Scoring & Levels
The 5-level maturity scale, A–F letter grades, the five dimensions, and how points are calculated.
Overall score
Each scan produces a single number between 0 and 100 — the sum of points earned across every applicable check, divided by the maximum points possible for your site profile, rounded to the nearest integer.
Checks marked na (not applicable) are removed from both the numerator and the denominator so they neither help nor hurt your score. Checks marked info or optional can earn bonus points but cannot drag the score down.
Letter grades
The letter grade is a one-glance summary of the score:
| Score | Grade | Meaning |
|---|---|---|
| 90–100 | A | Agent-native — agents can read, query, and act. |
| 75–89 | B | Readable — strong content and bot hygiene. |
| 60–74 | C | Indexable — agents can find and parse the site. |
| 40–59 | D | Crawlable — basic web hygiene only. |
| 0–39 | F | Invisible — agents can't reliably use the site. |
Maturity levels
The five-level scale describes what an agent can actually do with your site:
- Level 0 — Invisible. Robots are blocked, no sitemap, no structured HTML. Agents skip the site.
- Level 1 — Crawlable. Agents can fetch pages but get raw HTML with no useful signals.
- Level 2 — Indexable. Sitemap, valid title/meta, single H1. Agents can index pages.
- Level 3 — Readable. Clean markdown content negotiation, explicit AI bot rules, JSON-LD. Agents understand the content.
- Level 4 — Discoverable APIs. An API catalog and/or MCP server card means agents know what programmatic actions are available.
- Level 5 — Agent-Native. MCP server, Agent Skills, OAuth discovery, agentic checkout (where relevant). Agents can act on a user's behalf.
The five dimensions
Every check belongs to exactly one dimension. Each dimension answers a different question.
Discoverability
Can agents find your pages? Covers robots.txt, sitemap.xml, and HTTP Link headers pointing at discovery resources. Read the Discoverability checks for the exact probes.
Content
Can agents read your content cleanly? Markdown content negotiation, /llms.txt, structured HTML with title, meta description, single H1, and JSON-LD. The Content checks explain how each signal is measured.
Bot Access
Are AI crawlers explicitly allowed or blocked? Explicit rules for GPTBot, ClaudeBot, PerplexityBot, Google-Extended; emerging signals like Cloudflare's Content-Signal directive and Web Bot Auth. See the Bot Access checks for the crawler policy details.
Capabilities
Can agents do things? Discoverable APIs via /.well-known/api-catalog, MCP server cards, Agent Skills bundles, and OAuth 2.0 protected-resource metadata. The Capabilities checks cover these machine-readable endpoints.
Commerce
Can agents transact? Product feeds, structured product data, agentic checkout endpoints. Only weighted when AIScan detects an e-commerce site. Read the Commerce checks for catalogue and transactional site scoring.
Weights & site profiles
Different sites have different obligations. A WordPress blog doesn't need to expose an MCP server; a SaaS dashboard doesn't need a product feed. AIScan adjusts each dimension's weight based on a detected profile:
| Profile | Disc. | Content | Bot | Caps. | Commerce |
|---|---|---|---|---|---|
| Default content site | 1.0 | 1.0 | 1.0 | 1.0 | 0 |
| WordPress | 1.0 | 1.2 | 1.0 | 0.6 | 0 |
| Shopify (e-commerce) | 1.0 | 0.6 | 1.0 | 0.8 | 1.2 |
| SPA / app | 0.6 | 0.5 | 0.8 | 1.2 | 0 |
If you sell physical or digital goods, the Commerce dimension switches on regardless of platform.
Check statuses
- pass — full points.
- partial — some signal present; partial credit.
- fail — zero points; the remediation tells you what to add.
- na — removed from the denominator.
- info — informational; cannot lower the score.
Essential, recommended, bonus
Every graded check carries a tier so you can tell a baseline requirement from an emerging signal:
- Essential — the baseline any public site should meet: reachable robots.txt, a sitemap, HTTPS on a single canonical host, a real 404, server-rendered headings and copy.
- Recommended — well-supported signals most sites benefit from: structured data, an llms.txt, an OpenAPI description where an API exists, a content feed.
- Bonus — emerging or optional standards (MCP endpoints, agent skills, x402 payments). These can only add points; not having them never lowers your score.
Evidence & citations
No check is a black box. Expanding a result shows the exact evidence it was based on — the URL fetched, the HTTP status, the content type, the byte count, or the parsed body excerpt — plus links to the published standards the check is measured against (for example RFC 9309 for robots.txt, RFC 9727 for API catalogs, RFC 9457 for error payloads, and the sitemaps.org and schema.org specifications). When a check doesn't apply we say why in plain language instead of silently hiding it.
Limitations
- We fetch pages as an HTTP client and do not execute JavaScript, so client-only content is invisible to us — deliberately, because most crawling agents behave the same way.
- We scan one URL per run (the homepage, or a specific page in a page scan). We infer site-wide behaviour from that page plus well-known files, not from a full crawl.
- Results are cached briefly; add
?fresh=1to force a new fetch. - Standards in this space move quickly. Weights and checks change; the changelog records every rubric change, and the about page explains how AIScan versions the rubric and what the scanner deliberately does not measure.