid)

## Content for agents (3/5)

### MISSING — /llms.txt present with a summary and link index

- Tier: SHOULD
- Goal: Serve /llms.txt with a title, summary, and categorized link index.
- Result: Not found (https://huggingface.co/llms.txt -> 404 (status 404 not in [200]))
- Fix: Serve `/llms.txt` (llmstxt.org): an H1 title, a one-line summary blockquote, and a categorized index of links to your most important pages as markdown. It is the canonical entry point an agent fetches to understand what a site offers and where to look next.
- Resources: [llmstxt.org](https://llmstxt.org/), [Fix skill](https://www.anc.dev/web-audit/skill/llms-txt)

```text
Goal: Serve /llms.txt with a title, summary, and categorized link index
Issue: https://huggingface.co/llms.txt -> 404 (status 404 not in [200])
Fix: Serve `/llms.txt` (llmstxt.org): an H1 title, a one-line summary blockquote, and a categorized index of links to your most important pages as markdown. It is the canonical entry point an agent fetches to understand what a site offers and where to look next.
Skill: https://www.anc.dev/web-audit/skill/llms-txt
Docs: https://llmstxt.org/
```

### N/A — /llms-full.txt present (single-fetch full corpus)

- Tier: MAY
- Goal: Serve the whole docs corpus as markdown at /llms-full.txt for one-fetch ingestion.
- Result: Not applicable (not a docs/content site)
- Resources: [llmstxt.org](https://llmstxt.org/), [Fix skill](https://www.anc.dev/web-audit/skill/llms-full-txt)

### N/A — Per-section llms.txt files resolve under content subdirectories

- Tier: MAY
- Goal: Serve a scoped llms.txt inside each major content section.
- Result: Not applicable (root llms.txt not present)
- Resources: [llmstxt.org](https://llmstxt.org/), [Fix skill](https://www.anc.dev/web-audit/skill/llms-txt-scoped)

### N/A — Per-section llms-full.txt files resolve under content subdirectories

- Tier: MAY
- Goal: Serve a scoped llms-full.txt corpus inside each major content section.
- Result: Not applicable (root llms-full.txt not present)
- Resources: [llmstxt.org](https://llmstxt.org/), [Fix skill](https://www.anc.dev/web-audit/skill/llms-full-txt-scoped)

### PASS — Root HTML has a descriptive <meta name="description">

- Tier: SHOULD
- Goal: Add a meta description naming what the service does and its agent entry points.
- Result: Verified (https://huggingface.co/ -> 200)
- Resources: [MDN meta description](https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/meta/name), [Fix skill](https://www.anc.dev/web-audit/skill/root-meta-description)

### N/A — Root HTML embeds Schema.org JSON-LD

- Tier: MAY
- Goal: Embed Schema.org JSON-LD so agents get typed facts without inference.
- Result: Not implemented, optional (https://huggingface.co/ -> 200 (body no match /application/ld\+json/))
- Resources: [Schema.org](https://schema.org/docs/gs.html), [Fix skill](https://www.anc.dev/web-audit/skill/schema-org-jsonld)

### PASS — Root HTML uses semantic landmarks

- Tier: MAY
- Goal: Use semantic landmarks so the HTML path is parseable structure, not div soup.
- Result: Verified (https://huggingface.co/ -> 200)
- Resources: [MDN content sectioning](https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements#content_sectioning), [Fix skill](https://www.anc.dev/web-audit/skill/semantic-html)

### PASS — Root HTML has a <noscript> with machine entry points

- Tier: SHOULD
- Goal: Give non-JS agents a noscript block listing your machine entry points.
- Result: Verified (https://huggingface.co/ -> 200)
- Resources: [MDN noscript](https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/noscript), [Fix skill](https://www.anc.dev/web-audit/skill/noscript-fallback)

### MISSING — Accept text/markdown content negotiation returns markdown

- Tier: SHOULD
- Goal: Honor Accept text/markdown on content URLs with raw markdown, not HTML chrome.
- Result: Not found (https://huggingface.co/ -> 200 (content-type "text/html; charset=utf-8" !~ /markdown|text/plain/))
- Fix: Honor `Accept: text/markdown` on content URLs and return raw markdown rather than HTML chrome. Agents parse markdown far more reliably than a JS-rendered page. Serve the markdown twin at the same URL via content negotiation, invisibly to crawlers.
- Resources: [RFC 7763 (text/markdown)](https://www.rfc-editor.org/rfc/rfc7763), [Fix skill](https://www.anc.dev/web-audit/skill/accept-markdown)

```text
Goal: Honor Accept text/markdown on content URLs with raw markdown, not HTML chrome
Issue: https://huggingface.co/ -> 200 (content-type "text/html; charset=utf-8" !~ /markdown|text/plain/)
Fix: Honor `Accept: text/markdown` on content URLs and return raw markdown rather than HTML chrome. Agents parse markdown far more reliably than a JS-rendered page. Serve the markdown twin at the same URL via content negotiation, invisibly to crawlers.
Skill: https://www.anc.dev/web-audit/skill/accept-markdown
Docs: https://www.rfc-editor.org/rfc/rfc7763
```

## Bot & crawl policy (2/4)

### PASS — robots.txt declares AI-crawler rules (RFC 9309)

- Tier: SHOULD
- Goal: State your AI-crawler policy in robots.txt with explicit User-agent rules.
- Result: Verified (https://huggingface.co/robots.txt -> 200)
- Resources: [RFC 9309](https://www.rfc-editor.org/rfc/rfc9309), [Fix skill](https://www.anc.dev/web-audit/skill/robots-ai-rules)

### BROKEN — robots.txt declares Content-Signal AI-usage preferences

- Tier: SHOULD
- Goal: Declare Content-Signal AI-usage preferences in robots.txt.
- Result: Present but broken (https://huggingface.co/robots.txt -> 200 (body no match /^\s*Content-Signal:\s*(ai-train|search|ai-input)/))
- Fix: Add `Content-Signal` directives to `robots.txt` (contentsignals.org): `ai-train`, `search`, and `ai-input` set to `yes` or `no`. They express usage preferences at a finer grain than a blanket allow/deny.
- Resources: [contentsignals.org](https://contentsignals.org/), [Fix skill](https://www.anc.dev/web-audit/skill/content-signals)

```text
Goal: Declare Content-Signal AI-usage preferences in robots.txt
Issue: https://huggingface.co/robots.txt -> 200 (body no match /^\s*Content-Signal:\s*(ai-train|search|ai-input)/)
Fix: Add `Content-Signal` directives to `robots.txt` (contentsignals.org): `ai-train`, `search`, and `ai-input` set to `yes` or `no`. They express usage preferences at a finer grain than a blanket allow/deny.
Skill: https://www.anc.dev/web-audit/skill/content-signals
Docs: https://contentsignals.org/
```

### PASS — /.well-known/security.txt present (RFC 9116)

- Tier: MAY
- Goal: Publish security.txt with a Contact and Expires field.
- Result: Verified (https://huggingface.co/.well-known/security.txt -> 200)
- Resources: [RFC 9116](https://www.rfc-editor.org/rfc/rfc9116), [Fix skill](https://www.anc.dev/web-audit/skill/security-txt)

### BROKEN — Web Bot Auth signature directory present (informational)

- Tier: MAY
- Goal: Publish an HTTP Message Signatures directory if your site sends signed bot traffic.
- Result: Present but broken (https://huggingface.co/.well-known/http-message-signatures-directory -> 401 (status 401 not in [200]))
- Fix: Informational only. If your site sends authenticated bot traffic, publish an HTTP Message Signatures JWKS directory at `/.well-known/http-message-signatures-directory` so recipients can verify your bot's signatures. Skip it if you do not send signed bot requests.
- Resources: [Web Bot Auth draft](https://datatracker.ietf.org/doc/draft-meunier-web-bot-auth-architecture/), [Fix skill](https://www.anc.dev/web-audit/skill/web-bot-auth)

```text
Goal: Publish an HTTP Message Signatures directory if your site sends signed bot traffic
Issue: https://huggingface.co/.well-known/http-message-signatures-directory -> 401 (status 401 not in [200])
Fix: Informational only. If your site sends authenticated bot traffic, publish an HTTP Message Signatures JWKS directory at `/.well-known/http-message-signatures-directory` so recipients can verify your bot's signatures. Skip it if you do not send signed bot requests.
Skill: https://www.anc.dev/web-audit/skill/web-bot-auth
Docs: https://datatracker.ietf.org/doc/draft-meunier-web-bot-auth-architecture/
```

## API (1/2)

### PASS — An OpenAPI description is published

- Tier: MUST
- Goal: Publish an OpenAPI description so non-MCP agents can call your HTTP API.
- Result: Verified (https://huggingface.co/.well-known/openapi.json -> 200)
- Resources: [OpenAPI 3.1](https://spec.openapis.org/oas/latest.html), [Fix skill](https://www.anc.dev/web-audit/skill/openapi)

### BROKEN — /.well-known/api-catalog published (RFC 9727)

- Tier: MAY
- Goal: Serve an RFC 9727 api-catalog linkset indexing your API descriptions.
- Result: Present but broken (https://huggingface.co/.well-known/api-catalog -> 401 (status 401 not in [200]))
- Fix: Serve `/.well-known/api-catalog` (RFC 9727) as `application/linkset+json` with a `linkset[]` of anchor plus `service-desc` entries. It is the standard index that points agents at every API description you publish.
- Resources: [RFC 9727](https://www.rfc-editor.org/rfc/rfc9727), [Fix skill](https://www.anc.dev/web-audit/skill/api-catalog)

```text
Goal: Serve an RFC 9727 api-catalog linkset indexing your API descriptions
Issue: https://huggingface.co/.well-known/api-catalog -> 401 (status 401 not in [200])
Fix: Serve `/.well-known/api-catalog` (RFC 9727) as `application/linkset+json` with a `linkset[]` of anchor plus `service-desc` entries. It is the standard index that points agents at every API description you publish.
Skill: https://www.anc.dev/web-audit/skill/api-catalog
Docs: https://www.rfc-editor.org/rfc/rfc9727
```

### N/A — Referenced JSON Schemas resolve as application/schema+json

- Tier: MAY
- Goal: Serve the JSON Schemas your API references so agents can validate payloads pre-flight.
- Result: Not implemented, optional (https://huggingface.co/api/schema/input.json -> 404 (status 404 not in [200]))
- Resources: [JSON Schema](https://json-schema.org/specification), [Fix skill](https://www.anc.dev/web-audit/skill/json-schemas)

## MCP (5/8)

### PASS — initialize handshake returns serverInfo + protocolVersion

- Tier: MUST
- Goal: Answer JSON-RPC initialize with serverInfo and protocolVersion so clients can begin a session.
- Result: Verified (serverInfo @huggingface/mcp-services, protocol 2025-06-18)
- Resources: [MCP lifecycle](https://modelcontextprotocol.io/specification/2025-06-18/basic/lifecycle), [Fix skill](https://www.anc.dev/web-audit/skill/mcp-initialize)

### PASS — initialize advertises capabilities (tools / resources / prompts)

- Tier: SHOULD
- Goal: Advertise the capability groups your MCP server implements in the initialize result.
- Result: Verified (serverInfo @huggingface/mcp-services, protocol 2025-06-18)
- Resources: [MCP lifecycle](https://modelcontextprotocol.io/specification/2025-06-18/basic/lifecycle), [Fix skill](https://www.anc.dev/web-audit/skill/mcp-capabilities)

### BROKEN — tools/list returns a tools array with input schemas

- Tier: MUST
- Goal: Return tools/list entries with name, description, and a JSON inputSchema.
- Result: Present but broken (no tools array)
- Fix: Return `result.tools` as an array from the `tools/list` method. Each tool needs a `name`, a `description`, and a JSON Schema `inputSchema` so an agent can validate arguments before calling. A tool without an `inputSchema` forces the agent to guess argument shapes.
- Resources: [MCP tools](https://modelcontextprotocol.io/specification/2025-06-18/server/tools), [Fix skill](https://www.anc.dev/web-audit/skill/mcp-tools-list)

```text
Goal: Return tools/list entries with name, description, and a JSON inputSchema
Issue: no tools array
Fix: Return `result.tools` as an array from the `tools/list` method. Each tool needs a `name`, a `description`, and a JSON Schema `inputSchema` so an agent can validate arguments before calling. A tool without an `inputSchema` forces the agent to guess argument shapes.
Skill: https://www.anc.dev/web-audit/skill/mcp-tools-list
Docs: https://modelcontextprotocol.io/specification/2025-06-18/server/tools
```

### BROKEN — unknown JSON-RPC method returns -32601

- Tier: SHOULD
- Goal: Reject unknown JSON-RPC methods with error -32601 instead of a hang or 500.
- Result: Present but broken (error code -32600)
- Fix: Reject an unknown JSON-RPC method with the standard error code `-32601` (Method not found), not a hang, a 500, or a silent empty body. Agents rely on `-32601` to distinguish "unsupported" from "failed"; anything else looks like an outage.
- Resources: [JSON-RPC 2.0](https://www.jsonrpc.org/specification#error_object), [Fix skill](https://www.anc.dev/web-audit/skill/mcp-unknown-method)

```text
Goal: Reject unknown JSON-RPC methods with error -32601 instead of a hang or 500
Issue: error code -32600
Fix: Reject an unknown JSON-RPC method with the standard error code `-32601` (Method not found), not a hang, a 500, or a silent empty body. Agents rely on `-32601` to distinguish "unsupported" from "failed"; anything else looks like an outage.
Skill: https://www.anc.dev/web-audit/skill/mcp-unknown-method
Docs: https://www.jsonrpc.org/specification#error_object
```

### PASS — GET on the MCP endpoint answers fast (not a held-open hang)

- Tier: SHOULD
- Goal: Answer GET on the MCP endpoint fast (a fast-fail status or a documented surface), never a held-open hang.
- Result: Verified (https://huggingface.co/mcp -> 405)
- Resources: [MCP transports](https://modelcontextprotocol.io/specification/2025-06-18/basic/transports), [Fix skill](https://www.anc.dev/web-audit/skill/mcp-get-fast-fail)

### N/A — Root HTML exposes WebMCP browser tools

- Tier: MAY
- Goal: Expose page tools to browser agents via WebMCP.
- Result: Not implemented, optional (https://huggingface.co/ -> 200 (no WebMCP markers in root HTML))
- Resources: [WebMCP spec](https://webmachinelearning.github.io/webmcp/), [Fix skill](https://www.anc.dev/web-audit/skill/webmcp)

### PASS — POST response carries Access-Control-Allow-Origin

- Tier: SHOULD
- Goal: Echo Access-Control-Allow-Origin on the actual MCP POST response.
- Result: Verified (allow-origin https://example.com)
- Resources: [MDN CORS](https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CORS), [Fix skill](https://www.anc.dev/web-audit/skill/mcp-cors-actual)

### PASS — CORS preflight (OPTIONS) succeeds with Access-Control-Allow-* headers

- Tier: SHOULD
- Goal: Answer OPTIONS preflights on the MCP endpoint with Access-Control-Allow-* headers.
- Result: Verified (200 allow-origin https://example.com)
- Resources: [MDN CORS preflight](https://developer.mozilla.org/en-US/docs/Glossary/Preflight_request), [Fix skill](https://www.anc.dev/web-audit/skill/mcp-cors-preflight)

### N/A — A human/agent usage doc for the server resolves

- Tier: MAY
- Goal: Publish a one-fetch markdown usage doc for your MCP server.
- Result: Not implemented, optional (https://huggingface.co/mcp-skill.md -> 404 (status 404 not in [200]))
- Resources: [anc.dev example](https://anc.dev/mcp-skill.md), [Fix skill](https://www.anc.dev/web-audit/skill/mcp-usage-doc)

### MISSING — A .well-known MCP server card is published (SEP-1649)

- Tier: SHOULD
- Goal: Publish an MCP server card at the canonical SEP-1649 path and 301 the legacy aliases to it.
- Result: Not found (https://huggingface.co/.well-known/mcp/server-card.json -> 404 (status 404 not in [200]))
- Fix: Publish an MCP server card at `/.well-known/mcp/server-card.json` (SEP-1649) naming the endpoint, transport, and capabilities: include `mcp_endpoint` (or `url`, or `transport.endpoint`), `serverInfo`, and the transport type. Serve the legacy pointer paths (`/.well-known/mcp`, `/.well-known/mcp.json`, `/mcp.json`) as `301` redirects to the canonical, never as duplicate inline copies.
- Resources: [SEP-1649](https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2127), [Fix skill](https://www.anc.dev/web-audit/skill/well-known-mcp-card)

```text
Goal: Publish an MCP server card at the canonical SEP-1649 path and 301 the legacy aliases to it
Issue: https://huggingface.co/.well-known/mcp/server-card.json -> 404 (status 404 not in [200])
Fix: Publish an MCP server card at `/.well-known/mcp/server-card.json` (SEP-1649) naming the endpoint, transport, and capabilities: include `mcp_endpoint` (or `url`, or `transport.endpoint`), `serverInfo`, and the transport type. Serve the legacy pointer paths (`/.well-known/mcp`, `/.well-known/mcp.json`, `/mcp.json`) as `301` redirects to the canonical, never as duplicate inline copies.
Skill: https://www.anc.dev/web-audit/skill/well-known-mcp-card
Docs: https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2127
```

## Agent discovery & auth (1/3)

### PASS — OAuth/OIDC discovery metadata published

- Tier: MAY
- Goal: Publish OAuth/OIDC discovery metadata if agents authenticate to your service.
- Result: Verified (https://huggingface.co/.well-known/openid-configuration -> 200)
- Resources: [RFC 8414](https://www.rfc-editor.org/rfc/rfc8414), [Fix skill](https://www.anc.dev/web-audit/skill/oauth-discovery)

### N/A — OAuth Protected Resource Metadata published (RFC 9728)

- Tier: MAY
- Goal: Publish RFC 9728 protected-resource metadata for your authenticated MCP server.
- Result: Not applicable (MCP endpoint does not challenge for auth)
- Resources: [RFC 9728](https://www.rfc-editor.org/rfc/rfc9728), [Fix skill](https://www.anc.dev/web-audit/skill/oauth-protected-resource)

### BROKEN — A2A Agent Card published for agent-to-agent discovery

- Tier: MAY
- Goal: Publish an A2A Agent Card for agent-to-agent discovery.
- Result: Present but broken (https://huggingface.co/.well-known/agent-card.json -> 401 (status 401 not in [200]))
- Fix: Serve an A2A Agent Card at `/.well-known/agent-card.json` (a2a-protocol.org) with `name`, `version`, and `supportedInterfaces`. It lets other agents discover and interoperate with yours over the agent-to-agent protocol.
- Resources: [A2A protocol](https://a2a-protocol.org/latest/specification/), [Fix skill](https://www.anc.dev/web-audit/skill/a2a-agent-card)

```text
Goal: Publish an A2A Agent Card for agent-to-agent discovery
Issue: https://huggingface.co/.well-known/agent-card.json -> 401 (status 401 not in [200])
Fix: Serve an A2A Agent Card at `/.well-known/agent-card.json` (a2a-protocol.org) with `name`, `version`, and `supportedInterfaces`. It lets other agents discover and interoperate with yours over the agent-to-agent protocol.
Skill: https://www.anc.dev/web-audit/skill/a2a-agent-card
Docs: https://a2a-protocol.org/latest/specification/
```

### N/A — Agent-skills discovery index published

- Tier: MAY
- Goal: Publish an agent-skills discovery index so agents can enumerate your skills.
- Result: Not implemented, optional (https://huggingface.co/.well-known/agent-skills/index.json -> 404 (status 404 not in [200]))
- Resources: [Agent Skills Discovery](https://github.com/cloudflare/agent-skills-discovery), [Fix skill](https://www.anc.dev/web-audit/skill/agent-skills)

### BROKEN — Agent auth/registration metadata doc published

- Tier: MAY
- Goal: Publish an auth.md telling agents how to obtain credentials.
- Result: Present but broken (https://huggingface.co/.well-known/auth.md -> 401)
- Fix: Publish an `auth.md` at `/.well-known/auth.md` (or `/auth.md`): a short markdown guide that tells an agent how to obtain credentials, including where to register, which OAuth flows are supported, token endpoints, and scopes. It turns "figure out our auth" into a one-fetch orientation.
- Resources: [anc.dev example](https://anc.dev/auth.md), [Fix skill](https://www.anc.dev/web-audit/skill/auth-md)

```text
Goal: Publish an auth.md telling agents how to obtain credentials
Issue: https://huggingface.co/.well-known/auth.md -> 401
Fix: Publish an `auth.md` at `/.well-known/auth.md` (or `/auth.md`): a short markdown guide that tells an agent how to obtain credentials, including where to register, which OAuth flows are supported, token endpoints, and scopes. It turns "figure out our auth" into a one-fetch orientation.
Skill: https://www.anc.dev/web-audit/skill/auth-md
Docs: https://anc.dev/auth.md
```

## Re-run this audit

Re-run from [anc.dev/web-audit](https://anc.dev/web-audit), or call the `audit_website` MCP tool.