Prisma
relative to the checks that apply to this site; global measures it against a maximally agent-ready site.
Discoverability
2 / 4/robots.txt present SHOULD PASS
Goal: Publish robots.txt and state your crawl policy explicitly.
Result: Verified (https://prisma.io/robots.txt -> 200)
/sitemap.xml present MAY PASS
Goal: Publish sitemap.xml so agents can enumerate your content URLs.
Result: Verified (https://prisma.io/sitemap.xml -> 200)
Resources: sitemaps.org · Fix skill
Homepage sends RFC 8288 Link headers pointing at agent resources SHOULD MISSING
Goal: Advertise machine surfaces in a Link response header on / for header-only discovery.
Result: Not found (https://prisma.io/ -> 200 (header link no match /rel="?(service-desc|describedby|api-catalog|service-doc)"?/))
Fix: Send a `Link` response header on `/` (RFC 8288) whose `rel` points at your machine surfaces, so an agent reading only response headers finds them without parsing HTML or probing `/.well-known`. Use the RFC 8631 service trio and the RFC 9727 catalog: `rel="service-desc"` at a machine-readable description (OpenAPI, or an MCP server card), `rel="service-doc"` at the human-readable doc, `rel="service-meta"` at the service-context declaration, and `rel="api-catalog"` at your `/.well-known/api-catalog` index. Example: `Link: </.well-known/api-catalog>; rel="api-catalog", </.well-known/mcp/server-card.json>; rel="service-desc"`.
Resources: RFC 8288 (Link) · RFC 8631 (service links) · RFC 9727 (api-catalog) · Fix skill
Root HTML links to machine surfaces via <link rel> SHOULD MISSING
Goal: Point link rel elements at your machine surfaces from the root HTML head.
Result: Not found (https://prisma.io/ -> 200 (body no match /rel=["'](service-desc|service-doc|alternate)["']/))
Fix: Add `<link rel>` elements in your root HTML head pointing at your machine surfaces: `rel="service-desc"` to the OpenAPI doc, `rel="service-doc"` to human docs, and `rel="alternate"` to `llms.txt` and the MCP card. An agent that lands on the HTML can then discover the structured surfaces without scraping.
Resources: RFC 8631 (service-desc/doc) · Fix skill
DNS for AI Discovery (DNS-AID) records under _agents (IETF draft) MAY N/A
Goal: Publish DNSSEC-signed SVCB records under _agents for DNS-level agent discovery.
Result: Not implemented, optional (no DNS-AID records)
Resources: DNS-AID draft · Fix skill
Content for agents
5 / 7/llms.txt present with a summary and link index SHOULD PASS
Goal: Serve /llms.txt with a title, summary, and categorized link index.
Result: Verified (https://prisma.io/llms.txt -> 200)
Resources: llmstxt.org · Fix skill
/llms-full.txt present (single-fetch full corpus) MAY PASS
Goal: Serve the whole docs corpus as markdown at /llms-full.txt for one-fetch ingestion.
Result: Verified (https://prisma.io/llms-full.txt -> 200)
Resources: llmstxt.org · Fix skill
Per-section llms.txt files resolve under content subdirectories MAY N/A
Goal: Serve a scoped llms.txt inside each major content section.
Result: Not implemented, optional (llms-txt-scoped -> error (no section directories in the root llms.txt or sitemap))
Resources: llmstxt.org · Fix skill
Per-section llms-full.txt files resolve under content subdirectories MAY N/A
Goal: Serve a scoped llms-full.txt corpus inside each major content section.
Result: Not implemented, optional (llms-full-txt-scoped -> error (no section directories in the root llms.txt or sitemap))
Resources: llmstxt.org · Fix skill
Root HTML has a descriptive <meta name="description"> SHOULD PASS
Goal: Add a meta description naming what the service does and its agent entry points.
Result: Verified (https://prisma.io/ -> 200)
Resources: MDN meta description · Fix skill
Root HTML embeds Schema.org JSON-LD MAY PASS
Goal: Embed Schema.org JSON-LD so agents get typed facts without inference.
Result: Verified (https://prisma.io/ -> 200)
Resources: Schema.org · Fix skill
Root HTML uses semantic landmarks MAY PASS
Goal: Use semantic landmarks so the HTML path is parseable structure, not div soup.
Result: Verified (https://prisma.io/ -> 200)
Resources: MDN content sectioning · Fix skill
Root HTML has a <noscript> with machine entry points SHOULD MISSING
Goal: Give non-JS agents a noscript block listing your machine entry points.
Result: Not found (https://prisma.io/ -> 200 (body no match /<noscript/))
Fix: Add a `<noscript>` block to your root HTML that links your machine entry points: `llms.txt`, your OpenAPI or MCP endpoint, and any `.well-known` cards. It hands a fetch-only crawler or a non-JS agent a concrete, in-body list of where the structured surfaces live, so it never has to run the client bundle or infer them from the visible page.
Resources: MDN noscript · Fix skill
Accept text/markdown content negotiation returns markdown SHOULD MISSING
Goal: Honor Accept text/markdown on content URLs with raw markdown, not HTML chrome.
Result: Not found (https://prisma.io/ -> 200 (content-type "text/html; charset=utf-8" !~ /markdown|text/plain/))
Fix: Honor `Accept: text/markdown` on content URLs and return raw markdown rather than HTML chrome. Agents parse markdown far more reliably than a JS-rendered page. Serve the markdown twin at the same URL via content negotiation, invisibly to crawlers.
Resources: RFC 7763 (text/markdown) · Fix skill
Bot & crawl policy
2 / 3Web Bot Auth signature directory present (informational) MAY N/A
Goal: Publish an HTTP Message Signatures directory if your site sends signed bot traffic.
Result: Not implemented, optional (https://prisma.io/.well-known/http-message-signatures-directory -> 404 (status 404 not in [200]))
Resources: Web Bot Auth draft · Fix skill
/.well-known/security.txt present (RFC 9116) MAY PASS
Goal: Publish security.txt with a Contact and Expires field.
Result: Verified (https://prisma.io/.well-known/security.txt -> 200)
robots.txt declares AI-crawler rules (RFC 9309) SHOULD PASS
Goal: State your AI-crawler policy in robots.txt with explicit User-agent rules.
Result: Verified (https://prisma.io/robots.txt -> 200)
robots.txt declares Content-Signal AI-usage preferences SHOULD BROKEN
Goal: Declare Content-Signal AI-usage preferences in robots.txt.
Result: Present but broken (https://prisma.io/robots.txt -> 200 (body no match /^\s*Content-Signal:\s*(ai-train|search|ai-input)/))
Fix: Add `Content-Signal` directives to `robots.txt` (contentsignals.org): `ai-train`, `search`, and `ai-input` set to `yes` or `no`. They express usage preferences at a finer grain than a blanket allow/deny.
Resources: contentsignals.org · Fix skill
API
0 / 0No checks in this category apply to this site.
An OpenAPI description is published MUST N/A
Goal: Publish an OpenAPI description so non-MCP agents can call your HTTP API.
Result: Not applicable (no API surface detected)
Resources: OpenAPI 3.1 · Fix skill
Referenced JSON Schemas resolve as application/schema+json MAY N/A
Goal: Serve the JSON Schemas your API references so agents can validate payloads pre-flight.
Result: Not applicable (no JSON Schema references detected)
Resources: JSON Schema · Fix skill
MCP
1 / 8initialize handshake returns serverInfo + protocolVersion MUST BROKEN
Goal: Answer JSON-RPC initialize with serverInfo and protocolVersion so clients can begin a session.
Result: Present but broken (no serverInfo in initialize result)
Fix: Answer the JSON-RPC `initialize` method on your MCP endpoint with a `result` that carries `serverInfo` (an object with `name` and `version`) and `protocolVersion`. Accept `POST` with `Content-Type: application/json` and `Accept: application/json, text/event-stream`, and echo the negotiated `protocolVersion` (the current pinned value is `2025-06-18`).
Resources: MCP lifecycle · Fix skill
GET on the MCP endpoint answers fast (not a held-open hang) SHOULD PASS
Goal: Answer GET on the MCP endpoint fast (a fast-fail status or a documented surface), never a held-open hang.
Result: Verified (https://mcp.prisma.io/mcp -> 401)
Resources: MCP transports · Fix skill
tools/list returns a tools array with input schemas MUST BROKEN
Goal: Return tools/list entries with name, description, and a JSON inputSchema.
Result: Present but broken (no tools array)
Fix: Return `result.tools` as an array from the `tools/list` method. Each tool needs a `name`, a `description`, and a JSON Schema `inputSchema` so an agent can validate arguments before calling. A tool without an `inputSchema` forces the agent to guess argument shapes.
CORS preflight (OPTIONS) succeeds with Access-Control-Allow-* headers SHOULD MISSING
Goal: Answer OPTIONS preflights on the MCP endpoint with Access-Control-Allow-* headers.
Result: Not found (401 allow-origin absent)
Fix: Answer the `OPTIONS` preflight on your MCP endpoint with `204` (or `200`) and the `Access-Control-Allow-Origin`, `Access-Control-Allow-Methods`, and `Access-Control-Allow-Headers` response headers, so a browser-origin agent can call the endpoint. If your MCP surface is deliberately server-to-agent only (no browser clients), this SHOULD is a considered choice, not a defect.
Resources: MDN CORS preflight · Fix skill
Root HTML exposes WebMCP browser tools MAY N/A
Goal: Expose page tools to browser agents via WebMCP.
Result: Not implemented, optional (https://prisma.io/ -> 200 (no WebMCP markers in root HTML))
Resources: WebMCP spec · Fix skill
unknown JSON-RPC method returns -32601 SHOULD BROKEN
Goal: Reject unknown JSON-RPC methods with error -32601 instead of a hang or 500.
Result: Present but broken (error code null)
Fix: Reject an unknown JSON-RPC method with the standard error code `-32601` (Method not found), not a hang, a 500, or a silent empty body. Agents rely on `-32601` to distinguish "unsupported" from "failed"; anything else looks like an outage.
Resources: JSON-RPC 2.0 · Fix skill
POST response carries Access-Control-Allow-Origin SHOULD MISSING
Goal: Echo Access-Control-Allow-Origin on the actual MCP POST response.
Result: Not found (allow-origin absent)
Fix: Echo `Access-Control-Allow-Origin` on the actual `POST` response, not only on the preflight. A browser blocks the response body when the header is absent even if the preflight passed. Omit it deliberately only if browser-origin agents are not a supported client.
initialize advertises capabilities (tools / resources / prompts) SHOULD BROKEN
Goal: Advertise the capability groups your MCP server implements in the initialize result.
Result: Present but broken (no serverInfo in initialize result)
Fix: Populate the `capabilities` object in your `initialize` result. Clients gate feature use on it: an empty or missing `capabilities` tells a client nothing is available, so it will not call `tools/list`, `resources/list`, or `prompts/list`. Advertise the groups your server actually implements (for example `{ "tools": {} }`).
Resources: MCP lifecycle · Fix skill
A human/agent usage doc for the server resolves MAY N/A
Goal: Publish a one-fetch markdown usage doc for your MCP server.
Result: Not implemented, optional (https://prisma.io/mcp-skill.md -> 404 (status 404 not in [200]))
Resources: anc.dev example · Fix skill
A .well-known MCP server card is published (SEP-1649) SHOULD BROKEN
Goal: Publish an MCP server card at the canonical SEP-1649 path and 301 the legacy aliases to it.
Result: Present but broken (https://prisma.io/.well-known/mcp/server-card.json -> 200 (body matches /mcp_endpoint|serverInfo|transport|"name"/))
Fix: Publish an MCP server card at `/.well-known/mcp/server-card.json` (SEP-1649) naming the endpoint, transport, and capabilities: include `mcp_endpoint` (or `url`, or `transport.endpoint`), `serverInfo`, and the transport type. Serve the legacy pointer paths (`/.well-known/mcp`, `/.well-known/mcp.json`, `/mcp.json`) as `301` redirects to the canonical, never as duplicate inline copies.
Agent discovery & auth
1 / 1OAuth/OIDC discovery metadata published MAY N/A
Goal: Publish OAuth/OIDC discovery metadata if agents authenticate to your service.
Result: Not implemented, optional (https://prisma.io/.well-known/openid-configuration -> 404 (status 404 not in [200]))
OAuth Protected Resource Metadata published (RFC 9728) MAY N/A
Goal: Publish RFC 9728 protected-resource metadata for your authenticated MCP server.
Result: Not implemented, optional (https://prisma.io/.well-known/oauth-protected-resource -> 404 (status 404 not in [200]))
A2A Agent Card published for agent-to-agent discovery MAY N/A
Goal: Publish an A2A Agent Card for agent-to-agent discovery.
Result: Not implemented, optional (https://prisma.io/.well-known/agent-card.json -> 404 (status 404 not in [200]))
Resources: A2A protocol · Fix skill
Agent-skills discovery index published MAY PASS
Goal: Publish an agent-skills discovery index so agents can enumerate your skills.
Result: Verified (https://prisma.io/.well-known/agent-skills/index.json -> 200)
Resources: Agent Skills Discovery · Fix skill
Agent auth/registration metadata doc published MAY N/A
Goal: Publish an auth.md telling agents how to obtain credentials.
Result: Not implemented, optional (https://prisma.io/.well-known/auth.md -> 404)
Resources: anc.dev example · Fix skill
This scorecard reflects the target's public agent-facing surface at audit time. Re-run the audit from anc.dev/web-audit to refresh it, or call the audit_website MCP tool.