{ "schema": "iitr-scan/v0.5", "target": "cicap.es", "scannedAt": "2026-08-05T11:11:38.084Z", "rubricVersion": "0.6.2", "score": 86.67, "grade": "A", "establishedScore": 100, "establishedGrade": "A+", "categories": [ { "id": "identity", "title": "Verifiable identity", "weight": 0.25, "score": 66.67, "applicable": true, "checks": [ { "id": "identity.agent-card", "category": "identity", "title": "Publishes an A2A agent card", "status": "pass", "maturity": "emerging", "basis": "convention", "scoringContribution": "scored", "specUrl": "https://a2a-protocol.org/latest/specification/", "evidencePath": "/.well-known/agent-card.json", "detail": "agent card present with a name and declared capabilities" }, { "id": "identity.agent-card-signed", "category": "identity", "title": "Agent card is cryptographically verifiable (signed / DID / VC)", "status": "pass", "maturity": "emerging", "basis": "standard", "scoringContribution": "scored", "specUrl": "https://www.w3.org/TR/vc-data-model-2.0/", "evidencePath": "/.well-known/agent-card.json", "detail": "agent card carries a cryptographic signature / proof / DID binding" }, { "id": "identity.mcp-server-card", "category": "identity", "title": "Publishes an MCP server card (if it runs MCP)", "status": "fail", "maturity": "emerging", "basis": "convention", "scoringContribution": "scored", "specUrl": "https://modelcontextprotocol.io/", "evidencePath": "/.well-known/mcp/server-card.json", "detail": "no MCP server card published", "fixPrompt": "If you run an MCP server, advertise it at https:///.well-known/mcp/server-card.json (Content-Type: application/json). Minimal card:\n{\n \"name\": \"\",\n \"version\": \"1.0.0\",\n \"transport\": \"streamable-http\",\n \"url\": \"https:///mcp\",\n \"tools\": [{ \"name\": \"\", \"description\": \"\" }]\n}\nVerify: `curl -s https:///.well-known/mcp/server-card.json` returns the card with a name + tools. (If you don't run MCP, skip — this check is upside-only.) Spec: https://modelcontextprotocol.io/" } ] }, { "id": "alignment", "title": "Alignment & values", "weight": 0.2, "score": 100, "applicable": true, "checks": [ { "id": "alignment.card", "category": "alignment", "title": "Publishes an alignment / values card", "status": "pass", "maturity": "emerging", "basis": "convention", "scoringContribution": "scored", "specUrl": "https://github.com/mnemom/aap", "evidencePath": "/.well-known/alignment-card.json", "detail": "alignment card declares values plus scope/refusals" }, { "id": "alignment.capabilities", "category": "alignment", "title": "Declared capabilities are present and coherent", "status": "pass", "maturity": "emerging", "basis": "convention", "scoringContribution": "scored", "specUrl": "https://a2a-protocol.org/latest/specification/", "evidencePath": "/.well-known/agent-card.json", "detail": "agent card enumerates concrete capabilities/skills" } ] }, { "id": "attestation", "title": "Attestation & provenance", "weight": 0.2, "score": 75, "applicable": true, "checks": [ { "id": "attestation.signed", "category": "attestation", "title": "Publishes signed attestations / verifiable credentials", "status": "pass", "maturity": "emerging", "basis": "standard", "scoringContribution": "scored", "specUrl": "https://www.w3.org/TR/vc-data-model-2.0/", "evidencePath": "/.well-known/attestations.json", "detail": "publishes signed attestations / verifiable credentials" }, { "id": "attestation.provenance", "category": "attestation", "title": "Build / behaviour provenance (Sigstore / SLSA)", "status": "partial", "maturity": "emerging", "basis": "standard", "scoringContribution": "scored", "specUrl": "https://slsa.dev/", "evidencePath": "/.well-known/provenance.json", "detail": "provenance statement present but not signed/enveloped", "fixPrompt": "Publish https:///.well-known/provenance.json (application/json) — a SLSA/in-toto statement, ideally Sigstore/DSSE-signed. Recognized: a `predicateType`+`predicate` (in-toto) or a `dsseEnvelope`, plus `dsseEnvelope`/`signatures` to be a PASS (unsigned = partial). Example:\n{\n \"_type\": \"https://in-toto.io/Statement/v1\",\n \"predicateType\": \"https://slsa.dev/provenance/v1\",\n \"predicate\": { \"buildDefinition\": { /* … */ } },\n \"dsseEnvelope\": { \"payload\": \"\", \"signatures\": [{ \"sig\": \"\" }] }\n}\nGenerate with `slsa-generator` or `cosign attest`. Verify: `curl -s …/provenance.json` shows the predicate + a signature/DSSE envelope. Spec: https://slsa.dev/" } ] }, { "id": "accountability", "title": "Accountability", "weight": 0.2, "score": 100, "applicable": true, "checks": [ { "id": "accountability.security-txt", "category": "accountability", "title": "Serves security.txt", "status": "pass", "maturity": "established", "basis": "standard", "scoringContribution": "scored", "specUrl": "https://www.rfc-editor.org/rfc/rfc9116", "evidencePath": "/.well-known/security.txt", "detail": "security.txt served with Contact and Expires" }, { "id": "accountability.status", "category": "accountability", "title": "Publishes a dated, signed re-verification status", "status": "pass", "maturity": "emerging", "basis": "convention", "scoringContribution": "scored", "specUrl": "https://www.mnemom.ai/for-agents/", "evidencePath": "/agent-readiness-status.json", "detail": "publishes a dated, machine-readable verification status" }, { "id": "accountability.advisories", "category": "accountability", "title": "Publishes advisories / a STIX IoC feed", "status": "pass", "maturity": "emerging", "basis": "standard", "scoringContribution": "scored", "specUrl": "https://oasis-open.github.io/cti-documentation/stix/intro", "evidencePath": "/.well-known/advisories.json", "detail": "STIX bundle published (0 objects)" } ] }, { "id": "delegation", "title": "Delegation & auth", "weight": 0.15, "score": 100, "applicable": true, "checks": [ { "id": "delegation.protected-resource", "category": "delegation", "title": "OAuth protected-resource metadata", "status": "na", "maturity": "established", "basis": "standard", "scoringContribution": "scored", "specUrl": "https://www.rfc-editor.org/rfc/rfc9728", "evidencePath": "/.well-known/oauth-protected-resource", "detail": "not applicable — service declares no delegated/OAuth authorization" }, { "id": "delegation.auth-server", "category": "delegation", "title": "OAuth authorization-server metadata", "status": "na", "maturity": "established", "basis": "standard", "scoringContribution": "scored", "specUrl": "https://www.rfc-editor.org/rfc/rfc8414", "evidencePath": "/.well-known/oauth-authorization-server", "detail": "not applicable — service declares no delegated/OAuth authorization" }, { "id": "delegation.auth-doc", "category": "delegation", "title": "Documents agent authentication", "status": "pass", "maturity": "emerging", "basis": "convention", "scoringContribution": "scored", "specUrl": "https://github.com/workos/auth.md", "evidencePath": "/auth.md", "detail": "publishes a substantive agent authentication guide" } ] } ], "access": { "axis": "access", "version": "0.6.2", "score": 100, "grade": "A+", "establishedScore": 100, "establishedGrade": "A+", "applicable": true, "categories": [ { "id": "crawl-discoverability", "title": "Crawl discoverability", "weight": 0.25, "score": 100, "applicable": true, "checks": [ { "id": "access.robots_present", "category": "crawl-discoverability", "title": "Serves a parseable robots.txt", "status": "pass", "maturity": "established", "basis": "standard", "scoringContribution": "floor", "specUrl": "https://www.rfc-editor.org/rfc/rfc9309.html", "evidencePath": "/robots.txt", "detail": "serves a parseable robots.txt" }, { "id": "access.sitemap", "category": "crawl-discoverability", "title": "Publishes a sitemap", "status": "pass", "maturity": "established", "basis": "standard", "scoringContribution": "floor", "specUrl": "https://www.sitemaps.org/protocol.html", "evidencePath": "/sitemap.xml", "detail": "serves a sitemap (valid XML / sitemap index)" }, { "id": "access.link_headers", "category": "crawl-discoverability", "title": "Emits HTTP Link relations", "status": "pass", "maturity": "established", "basis": "standard", "scoringContribution": "floor", "specUrl": "https://www.rfc-editor.org/rfc/rfc8288.html", "evidencePath": "/", "detail": "emits 3 HTTP Link relation(s)" } ] }, { "id": "content-access", "title": "Agent content access", "weight": 0.2, "score": 100, "applicable": true, "checks": [ { "id": "access.markdown_negotiation", "category": "content-access", "title": "Serves markdown via content negotiation", "status": "fail", "maturity": "emerging", "basis": "convention", "scoringContribution": "upside-only", "specUrl": "https://blog.cloudflare.com/agent-readiness/", "evidencePath": "/ [Accept: text/markdown]", "detail": "Accept: text/markdown returns HTML, not markdown", "fixPrompt": "Make your homepage content-negotiate Markdown: when a request sends `Accept: text/markdown`, return the page AS Markdown with `Content-Type: text/markdown` (agents read it with ~80% fewer tokens than HTML). Implement at your edge/server (check the Accept header → serve a .md rendering). Verify: `curl -s -H 'Accept: text/markdown' https:/// -D - | grep -i content-type` shows text/markdown and the body is Markdown, not HTML. Spec: https://blog.cloudflare.com/agent-readiness/" }, { "id": "access.llms_txt", "category": "content-access", "title": "Publishes an llms.txt index", "status": "pass", "maturity": "emerging", "basis": "convention", "scoringContribution": "upside-only", "specUrl": "https://llmstxt.org/", "evidencePath": "/llms.txt", "detail": "publishes /llms.txt with an H1 title" }, { "id": "access.structured_data", "category": "content-access", "title": "Embeds structured data (JSON-LD / OpenGraph)", "status": "pass", "maturity": "established", "basis": "standard", "scoringContribution": "floor", "specUrl": "https://schema.org/", "evidencePath": "/", "detail": "embeds schema.org JSON-LD (LocalBusiness, Organization, WebSite)" } ] }, { "id": "ai-access-policy", "title": "AI access policy", "weight": 0.15, "score": 100, "applicable": true, "checks": [ { "id": "access.ai_bot_rules", "category": "ai-access-policy", "title": "Declares explicit AI-bot rules", "status": "pass", "maturity": "established", "basis": "standard", "scoringContribution": "floor", "specUrl": "https://www.rfc-editor.org/rfc/rfc9309.html", "evidencePath": "/robots.txt", "detail": "declares explicit rules for 11 known AI crawler(s): amazonbot, bytespider, ccbot, chatgpt-user, claude-web, claudebot, diffbot, facebookbot, google-extended, gptbot, perplexitybot" }, { "id": "access.content_signals", "category": "ai-access-policy", "title": "Publishes Content Signals", "status": "pass", "maturity": "emerging", "basis": "convention", "scoringContribution": "upside-only", "specUrl": "https://contentsignals.org/", "evidencePath": "/robots.txt", "detail": "publishes Content Signals (ai-train / ai-input / search)" } ] }, { "id": "capability-discovery", "title": "Capability discovery", "weight": 0.25, "score": 100, "applicable": true, "checks": [ { "id": "access.api_catalog", "category": "capability-discovery", "title": "Publishes an API catalog", "status": "pass", "maturity": "established", "basis": "standard", "scoringContribution": "floor", "specUrl": "https://www.rfc-editor.org/rfc/rfc9727.html", "evidencePath": "/.well-known/api-catalog", "detail": "publishes an RFC 9727 API catalog (linkset+json) with ≥1 link" }, { "id": "access.openapi", "category": "capability-discovery", "title": "Publishes an OpenAPI document", "status": "pass", "maturity": "established", "basis": "standard", "scoringContribution": "floor", "specUrl": "https://spec.openapis.org/oas/latest.html", "evidencePath": "/openapi.json", "detail": "publishes a discoverable OpenAPI document (v3.1.0) at https://cicap.es/openapi.json" }, { "id": "access.mcp_server_card", "category": "capability-discovery", "title": "Publishes an MCP server card", "status": "fail", "maturity": "emerging", "basis": "convention", "scoringContribution": "upside-only", "specUrl": "https://modelcontextprotocol.io/", "evidencePath": "/.well-known/mcp/server-card.json", "detail": "no MCP server card published", "fixPrompt": "If you run an MCP server, advertise it at https:///.well-known/mcp/server-card.json (application/json) with transport, url, and tools so agents can connect:\n{\n \"name\": \"\",\n \"transport\": \"streamable-http\",\n \"url\": \"https:///mcp\",\n \"tools\": [{ \"name\": \"\", \"description\": \"\" }]\n}\nVerify: `curl -s https:///.well-known/mcp/server-card.json` returns the card. (Upside-only — skip if you don't run MCP.) Spec: https://modelcontextprotocol.io/" }, { "id": "access.agent_entrypoint", "category": "capability-discovery", "title": "Foregrounds the primary agent channel (agents.txt → MCP)", "status": "partial", "maturity": "emerging", "basis": "convention", "scoringContribution": "upside-only", "specUrl": "https://llmstxt.org/", "evidencePath": "/agents.txt", "detail": "/agents.txt is served but neither it nor /llms.txt references the MCP endpoint — an arriving agent isn't pointed at the primary channel", "fixPrompt": "Publish a real text/plain https:///agents.txt (an agent-facing companion to robots.txt) that points arriving agents at your primary programmatic channel — reference your MCP endpoint URL (or the /.well-known/mcp/ server card), or surface it from /llms.txt, so an agent hitting the convention path finds the channel without guessing. Example (agents.txt):\n# agents.txt — \n## Use this service\nMCP (preferred): https:///mcp (streamable-http)\n first call: ({ ... })\n server card: https:///.well-known/mcp/server-card.json\nVerify: `curl -s https:///agents.txt` (or /llms.txt) references your /mcp endpoint or MCP server card. (Upside-only — never lowers your score.) Spec: https://llmstxt.org/ + https://modelcontextprotocol.io/" }, { "id": "access.dns_aid", "category": "capability-discovery", "title": "DNS-AID agent discovery (DNSSEC-validated)", "status": "fail", "maturity": "emerging", "basis": "convention", "scoringContribution": "upside-only", "specUrl": "https://datatracker.ietf.org/doc/draft-mozleywilliams-dnsop-dnsaid/", "evidencePath": "_index._agents", "detail": "no DNS-AID ServiceMode SVCB/HTTPS record (_index._agents, _a2a._agents, or _mcp._agents)", "fixPrompt": "Publish a DNS-AID ServiceMode SVCB record (RFC 9460) at _index._agents. (and/or _a2a._agents, _mcp._agents) pointing agents at your endpoints, then sign the zone with DNSSEC (resolver AD=true) so it's tamper-evident. Example zone record:\n_index._agents.. 3600 IN SVCB 1 . (\n alpn=\"h2\" port=443\n)\nEnable DNSSEC at your DNS provider. Verify: `dig +dnssec SVCB _index._agents.` returns the SVCB record with the AD flag set. Spec: https://datatracker.ietf.org/doc/draft-mozleywilliams-dnsop-dnsaid/" } ] }, { "id": "authorization-discovery", "title": "Authorization discovery", "weight": 0.15, "score": 0, "applicable": false, "checks": [ { "id": "access.oauth_protected_resource", "category": "authorization-discovery", "title": "OAuth protected-resource metadata", "status": "na", "maturity": "established", "basis": "standard", "scoringContribution": "floor", "specUrl": "https://www.rfc-editor.org/rfc/rfc9728", "evidencePath": "/.well-known/oauth-protected-resource", "detail": "not applicable — service declares no delegated/OAuth authorization" }, { "id": "access.oauth_as_metadata", "category": "authorization-discovery", "title": "OAuth authorization-server metadata", "status": "na", "maturity": "established", "basis": "standard", "scoringContribution": "floor", "specUrl": "https://www.rfc-editor.org/rfc/rfc8414", "evidencePath": "/.well-known/oauth-authorization-server", "detail": "not applicable — service declares no delegated/OAuth authorization" } ] }, { "id": "mcp-protocol-hygiene", "title": "Protocol hygiene", "weight": 0.35, "score": 0, "applicable": false, "checks": [] }, { "id": "mcp-discoverability", "title": "Discoverability", "weight": 0.4, "score": 0, "applicable": false, "checks": [] }, { "id": "mcp-breadth", "title": "Breadth of publishing", "weight": 0.25, "score": 0, "applicable": false, "checks": [] } ] }, "mcp": { "axis": "mcp", "version": "0.6.2", "score": 0, "grade": "F", "establishedScore": 0, "establishedGrade": "F", "applicable": false, "categories": [ { "id": "mcp-tool-schema-quality", "title": "Tool & schema quality", "weight": 0.4, "score": 0, "applicable": false, "checks": [] }, { "id": "mcp-annotations", "title": "Annotations", "weight": 0.3, "score": 0, "applicable": false, "checks": [] }, { "id": "mcp-metadata", "title": "Server metadata", "weight": 0.3, "score": 0, "applicable": false, "checks": [] } ] }, "composite": { "score": 91.67, "grade": "A+" }, "percentileContext": { "betterThanPct": 97, "sampleSize": 126, "computedAt": "2026-08-05T11:11:38.084Z" }, "verification": { "alg": "Ed25519", "kid": "94502b2b7235c986", "jwks": "https://api.isittrustready.ai/jwk", "canonicalization": "Remove fields [signature, cached, permalink, verification] if present; serialize the rest as deterministic JSON (object keys sorted by UTF-16 code unit, undefined dropped, arrays in order, primitives via standard JSON.stringify — RFC 8785 JCS-equivalent for this value space); UTF-8 encode; Ed25519-verify the base64 signature.value against the jwks key selected by kid." }, "signature": { "alg": "Ed25519", "publicKeyId": "94502b2b7235c986", "value": "5A2TMz7wbKsw6J/DhHfb/nSe3OWh+4WnoqSI2tCb0TCg8CsDIy61gRtzANnkahMpo0RgDBQqMa+oVZ62r2IpAw==", "signedAt": "2026-08-05T11:11:38.228Z" }, "permalink": "https://api.isittrustready.ai/r/cicap.es/7ba23c45dc9da2ee" }