# Vercel — Agent-Readiness Audit

Website: [https://vercel.com/](https://vercel.com/)

**Score:** 74% (relative to the checks that apply to this site)
**Global:** 34% of a maximally agent-ready site

## Discoverability (2/4)

### PASS — /robots.txt present

- Tier: SHOULD
- Goal: Publish robots.txt and state your crawl policy explicitly.
- Result: Verified (https://vercel.com/robots.txt -> 200)
- Resources: [RFC 9309](https://www.rfc-editor.org/rfc/rfc9309), [Fix skill](https://www.anc.dev/web-audit/skill/robots)

### PASS — /sitemap.xml present

- Tier: MAY
- Goal: Publish sitemap.xml so agents can enumerate your content URLs.
- Result: Verified (https://vercel.com/sitemap.xml -> 200)
- Resources: [sitemaps.org](https://www.sitemaps.org/protocol.html), [Fix skill](https://www.anc.dev/web-audit/skill/sitemap)

### MISSING — Homepage sends RFC 8288 Link headers pointing at agent resources

- Tier: SHOULD
- Goal: Advertise machine surfaces in a Link response header on / for header-only discovery.
- Result: Not found (https://vercel.com/ -> 200 (header link no match /rel="?(service-desc|describedby|api-catalog|service-doc)"?/))
- Fix: Send a `Link` response header on `/` (RFC 8288) whose `rel` points at your machine surfaces, so an agent reading only response headers finds them without parsing HTML or probing `/.well-known`. Use the RFC 8631 service trio and the RFC 9727 catalog: `rel="service-desc"` at a machine-readable description (OpenAPI, or an MCP server card), `rel="service-doc"` at the human-readable doc, `rel="service-meta"` at the service-context declaration, and `rel="api-catalog"` at your `/.well-known/api-catalog` index. Example: `Link: </.well-known/api-catalog>; rel="api-catalog", </.well-known/mcp/server-card.json>; rel="service-desc"`.
- Resources: [RFC 8288 (Link)](https://www.rfc-editor.org/rfc/rfc8288), [RFC 8631 (service links)](https://www.rfc-editor.org/rfc/rfc8631), [RFC 9727 (api-catalog)](https://www.rfc-editor.org/rfc/rfc9727), [Fix skill](https://www.anc.dev/web-audit/skill/link-headers)

```text
Goal: Advertise machine surfaces in a Link response header on / for header-only discovery
Issue: https://vercel.com/ -> 200 (header link no match /rel="?(service-desc|describedby|api-catalog|service-doc)"?/)
Fix: Send a `Link` response header on `/` (RFC 8288) whose `rel` points at your machine surfaces, so an agent reading only response headers finds them without parsing HTML or probing `/.well-known`. Use the RFC 8631 service trio and the RFC 9727 catalog: `rel="service-desc"` at a machine-readable description (OpenAPI, or an MCP server card), `rel="service-doc"` at the human-readable doc, `rel="service-meta"` at the service-context declaration, and `rel="api-catalog"` at your `/.well-known/api-catalog` index. Example: `Link: </.well-known/api-catalog>; rel="api-catalog", </.well-known/mcp/server-card.json>; rel="service-desc"`.
Skill: https://www.anc.dev/web-audit/skill/link-headers
Docs: https://www.rfc-editor.org/rfc/rfc8288, https://www.rfc-editor.org/rfc/rfc8631, https://www.rfc-editor.org/rfc/rfc9727
```

### MISSING — Root HTML links to machine surfaces via <link rel>

- Tier: SHOULD
- Goal: Point link rel elements at your machine surfaces from the root HTML head.
- Result: Not found (https://vercel.com/ -> 200 (body no match /rel=["'](service-desc|service-doc|alternate)["']/))
- Fix: Add `<link rel>` elements in your root HTML head pointing at your machine surfaces: `rel="service-desc"` to the OpenAPI doc, `rel="service-doc"` to human docs, and `rel="alternate"` to `llms.txt` and the MCP card. An agent that lands on the HTML can then discover the structured surfaces without scraping.
- Resources: [RFC 8631 (service-desc/doc)](https://www.rfc-editor.org/rfc/rfc8631), [Fix skill](https://www.anc.dev/web-audit/skill/root-link-rel)

```text
Goal: Point link rel elements at your machine surfaces from the root HTML head
Issue: https://vercel.com/ -> 200 (body no match /rel=["'](service-desc|service-doc|alternate)["']/)
Fix: Add `<link rel>` elements in your root HTML head pointing at your machine surfaces: `rel="service-desc"` to the OpenAPI doc, `rel="service-doc"` to human docs, and `rel="alternate"` to `llms.txt` and the MCP card. An agent that lands on the HTML can then discover the structured surfaces without scraping.
Skill: https://www.anc.dev/web-audit/skill/root-link-rel
Docs: https://www.rfc-editor.org/rfc/rfc8631
```

### N/A — DNS for AI Discovery (DNS-AID) records under _agents (IETF draft)

- Tier: MAY
- Goal: Publish DNSSEC-signed SVCB records under _agents for DNS-level agent discovery.
- Result: Not implemented, optional (no DNS-AID records)
- Resources: [DNS-AID draft](https://datatracker.ietf.org/doc/draft-mozleywilliams-dnsop-dnsaid/), [Fix skill](https://www.anc.dev/web-audit/skill/dns-aid)

## Content for agents (7/9)

### PASS — /llms.txt present with a summary and link index

- Tier: SHOULD
- Goal: Serve /llms.txt with a title, summary, and categorized link index.
- Result: Verified (https://vercel.com/llms.txt -> 200)
- Resources: [llmstxt.org](https://llmstxt.org/), [Fix skill](https://www.anc.dev/web-audit/skill/llms-txt)

### PASS — /llms-full.txt present (single-fetch full corpus)

- Tier: MAY
- Goal: Serve the whole docs corpus as markdown at /llms-full.txt for one-fetch ingestion.
- Result: Verified (https://vercel.com/llms-full.txt -> 200)
- Resources: [llmstxt.org](https://llmstxt.org/), [Fix skill](https://www.anc.dev/web-audit/skill/llms-full-txt)

### PASS — Root HTML has a descriptive <meta name="description">

- Tier: SHOULD
- Goal: Add a meta description naming what the service does and its agent entry points.
- Result: Verified (https://vercel.com/ -> 200)
- Resources: [MDN meta description](https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/meta/name), [Fix skill](https://www.anc.dev/web-audit/skill/root-meta-description)

### PASS — Root HTML embeds Schema.org JSON-LD

- Tier: MAY
- Goal: Embed Schema.org JSON-LD so agents get typed facts without inference.
- Result: Verified (https://vercel.com/ -> 200)
- Resources: [Schema.org](https://schema.org/docs/gs.html), [Fix skill](https://www.anc.dev/web-audit/skill/schema-org-jsonld)

### PASS — Root HTML uses semantic landmarks

- Tier: MAY
- Goal: Use semantic landmarks so the HTML path is parseable structure, not div soup.
- Result: Verified (https://vercel.com/ -> 200)
- Resources: [MDN content sectioning](https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements#content_sectioning), [Fix skill](https://www.anc.dev/web-audit/skill/semantic-html)

### MISSING — Root HTML has a <noscript> with machine entry points

- Tier: SHOULD
- Goal: Give non-JS agents a noscript block listing your machine entry points.
- Result: Not found (https://vercel.com/ -> 200 (body no match /<noscript/))
- Fix: Add a `<noscript>` block to your root HTML that links your machine entry points: `llms.txt`, your OpenAPI or MCP endpoint, and any `.well-known` cards. It hands a fetch-only crawler or a non-JS agent a concrete, in-body list of where the structured surfaces live, so it never has to run the client bundle or infer them from the visible page.
- Resources: [MDN noscript](https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/noscript), [Fix skill](https://www.anc.dev/web-audit/skill/noscript-fallback)

```text
Goal: Give non-JS agents a noscript block listing your machine entry points
Issue: https://vercel.com/ -> 200 (body no match /<noscript/)
Fix: Add a `<noscript>` block to your root HTML that links your machine entry points: `llms.txt`, your OpenAPI or MCP endpoint, and any `.well-known` cards. It hands a fetch-only crawler or a non-JS agent a concrete, in-body list of where the structured surfaces live, so it never has to run the client bundle or infer them from the visible page.
Skill: https://www.anc.dev/web-audit/skill/noscript-fallback
Docs: https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/noscript
```

### MISSING — Accept text/markdown content negotiation returns markdown

- Tier: SHOULD
- Goal: Honor Accept text/markdown on content URLs with raw markdown, not HTML chrome.
- Result: Not found (https://vercel.com/ -> 200 (content-type "text/html; charset=utf-8" !~ /markdown|text/plain/))
- Fix: Honor `Accept: text/markdown` on content URLs and return raw markdown rather than HTML chrome. Agents parse markdown far more reliably than a JS-rendered page. Serve the markdown twin at the same URL via content negotiation, invisibly to crawlers.
- Resources: [RFC 7763 (text/markdown)](https://www.rfc-editor.org/rfc/rfc7763), [Fix skill](https://www.anc.dev/web-audit/skill/accept-markdown)

```text
Goal: Honor Accept text/markdown on content URLs with raw markdown, not HTML chrome
Issue: https://vercel.com/ -> 200 (content-type "text/html; charset=utf-8" !~ /markdown|text/plain/)
Fix: Honor `Accept: text/markdown` on content URLs and return raw markdown rather than HTML chrome. Agents parse markdown far more reliably than a JS-rendered page. Serve the markdown twin at the same URL via content negotiation, invisibly to crawlers.
Skill: https://www.anc.dev/web-audit/skill/accept-markdown
Docs: https://www.rfc-editor.org/rfc/rfc7763
```

### PASS — Per-section llms.txt files resolve under content subdirectories

- Tier: MAY
- Goal: Serve a scoped llms.txt inside each major content section.
- Result: Verified (https://vercel.com/docs/llms.txt -> 200)
- Resources: [llmstxt.org](https://llmstxt.org/), [Fix skill](https://www.anc.dev/web-audit/skill/llms-txt-scoped)

### PASS — Per-section llms-full.txt files resolve under content subdirectories

- Tier: MAY
- Goal: Serve a scoped llms-full.txt corpus inside each major content section.
- Result: Verified (https://vercel.com/docs/llms-full.txt -> 200)
- Resources: [llmstxt.org](https://llmstxt.org/), [Fix skill](https://www.anc.dev/web-audit/skill/llms-full-txt-scoped)

## Bot & crawl policy (3/3)

### PASS — robots.txt declares AI-crawler rules (RFC 9309)

- Tier: SHOULD
- Goal: State your AI-crawler policy in robots.txt with explicit User-agent rules.
- Result: Verified (https://vercel.com/robots.txt -> 200)
- Resources: [RFC 9309](https://www.rfc-editor.org/rfc/rfc9309), [Fix skill](https://www.anc.dev/web-audit/skill/robots-ai-rules)

### PASS — robots.txt declares Content-Signal AI-usage preferences

- Tier: SHOULD
- Goal: Declare Content-Signal AI-usage preferences in robots.txt.
- Result: Verified (https://vercel.com/robots.txt -> 200)
- Resources: [contentsignals.org](https://contentsignals.org/), [Fix skill](https://www.anc.dev/web-audit/skill/content-signals)

### PASS — /.well-known/security.txt present (RFC 9116)

- Tier: MAY
- Goal: Publish security.txt with a Contact and Expires field.
- Result: Verified (https://vercel.com/.well-known/security.txt -> 200)
- Resources: [RFC 9116](https://www.rfc-editor.org/rfc/rfc9116), [Fix skill](https://www.anc.dev/web-audit/skill/security-txt)

### N/A — Web Bot Auth signature directory present (informational)

- Tier: MAY
- Goal: Publish an HTTP Message Signatures directory if your site sends signed bot traffic.
- Result: Not implemented, optional (https://vercel.com/.well-known/http-message-signatures-directory -> 404 (status 404 not in [200]))
- Resources: [Web Bot Auth draft](https://datatracker.ietf.org/doc/draft-meunier-web-bot-auth-architecture/), [Fix skill](https://www.anc.dev/web-audit/skill/web-bot-auth)

## API (1/2)

### PASS — An OpenAPI description is published

- Tier: MUST
- Goal: Publish an OpenAPI description so non-MCP agents can call your HTTP API.
- Result: Verified (https://vercel.com/openapi.json -> 200)
- Resources: [OpenAPI 3.1](https://spec.openapis.org/oas/latest.html), [Fix skill](https://www.anc.dev/web-audit/skill/openapi)

### N/A — /.well-known/api-catalog published (RFC 9727)

- Tier: MAY
- Goal: Serve an RFC 9727 api-catalog linkset indexing your API descriptions.
- Result: Not implemented, optional (https://vercel.com/.well-known/api-catalog -> 404 (status 404 not in [200]))
- Resources: [RFC 9727](https://www.rfc-editor.org/rfc/rfc9727), [Fix skill](https://www.anc.dev/web-audit/skill/api-catalog)

### BROKEN — Referenced JSON Schemas resolve as application/schema+json

- Tier: MAY
- Goal: Serve the JSON Schemas your API references so agents can validate payloads pre-flight.
- Result: Present but broken (https://vercel.com/api/schema/input.json -> 404 (status 404 not in [200]))
- Fix: Serve the input and output JSON Schemas your API references (for example `/api/schema/input.json`) as `application/schema+json`. Agents validate payloads against them before calling, which turns a class of runtime failures into pre-flight validation.
- Resources: [JSON Schema](https://json-schema.org/specification), [Fix skill](https://www.anc.dev/web-audit/skill/json-schemas)

```text
Goal: Serve the JSON Schemas your API references so agents can validate payloads pre-flight
Issue: https://vercel.com/api/schema/input.json -> 404 (status 404 not in [200])
Fix: Serve the input and output JSON Schemas your API references (for example `/api/schema/input.json`) as `application/schema+json`. Agents validate payloads against them before calling, which turns a class of runtime failures into pre-flight validation.
Skill: https://www.anc.dev/web-audit/skill/json-schemas
Docs: https://json-schema.org/specification
```

## MCP (0/0)

No checks in this category apply to this site.

### N/A — initialize handshake returns serverInfo + protocolVersion

- Tier: MUST
- Goal: Answer JSON-RPC initialize with serverInfo and protocolVersion so clients can begin a session.
- Result: Not applicable (no MCP endpoint discovered)
- Resources: [MCP lifecycle](https://modelcontextprotocol.io/specification/2025-06-18/basic/lifecycle), [Fix skill](https://www.anc.dev/web-audit/skill/mcp-initialize)

### N/A — initialize advertises capabilities (tools / resources / prompts)

- Tier: SHOULD
- Goal: Advertise the capability groups your MCP server implements in the initialize result.
- Result: Not applicable (no MCP endpoint discovered)
- Resources: [MCP lifecycle](https://modelcontextprotocol.io/specification/2025-06-18/basic/lifecycle), [Fix skill](https://www.anc.dev/web-audit/skill/mcp-capabilities)

### N/A — tools/list returns a tools array with input schemas

- Tier: MUST
- Goal: Return tools/list entries with name, description, and a JSON inputSchema.
- Result: Not applicable (no MCP endpoint discovered)
- Resources: [MCP tools](https://modelcontextprotocol.io/specification/2025-06-18/server/tools), [Fix skill](https://www.anc.dev/web-audit/skill/mcp-tools-list)

### N/A — unknown JSON-RPC method returns -32601

- Tier: SHOULD
- Goal: Reject unknown JSON-RPC methods with error -32601 instead of a hang or 500.
- Result: Not applicable (no MCP endpoint discovered)
- Resources: [JSON-RPC 2.0](https://www.jsonrpc.org/specification#error_object), [Fix skill](https://www.anc.dev/web-audit/skill/mcp-unknown-method)

### N/A — GET on the MCP endpoint answers fast (not a held-open hang)

- Tier: SHOULD
- Goal: Answer GET on the MCP endpoint fast (a fast-fail status or a documented surface), never a held-open hang.
- Result: Not applicable (no MCP endpoint discovered)
- Resources: [MCP transports](https://modelcontextprotocol.io/specification/2025-06-18/basic/transports), [Fix skill](https://www.anc.dev/web-audit/skill/mcp-get-fast-fail)

### N/A — CORS preflight (OPTIONS) succeeds with Access-Control-Allow-* headers

- Tier: SHOULD
- Goal: Answer OPTIONS preflights on the MCP endpoint with Access-Control-Allow-* headers.
- Result: Not applicable (no MCP endpoint discovered)
- Resources: [MDN CORS preflight](https://developer.mozilla.org/en-US/docs/Glossary/Preflight_request), [Fix skill](https://www.anc.dev/web-audit/skill/mcp-cors-preflight)

### N/A — POST response carries Access-Control-Allow-Origin

- Tier: SHOULD
- Goal: Echo Access-Control-Allow-Origin on the actual MCP POST response.
- Result: Not applicable (no MCP endpoint discovered)
- Resources: [MDN CORS](https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CORS), [Fix skill](https://www.anc.dev/web-audit/skill/mcp-cors-actual)

### N/A — A .well-known MCP server card is published (SEP-1649)

- Tier: SHOULD
- Goal: Publish an MCP server card at the canonical SEP-1649 path and 301 the legacy aliases to it.
- Result: Not applicable (no MCP endpoint discovered)
- Resources: [SEP-1649](https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2127), [Fix skill](https://www.anc.dev/web-audit/skill/well-known-mcp-card)

### N/A — A human/agent usage doc for the server resolves

- Tier: MAY
- Goal: Publish a one-fetch markdown usage doc for your MCP server.
- Result: Not applicable (no MCP endpoint discovered)
- Resources: [anc.dev example](https://anc.dev/mcp-skill.md), [Fix skill](https://www.anc.dev/web-audit/skill/mcp-usage-doc)

### N/A — Root HTML exposes WebMCP browser tools

- Tier: MAY
- Goal: Expose page tools to browser agents via WebMCP.
- Result: Not implemented, optional (https://vercel.com/ -> 200 (no WebMCP markers in root HTML))
- Resources: [WebMCP spec](https://webmachinelearning.github.io/webmcp/), [Fix skill](https://www.anc.dev/web-audit/skill/webmcp)

## Agent discovery & auth (1/2)

### PASS — OAuth/OIDC discovery metadata published

- Tier: MAY
- Goal: Publish OAuth/OIDC discovery metadata if agents authenticate to your service.
- Result: Verified (https://vercel.com/.well-known/openid-configuration -> 200)
- Resources: [RFC 8414](https://www.rfc-editor.org/rfc/rfc8414), [Fix skill](https://www.anc.dev/web-audit/skill/oauth-discovery)

### N/A — OAuth Protected Resource Metadata published (RFC 9728)

- Tier: MAY
- Goal: Publish RFC 9728 protected-resource metadata for your authenticated MCP server.
- Result: Not applicable (MCP endpoint does not challenge for auth)
- Resources: [RFC 9728](https://www.rfc-editor.org/rfc/rfc9728), [Fix skill](https://www.anc.dev/web-audit/skill/oauth-protected-resource)

### N/A — A2A Agent Card published for agent-to-agent discovery

- Tier: MAY
- Goal: Publish an A2A Agent Card for agent-to-agent discovery.
- Result: Not implemented, optional (https://vercel.com/.well-known/agent-card.json -> 404 (status 404 not in [200]))
- Resources: [A2A protocol](https://a2a-protocol.org/latest/specification/), [Fix skill](https://www.anc.dev/web-audit/skill/a2a-agent-card)

### N/A — Agent-skills discovery index published

- Tier: MAY
- Goal: Publish an agent-skills discovery index so agents can enumerate your skills.
- Result: Not implemented, optional (https://vercel.com/.well-known/agent-skills/index.json -> 404 (status 404 not in [200]))
- Resources: [Agent Skills Discovery](https://github.com/cloudflare/agent-skills-discovery), [Fix skill](https://www.anc.dev/web-audit/skill/agent-skills)

### BROKEN — Agent auth/registration metadata doc published

- Tier: MAY
- Goal: Publish an auth.md telling agents how to obtain credentials.
- Result: Present but broken (https://vercel.com/.well-known/auth.md -> 404)
- Fix: Publish an `auth.md` at `/.well-known/auth.md` (or `/auth.md`): a short markdown guide that tells an agent how to obtain credentials, including where to register, which OAuth flows are supported, token endpoints, and scopes. It turns "figure out our auth" into a one-fetch orientation.
- Resources: [anc.dev example](https://anc.dev/auth.md), [Fix skill](https://www.anc.dev/web-audit/skill/auth-md)

```text
Goal: Publish an auth.md telling agents how to obtain credentials
Issue: https://vercel.com/.well-known/auth.md -> 404
Fix: Publish an `auth.md` at `/.well-known/auth.md` (or `/auth.md`): a short markdown guide that tells an agent how to obtain credentials, including where to register, which OAuth flows are supported, token endpoints, and scopes. It turns "figure out our auth" into a one-fetch orientation.
Skill: https://www.anc.dev/web-audit/skill/auth-md
Docs: https://anc.dev/auth.md
```

## Re-run this audit

Re-run from [anc.dev/web-audit](https://anc.dev/web-audit), or call the `audit_website` MCP tool.