Is moveon.global AI agent ready? F · 25/100

# Agent-readiness remediation brief

Site: https://moveon.global/
Platform: nextjs (99% confidence)
AIScan score: 25/100 — Level 1 (Discoverable)
Rubric: v2026.08.2

## Failing checks (sorted by weight)
- **[D1] robots.txt present & sane** — PARTIAL
  - Evidence: 200 OK, 39735 bytes
  - Fix: Serve a non-blocking /robots.txt that references your Sitemap.
- **[C2] /llms.txt** — PARTIAL
  - Evidence: 200 OK, 39731 bytes
  - Fix: Publish /llms.txt per llmstxt.org with an H1, summary, and ## sections of markdown links.
- **[B2] Explicit AI bot rules** — FAIL
  - Evidence: 0 known AI agent(s) addressed in robots.txt
  - Fix: Add explicit allow/deny rules for GPTBot, ClaudeBot, PerplexityBot, Google-Extended, etc.
- **[D2] XML sitemap** — FAIL
  - Evidence: no /sitemap.xml or /sitemap_index.xml resolved
  - Fix: Publish /sitemap.xml and reference it in robots.txt.
- **[C3] Structured HTML (title, meta, JSON-LD, single H1)** — PARTIAL
  - Evidence: h1: 0, title: true, meta description: true, JSON-LD: false
  - Fix: Ensure a single <h1>, <title>, meta description, and schema.org JSON-LD.
- **[P1] API Catalog (RFC 9727)** — FAIL
  - Evidence: 404 at /.well-known/api-catalog
  - Fix: Publish /.well-known/api-catalog linking to your OpenAPI descriptions.
- **[P4] OAuth discovery metadata** — FAIL
  - Evidence: auth-server: 404, protected-resource: 404
  - Fix: Publish RFC 8414 / RFC 9728 metadata at the /.well-known/oauth-* endpoints.
- **[E1] Correct 404 handling** — FAIL
  - Evidence: GET /aiscan-404-probe-roltud → HTTP 200 (soft 404 — returns 200 for a missing page), 39761 bytes, text/html
  - Fix: Return a real HTTP 404 (not 200) for missing pages, with a body that names the site and links to your homepage, sitemap, and search so an agent can recover.
- **[E3] Heading hierarchy & server-rendered text** — FAIL
  - Evidence: 5 words of server-rendered text, 0 <h2>, 0 <h3>
  - Fix: Server-render your main copy and break it into a real heading outline (one h1, then descriptive h2/h3 sections). Agents that don't execute JavaScript only see the HTML you ship.
- **[E4] HTTPS & canonical host** — PARTIAL
  - Evidence: final origin https://moveon.global · http:// unreachable · www.moveon.global serves its own copy (duplicate origin) · no HSTS header
  - Fix: Serve the site over HTTPS, 301-redirect http:// to https://, and redirect the www/apex variant to a single canonical host so agents don't index two copies of every URL.
- **[D3] Link header for discovery** — FAIL
  - Evidence: no Link header or <link> tag
  - Fix: Add a Link response header or HTML <link rel="api-catalog"|"describedby"> tag.
- **[E2] Machine-readable API description** — FAIL
  - Evidence: no /openapi.json, /api/openapi.json or swagger document found
  - Fix: Publish an OpenAPI 3.1 document at /openapi.json and reference it from /.well-known/api-catalog as a service-desc link.

## General guidance
- Static-first: `robots.txt`, `llms.txt`, `/.well-known/*` JSON cards.
- Markdown negotiation: serve `text/markdown` when requested via `Accept` header or `?format=md`.
- Bot access: explicit allow/deny per AI user-agent (GPTBot, ClaudeBot, PerplexityBot, Google-Extended, Applebot-Extended, Bytespider, Amazonbot, CCBot, meta-externalagent, cohere-ai, Diffbot).
- Capabilities: publish an MCP server card and (optionally) an Agent Skills manifest even if the runtime isn't live — discovery first.
- Re-scan at aiscan.site after deploying.