# Microsoft — Agent-Readiness Audit

Website: [https://microsoft.com/](https://microsoft.com/)

**Score:** 43% (relative to the checks that apply to this site)
**Global:** 13% of a maximally agent-ready site

## Discoverability (2/4)

### PASS — /robots.txt present

- Tier: SHOULD
- Goal: Publish robots.txt and state your crawl policy explicitly.
- Result: Verified (https://microsoft.com/robots.txt -> 200)
- Resources: [RFC 9309](https://www.rfc-editor.org/rfc/rfc9309), [Fix skill](https://www.anc.dev/web-audit/skill/robots)

### PASS — /sitemap.xml present

- Tier: MAY
- Goal: Publish sitemap.xml so agents can enumerate your content URLs.
- Result: Verified (https://microsoft.com/sitemap.xml -> 200)
- Resources: [sitemaps.org](https://www.sitemaps.org/protocol.html), [Fix skill](https://www.anc.dev/web-audit/skill/sitemap)

### MISSING — Homepage sends RFC 8288 Link headers pointing at agent resources

- Tier: SHOULD
- Goal: Advertise machine surfaces in a Link response header on / for header-only discovery.
- Result: Not found (https://microsoft.com/ -> 200 (header link no match /rel="?(service-desc|describedby|api-catalog|service-doc)"?/))
- Fix: Send a `Link` response header on `/` (RFC 8288) whose `rel` points at your machine surfaces, so an agent reading only response headers finds them without parsing HTML or probing `/.well-known`. Use the RFC 8631 service trio and the RFC 9727 catalog: `rel="service-desc"` at a machine-readable description (OpenAPI, or an MCP server card), `rel="service-doc"` at the human-readable doc, `rel="service-meta"` at the service-context declaration, and `rel="api-catalog"` at your `/.well-known/api-catalog` index. Example: `Link: </.well-known/api-catalog>; rel="api-catalog", </.well-known/mcp/server-card.json>; rel="service-desc"`.
- Resources: [RFC 8288 (Link)](https://www.rfc-editor.org/rfc/rfc8288), [RFC 8631 (service links)](https://www.rfc-editor.org/rfc/rfc8631), [RFC 9727 (api-catalog)](https://www.rfc-editor.org/rfc/rfc9727), [Fix skill](https://www.anc.dev/web-audit/skill/link-headers)

```text
Goal: Advertise machine surfaces in a Link response header on / for header-only discovery
Issue: https://microsoft.com/ -> 200 (header link no match /rel="?(service-desc|describedby|api-catalog|service-doc)"?/)
Fix: Send a `Link` response header on `/` (RFC 8288) whose `rel` points at your machine surfaces, so an agent reading only response headers finds them without parsing HTML or probing `/.well-known`. Use the RFC 8631 service trio and the RFC 9727 catalog: `rel="service-desc"` at a machine-readable description (OpenAPI, or an MCP server card), `rel="service-doc"` at the human-readable doc, `rel="service-meta"` at the service-context declaration, and `rel="api-catalog"` at your `/.well-known/api-catalog` index. Example: `Link: </.well-known/api-catalog>; rel="api-catalog", </.well-known/mcp/server-card.json>; rel="service-desc"`.
Skill: https://www.anc.dev/web-audit/skill/link-headers
Docs: https://www.rfc-editor.org/rfc/rfc8288, https://www.rfc-editor.org/rfc/rfc8631, https://www.rfc-editor.org/rfc/rfc9727
```

### MISSING — Root HTML links to machine surfaces via <link rel>

- Tier: SHOULD
- Goal: Point link rel elements at your machine surfaces from the root HTML head.
- Result: Not found (https://microsoft.com/ -> 200 (body no match /rel=["'](service-desc|service-doc|alternate)["']/))
- Fix: Add `<link rel>` elements in your root HTML head pointing at your machine surfaces: `rel="service-desc"` to the OpenAPI doc, `rel="service-doc"` to human docs, and `rel="alternate"` to `llms.txt` and the MCP card. An agent that lands on the HTML can then discover the structured surfaces without scraping.
- Resources: [RFC 8631 (service-desc/doc)](https://www.rfc-editor.org/rfc/rfc8631), [Fix skill](https://www.anc.dev/web-audit/skill/root-link-rel)

```text
Goal: Point link rel elements at your machine surfaces from the root HTML head
Issue: https://microsoft.com/ -> 200 (body no match /rel=["'](service-desc|service-doc|alternate)["']/)
Fix: Add `<link rel>` elements in your root HTML head pointing at your machine surfaces: `rel="service-desc"` to the OpenAPI doc, `rel="service-doc"` to human docs, and `rel="alternate"` to `llms.txt` and the MCP card. An agent that lands on the HTML can then discover the structured surfaces without scraping.
Skill: https://www.anc.dev/web-audit/skill/root-link-rel
Docs: https://www.rfc-editor.org/rfc/rfc8631
```

### N/A — DNS for AI Discovery (DNS-AID) records under _agents (IETF draft)

- Tier: MAY
- Goal: Publish DNSSEC-signed SVCB records under _agents for DNS-level agent discovery.
- Result: Not implemented, optional (no DNS-AID records)
- Resources: [DNS-AID draft](https://datatracker.ietf.org/doc/draft-mozleywilliams-dnsop-dnsaid/), [Fix skill](https://www.anc.dev/web-audit/skill/dns-aid)

## Content for agents (2/5)

### MISSING — /llms.txt present with a summary and link index

- Tier: SHOULD
- Goal: Serve /llms.txt with a title, summary, and categorized link index.
- Result: Not found (https://microsoft.com/llms.txt -> 404 (status 404 not in [200]))
- Fix: Serve `/llms.txt` (llmstxt.org): an H1 title, a one-line summary blockquote, and a categorized index of links to your most important pages as markdown. It is the canonical entry point an agent fetches to understand what a site offers and where to look next.
- Resources: [llmstxt.org](https://llmstxt.org/), [Fix skill](https://www.anc.dev/web-audit/skill/llms-txt)

```text
Goal: Serve /llms.txt with a title, summary, and categorized link index
Issue: https://microsoft.com/llms.txt -> 404 (status 404 not in [200])
Fix: Serve `/llms.txt` (llmstxt.org): an H1 title, a one-line summary blockquote, and a categorized index of links to your most important pages as markdown. It is the canonical entry point an agent fetches to understand what a site offers and where to look next.
Skill: https://www.anc.dev/web-audit/skill/llms-txt
Docs: https://llmstxt.org/
```

### N/A — /llms-full.txt present (single-fetch full corpus)

- Tier: MAY
- Goal: Serve the whole docs corpus as markdown at /llms-full.txt for one-fetch ingestion.
- Result: Not applicable (not a docs/content site)
- Resources: [llmstxt.org](https://llmstxt.org/), [Fix skill](https://www.anc.dev/web-audit/skill/llms-full-txt)

### N/A — Per-section llms.txt files resolve under content subdirectories

- Tier: MAY
- Goal: Serve a scoped llms.txt inside each major content section.
- Result: Not applicable (root llms.txt not present)
- Resources: [llmstxt.org](https://llmstxt.org/), [Fix skill](https://www.anc.dev/web-audit/skill/llms-txt-scoped)

### N/A — Per-section llms-full.txt files resolve under content subdirectories

- Tier: MAY
- Goal: Serve a scoped llms-full.txt corpus inside each major content section.
- Result: Not applicable (root llms-full.txt not present)
- Resources: [llmstxt.org](https://llmstxt.org/), [Fix skill](https://www.anc.dev/web-audit/skill/llms-full-txt-scoped)

### PASS — Root HTML has a descriptive <meta name="description">

- Tier: SHOULD
- Goal: Add a meta description naming what the service does and its agent entry points.
- Result: Verified (https://microsoft.com/ -> 200)
- Resources: [MDN meta description](https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/meta/name), [Fix skill](https://www.anc.dev/web-audit/skill/root-meta-description)

### N/A — Root HTML embeds Schema.org JSON-LD

- Tier: MAY
- Goal: Embed Schema.org JSON-LD so agents get typed facts without inference.
- Result: Not implemented, optional (https://microsoft.com/ -> 200 (body no match /application/ld\+json/))
- Resources: [Schema.org](https://schema.org/docs/gs.html), [Fix skill](https://www.anc.dev/web-audit/skill/schema-org-jsonld)

### PASS — Root HTML uses semantic landmarks

- Tier: MAY
- Goal: Use semantic landmarks so the HTML path is parseable structure, not div soup.
- Result: Verified (https://microsoft.com/ -> 200)
- Resources: [MDN content sectioning](https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements#content_sectioning), [Fix skill](https://www.anc.dev/web-audit/skill/semantic-html)

### MISSING — Root HTML has a <noscript> with machine entry points

- Tier: SHOULD
- Goal: Give non-JS agents a noscript block listing your machine entry points.
- Result: Not found (https://microsoft.com/ -> 200 (body no match /<noscript/))
- Fix: Add a `<noscript>` block to your root HTML that links your machine entry points: `llms.txt`, your OpenAPI or MCP endpoint, and any `.well-known` cards. It hands a fetch-only crawler or a non-JS agent a concrete, in-body list of where the structured surfaces live, so it never has to run the client bundle or infer them from the visible page.
- Resources: [MDN noscript](https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/noscript), [Fix skill](https://www.anc.dev/web-audit/skill/noscript-fallback)

```text
Goal: Give non-JS agents a noscript block listing your machine entry points
Issue: https://microsoft.com/ -> 200 (body no match /<noscript/)
Fix: Add a `<noscript>` block to your root HTML that links your machine entry points: `llms.txt`, your OpenAPI or MCP endpoint, and any `.well-known` cards. It hands a fetch-only crawler or a non-JS agent a concrete, in-body list of where the structured surfaces live, so it never has to run the client bundle or infer them from the visible page.
Skill: https://www.anc.dev/web-audit/skill/noscript-fallback
Docs: https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/noscript
```

### MISSING — Accept text/markdown content negotiation returns markdown

- Tier: SHOULD
- Goal: Honor Accept text/markdown on content URLs with raw markdown, not HTML chrome.
- Result: Not found (https://microsoft.com/ -> 403 (content-type "text/html" !~ /markdown|text/plain/))
- Fix: Honor `Accept: text/markdown` on content URLs and return raw markdown rather than HTML chrome. Agents parse markdown far more reliably than a JS-rendered page. Serve the markdown twin at the same URL via content negotiation, invisibly to crawlers.
- Resources: [RFC 7763 (text/markdown)](https://www.rfc-editor.org/rfc/rfc7763), [Fix skill](https://www.anc.dev/web-audit/skill/accept-markdown)

```text
Goal: Honor Accept text/markdown on content URLs with raw markdown, not HTML chrome
Issue: https://microsoft.com/ -> 403 (content-type "text/html" !~ /markdown|text/plain/)
Fix: Honor `Accept: text/markdown` on content URLs and return raw markdown rather than HTML chrome. Agents parse markdown far more reliably than a JS-rendered page. Serve the markdown twin at the same URL via content negotiation, invisibly to crawlers.
Skill: https://www.anc.dev/web-audit/skill/accept-markdown
Docs: https://www.rfc-editor.org/rfc/rfc7763
```

## Bot & crawl policy (2/3)

### BROKEN — robots.txt declares Content-Signal AI-usage preferences

- Tier: SHOULD
- Goal: Declare Content-Signal AI-usage preferences in robots.txt.
- Result: Present but broken (https://microsoft.com/robots.txt -> 200 (body no match /^\s*Content-Signal:\s*(ai-train|search|ai-input)/))
- Fix: Add `Content-Signal` directives to `robots.txt` (contentsignals.org): `ai-train`, `search`, and `ai-input` set to `yes` or `no`. They express usage preferences at a finer grain than a blanket allow/deny.
- Resources: [contentsignals.org](https://contentsignals.org/), [Fix skill](https://www.anc.dev/web-audit/skill/content-signals)

```text
Goal: Declare Content-Signal AI-usage preferences in robots.txt
Issue: https://microsoft.com/robots.txt -> 200 (body no match /^\s*Content-Signal:\s*(ai-train|search|ai-input)/)
Fix: Add `Content-Signal` directives to `robots.txt` (contentsignals.org): `ai-train`, `search`, and `ai-input` set to `yes` or `no`. They express usage preferences at a finer grain than a blanket allow/deny.
Skill: https://www.anc.dev/web-audit/skill/content-signals
Docs: https://contentsignals.org/
```

### PASS — robots.txt declares AI-crawler rules (RFC 9309)

- Tier: SHOULD
- Goal: State your AI-crawler policy in robots.txt with explicit User-agent rules.
- Result: Verified (https://microsoft.com/robots.txt -> 200)
- Resources: [RFC 9309](https://www.rfc-editor.org/rfc/rfc9309), [Fix skill](https://www.anc.dev/web-audit/skill/robots-ai-rules)

### PASS — /.well-known/security.txt present (RFC 9116)

- Tier: MAY
- Goal: Publish security.txt with a Contact and Expires field.
- Result: Verified (https://microsoft.com/.well-known/security.txt -> 200)
- Resources: [RFC 9116](https://www.rfc-editor.org/rfc/rfc9116), [Fix skill](https://www.anc.dev/web-audit/skill/security-txt)

### N/A — Web Bot Auth signature directory present (informational)

- Tier: MAY
- Goal: Publish an HTTP Message Signatures directory if your site sends signed bot traffic.
- Result: Not implemented, optional (https://microsoft.com/.well-known/http-message-signatures-directory -> 404 (status 404 not in [200]))
- Resources: [Web Bot Auth draft](https://datatracker.ietf.org/doc/draft-meunier-web-bot-auth-architecture/), [Fix skill](https://www.anc.dev/web-audit/skill/web-bot-auth)

## API (0/0)

No checks in this category apply to this site.

### N/A — An OpenAPI description is published

- Tier: MUST
- Goal: Publish an OpenAPI description so non-MCP agents can call your HTTP API.
- Result: Not applicable (no API surface detected)
- Resources: [OpenAPI 3.1](https://spec.openapis.org/oas/latest.html), [Fix skill](https://www.anc.dev/web-audit/skill/openapi)

### N/A — Referenced JSON Schemas resolve as application/schema+json

- Tier: MAY
- Goal: Serve the JSON Schemas your API references so agents can validate payloads pre-flight.
- Result: Not applicable (no JSON Schema references detected)
- Resources: [JSON Schema](https://json-schema.org/specification), [Fix skill](https://www.anc.dev/web-audit/skill/json-schemas)

### N/A — /.well-known/api-catalog published (RFC 9727)

- Tier: MAY
- Goal: Serve an RFC 9727 api-catalog linkset indexing your API descriptions.
- Result: Not applicable (no API surface detected)
- Resources: [RFC 9727](https://www.rfc-editor.org/rfc/rfc9727), [Fix skill](https://www.anc.dev/web-audit/skill/api-catalog)

## MCP (0/0)

No checks in this category apply to this site.

### N/A — initialize handshake returns serverInfo + protocolVersion

- Tier: MUST
- Goal: Answer JSON-RPC initialize with serverInfo and protocolVersion so clients can begin a session.
- Result: Not applicable (no MCP endpoint discovered)
- Resources: [MCP lifecycle](https://modelcontextprotocol.io/specification/2025-06-18/basic/lifecycle), [Fix skill](https://www.anc.dev/web-audit/skill/mcp-initialize)

### N/A — initialize advertises capabilities (tools / resources / prompts)

- Tier: SHOULD
- Goal: Advertise the capability groups your MCP server implements in the initialize result.
- Result: Not applicable (no MCP endpoint discovered)
- Resources: [MCP lifecycle](https://modelcontextprotocol.io/specification/2025-06-18/basic/lifecycle), [Fix skill](https://www.anc.dev/web-audit/skill/mcp-capabilities)

### N/A — tools/list returns a tools array with input schemas

- Tier: MUST
- Goal: Return tools/list entries with name, description, and a JSON inputSchema.
- Result: Not applicable (no MCP endpoint discovered)
- Resources: [MCP tools](https://modelcontextprotocol.io/specification/2025-06-18/server/tools), [Fix skill](https://www.anc.dev/web-audit/skill/mcp-tools-list)

### N/A — unknown JSON-RPC method returns -32601

- Tier: SHOULD
- Goal: Reject unknown JSON-RPC methods with error -32601 instead of a hang or 500.
- Result: Not applicable (no MCP endpoint discovered)
- Resources: [JSON-RPC 2.0](https://www.jsonrpc.org/specification#error_object), [Fix skill](https://www.anc.dev/web-audit/skill/mcp-unknown-method)

### N/A — GET on the MCP endpoint answers fast (not a held-open hang)

- Tier: SHOULD
- Goal: Answer GET on the MCP endpoint fast (a fast-fail status or a documented surface), never a held-open hang.
- Result: Not applicable (no MCP endpoint discovered)
- Resources: [MCP transports](https://modelcontextprotocol.io/specification/2025-06-18/basic/transports), [Fix skill](https://www.anc.dev/web-audit/skill/mcp-get-fast-fail)

### N/A — CORS preflight (OPTIONS) succeeds with Access-Control-Allow-* headers

- Tier: SHOULD
- Goal: Answer OPTIONS preflights on the MCP endpoint with Access-Control-Allow-* headers.
- Result: Not applicable (no MCP endpoint discovered)
- Resources: [MDN CORS preflight](https://developer.mozilla.org/en-US/docs/Glossary/Preflight_request), [Fix skill](https://www.anc.dev/web-audit/skill/mcp-cors-preflight)

### N/A — POST response carries Access-Control-Allow-Origin

- Tier: SHOULD
- Goal: Echo Access-Control-Allow-Origin on the actual MCP POST response.
- Result: Not applicable (no MCP endpoint discovered)
- Resources: [MDN CORS](https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CORS), [Fix skill](https://www.anc.dev/web-audit/skill/mcp-cors-actual)

### N/A — A .well-known MCP server card is published (SEP-1649)

- Tier: SHOULD
- Goal: Publish an MCP server card at the canonical SEP-1649 path and 301 the legacy aliases to it.
- Result: Not applicable (no MCP endpoint discovered)
- Resources: [SEP-1649](https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2127), [Fix skill](https://www.anc.dev/web-audit/skill/well-known-mcp-card)

### N/A — A human/agent usage doc for the server resolves

- Tier: MAY
- Goal: Publish a one-fetch markdown usage doc for your MCP server.
- Result: Not applicable (no MCP endpoint discovered)
- Resources: [anc.dev example](https://anc.dev/mcp-skill.md), [Fix skill](https://www.anc.dev/web-audit/skill/mcp-usage-doc)

### N/A — Root HTML exposes WebMCP browser tools

- Tier: MAY
- Goal: Expose page tools to browser agents via WebMCP.
- Result: Not implemented, optional (https://microsoft.com/ -> 200 (no WebMCP markers in root HTML))
- Resources: [WebMCP spec](https://webmachinelearning.github.io/webmcp/), [Fix skill](https://www.anc.dev/web-audit/skill/webmcp)

## Agent discovery & auth (0/0)

No checks in this category apply to this site.

### N/A — OAuth/OIDC discovery metadata published

- Tier: MAY
- Goal: Publish OAuth/OIDC discovery metadata if agents authenticate to your service.
- Result: Not applicable (no auth surface detected)
- Resources: [RFC 8414](https://www.rfc-editor.org/rfc/rfc8414), [Fix skill](https://www.anc.dev/web-audit/skill/oauth-discovery)

### N/A — OAuth Protected Resource Metadata published (RFC 9728)

- Tier: MAY
- Goal: Publish RFC 9728 protected-resource metadata for your authenticated MCP server.
- Result: Not applicable (MCP endpoint does not challenge for auth)
- Resources: [RFC 9728](https://www.rfc-editor.org/rfc/rfc9728), [Fix skill](https://www.anc.dev/web-audit/skill/oauth-protected-resource)

### N/A — Agent auth/registration metadata doc published

- Tier: MAY
- Goal: Publish an auth.md telling agents how to obtain credentials.
- Result: Not applicable (no auth surface detected)
- Resources: [anc.dev example](https://anc.dev/auth.md), [Fix skill](https://www.anc.dev/web-audit/skill/auth-md)

### N/A — A2A Agent Card published for agent-to-agent discovery

- Tier: MAY
- Goal: Publish an A2A Agent Card for agent-to-agent discovery.
- Result: Not implemented, optional (https://microsoft.com/.well-known/agent-card.json -> 404 (status 404 not in [200]))
- Resources: [A2A protocol](https://a2a-protocol.org/latest/specification/), [Fix skill](https://www.anc.dev/web-audit/skill/a2a-agent-card)

### N/A — Agent-skills discovery index published

- Tier: MAY
- Goal: Publish an agent-skills discovery index so agents can enumerate your skills.
- Result: Not implemented, optional (https://microsoft.com/.well-known/agent-skills/index.json -> 404 (status 404 not in [200]))
- Resources: [Agent Skills Discovery](https://github.com/cloudflare/agent-skills-discovery), [Fix skill](https://www.anc.dev/web-audit/skill/agent-skills)

## Re-run this audit

Re-run from [anc.dev/web-audit](https://anc.dev/web-audit), or call the `audit_website` MCP tool.