AI readiness for API-first and agent-facing products

An agent found your product and could not work out how to call it.

P1E2P4P2M3M4C2

The moment

Yusuf, who sells a document-parsing API

An autonomous agent is assembling a workflow and needs a parsing step: it needs to discover an endpoint, understand auth, and know the price per call before it commits.

What the agent needs: Where is the API described, how do I authenticate, and what does a call cost.

What actually happens: The OpenAPI file exists but is only linked from a docs page behind a tab, there is no API catalogue at the well-known location, auth is described in prose, and pricing is per-seat marketing copy. The agent picks a competitor with a discoverable spec.

Which dimensions decide it, and why

AIScan grades five dimensions. These are the ones that carry the outcome for this kind of business.

Capabilities

This is the dimension the whole business rests on. An API catalogue at the well-known path (P1), a machine-readable description (E2), OAuth discovery metadata (P4) and an MCP server card (P2) are the four files that make a product callable rather than merely documented.

Commerce

Usage pricing has to be readable per unit. An agent budgeting a workflow needs a number; x402-style payment signalling is the emerging way to state it at the protocol level.

Content

Even here the marketing surface matters: llms.txt and a clear, server-rendered overview are how the product is identified before any spec is fetched.

The checks that matter here

Fix guides: /docs/checks/capabilities · /docs/checks/commerce · /docs/api · /docs/mcp

Most sites like this run on Next.js — read the Next.js playbook for where each fix lives.

Questions we get asked

What exactly is an API catalogue?

A small linkset at /.well-known/api-catalog, defined by RFC 9727, pointing at your API descriptions. It is the standards-shaped answer to 'what can this domain do', and check P1 grades it.

Is an MCP server worth building?

If your API is something an assistant would call on a user's behalf, it is currently the shortest path to being used inside one. The server card (P2) is how it gets discovered.

Why does OAuth discovery matter?

Because an agent that cannot discover your authorisation server cannot complete a connection without a human copying keys. P4 grades that metadata.

Should per-call pricing be machine-readable?

Yes. An agent choosing between two providers is doing arithmetic, and a provider with no readable unit price loses to one with a number.

What is x402?

A payment-required signalling pattern for machine clients. It is a bonus check (M3) — early, optional, and where agentic commerce is heading.

Where do we start?

Publish the OpenAPI file at a stable URL, add the API catalogue, then scan and check P1, E2 and P4 together.

Scan your site and see where you actually stand

Free, no account, about twenty seconds. The report names every failing check by ID, shows the evidence we found, and gives the fix for your platform — plus a hand-off prompt you can paste straight into Claude Code or Cursor.

Run a free scan npx aiscan-cli yoursite.com

Prefer to read first? Browse every check we run or the guide library.

Next in Software & agenciesAI readiness for web design and development studios

Also covers: api product, api first, developer platform, openapi, rest api, graphql api, webhooks, integration platform, data provider, machine learning api, payments api, usage based pricing, agent tools, automation platform, ipaas, service catalog, oauth.