scanned 8/6/2026, 6:12:35 AM · cached · refresh in 23h · rubric 2026.10.4
Built with Next.js
Needs work
This is how AI agents (not browsers) experience mehmetozen.dev. The score weights five categories of machine-readability; the ticks on the arc are the 36 individual checks behind it.
Send this to whoever edits the site. The link shows the score and grade as a preview card, and it stays current: it re-reads the latest scan rather than freezing today’s number.
Top fixes
Checks tagged “emerging” are 2026 agent-protocol standards most of the web hasn’t adopted yet. Adopting early is an edge, not a defect.
warnrobots.txt allows AI agents+1 ptDiscoverability
1 access agent(s) blocked: Amazonbot. These keep your site out of AI answers. 7 training-data crawler(s) blocked (GPTBot, ClaudeBot, Google-Extended, Applebot-Extended, Bytespider, CCBot, Meta-ExternalAgent), a licensing choice, not scored.
Show me exactly what to do
What this means
robots.txt is a small text file at yoursite.com/robots.txt where you tell visiting robots what they may read. Many sites carry an old rule that blocks ALL robots, which now also blocks the AI assistants your customers ask for recommendations.
Why it matters
ChatGPT, Claude, and Perplexity each send a named crawler (GPTBot, ClaudeBot, PerplexityBot). If your robots.txt turns them away, they cannot read your pages. So when a customer asks an assistant about your product, the assistant answers from what everyone ELSE says about you, or recommends a competitor it could read.
Do this
Next.js: Allow GPTBot, ClaudeBot, and PerplexityBot in robots.txt (or remove the blanket Disallow).
Open yoursite.com/robots.txt in a browser to see what you have today.
Don’t lose this report
Get it in your inbox now, plus a heads-up whenever mehmetozen.dev’s agent-readiness score changes. Free, unsubscribe anytime.
Prefer we just watch it for you? Monitor rescans weekly and emails what changed, $29/mo. Start monitoring →
Fix it
Generated, ready-to-ship files for the gaps above. Copy them, or download and drop them into your repo.
Allow AI agents in robots.txt
Merge these groups into your robots.txt at the site root.
This scan graded one page. Your site is more than one page.
This graded your homepage. Your pricing, docs, and checkout live on other pages: the ones assistants actually quote when they recommend you. A 77/100 here means agents are already missing things on the page you polish most. The $29 Deep Scan audits the whole site against all 36 checks, then emails a PDF with every failing check and its exact fix, ranked by what costs you the most visibility. One-time, delivered in minutes, no subscription.
mozenhomeblogaboutistanbulMehmetOzenSoftware engineer. I write about building modern web apps — architecture, tooling, and the occasional opinion piece.mowritingallengalgorithmstoolscareerdesignIdempotency: the only defence against a broker that keeps its promiseengineeringjul 27Goroutines are not threads, and that's the entire pointengineeringjul 20The GIL: why Python had it, and why it's going awayengineeringjul 13Backtracking: exhaustive search with pruningalgorithmsoct 13Greedy algorithms: local choices, global optimumalgorithmsoct 06view all →thememozen · 2026istanbul
Show your score
Embed this badge on your site. It links back to this live scan and updates on every rescan.
Get this report by email, then a heads-up when mehmetozen.dev’s agent-readiness actually changes: a check regressing, or the composite dropping.
Two things never trigger an email: a score change caused by us publishing a new rubric, because that is a different instrument rather than a change to your site, and movement explained only by timing-derived checks, which shift run to run on a site nobody touched.
Want it on your own schedule, with Slack or a webhook instead of email? Score-drift monitoring is on every paid plan.
This score says whether an AI agent could read mehmetozen.dev. AI traffic analytics says whether one actually came, and which pages turned it away.
Full breakdown
19 pass2 warn11 fail4 skip
Discoverability
pass
robots.txt present
A robots.txt is reachable at the site root.
100/100
warn
robots.txt allows AI agents
1 access agent(s) blocked: Amazonbot. These keep your site out of AI answers. 7 training-data crawler(s) blocked (GPTBot, ClaudeBot, Google-Extended, Applebot-Extended, Bytespider, CCBot, Meta-ExternalAgent), a licensing choice, not scored.
89/100
pass
Content-Signal directivesemerging
Content-Signal directives are advertised, declaring fine-grained AI usage preferences.
100/100
pass
llms.txt present
Found /llms.txt but missing H1 header and markdown links. Not scored.
100/100
pass
Sitemap present
sitemap.xml reachable and referenced from robots.txt.
100/100
fail
Link response headers
No HTTP Link: response headers. Emit canonical/alternate/describedby relations so HEAD-only or stream-rendering agents get them without parsing HTML.
0/100
pass
Canonical URL
Canonical points to self: https://mehmetozen.dev/.
100/100
fail
MCP server cardemerging
No valid MCP Server Card at /.well-known/mcp/server-card.json. Publish one so agents can discover your tools without HTML scraping.
0/100
fail
OAuth authorization metadataemerging
No RFC 8414 metadata at /.well-known/oauth-authorization-server. Agents that act on behalf of users need this to discover your authorization endpoints.
0/100
fail
OAuth resource metadataemerging
No RFC 9728 metadata at /.well-known/oauth-protected-resource. Publish it so agents can discover required scopes without hand-coded credentials.
0/100
fail
API catalog / OpenAPIemerging
No /.well-known/api-catalog (RFC 9727) and no /openapi.json|yaml. Publish one so agents that integrate with APIs can discover your endpoints.
0/100
fail
Web Bot Authemerging
No Web Bot Auth JWKS at /.well-known/http-message-signatures-directory.json. Publish one to allow trusted agents while keeping a default-deny posture for the rest.
0/100
Readability
fail
Markdown negotiationemerging
Accept: text/markdown returns HTML, not markdown. Serve a markdown variant of primary content when requested; agents summarize and cite it more reliably.
0/100
fail
Text-to-markup ratio
Visible text is 1.0% of HTML weight (584/61443 bytes). 80% of the document is inline script, 19% is markup.
7/100
pass
Content without JavaScript
Primary content is present in the initial HTML — agents without JS can read it. (Measured statically; a rendered comparison was not run because the static reading sufficed.)
90/100
pass
Heading hierarchy
Hierarchy is well-formed (1 H1, no skipped levels, 1 headings total).
100/100
pass
Cookie wall blocks content
No common consent-modal markers detected.
100/100
pass
Declared language
Declared lang="en".
100/100
pass
Page title
A concise <title> is present (31 chars).
100/100
pass
Meta description
A well-sized meta description is present (146 chars).
Page intent unclear; no specific schema.org type expected.
100/100
Coherence: do your channels agree?
skip
JSON-LD price matches the visible priceemerging
No price declared in JSON-LD, so there is nothing to cross-check. (Whether a price SHOULD be declared is the structured-data checks’ question.)
—
fail
JSON-LD name appears on the pageemerging
JSON-LD names "Independent" appear nowhere in the page title or visible text. Stale structured data after a rename, or machine-only content: either way an agent identifies an entity your visitors never see.
0/100
pass
Declared language matches the contentemerging
Declared lang="en" matches the detected content language (en).
100/100
Actionability
pass
Paywall / login wall
No paywall or login-wall detected on the landing URL.
100/100
fail
Agent Skills manifestemerging
No Agent Skills manifest at /.well-known/agent-skills.json. Enumerate the tasks agents can perform (search, add-to-cart, contact-support) so they pick the right one without scraping.
0/100
fail
WebMCP actionsemerging
No WebMCP detected. On pages with first-class actions (cart, support, account), embed a WebMCP server so on-page agents invoke tools directly.
0/100
pass
Primary action reachable
A primary offering and a price or call to action were both identifiable from the served HTML, so an agent can tell what this page sells and what it costs without running scripts.
100/100
pass
Reachability
HTTP 200.
100/100
skip
Primary action is clickableemerging
This page does not ask the reader to do anything, so there is no primary action to check. Informational pages are not penalised here.
—
skip
Filters reachable by URLemerging
This page does not offer to filter or sort a list, so there is nothing to address by URL. Pages without facets are not penalised here.
—
Performance
pass
Time to first byte
TTFB 155ms. Healthy.
100/100
skip
Full render time
Full-render time unavailable (browser pass skipped or failed).
—
pass
Page weight
Initial document is a lean 60 KB.
100/100
Beyond the scan
Running AI agents of your own? AgentSpeed also monitors them in production: every run, its latency, cost, and failures, with alerts when something breaks. Free for 10,000 events a month, no credit card.
Look for "User-agent: *" followed by "Disallow: /". That single pair blocks everything, AI agents included.
Add an explicit allow block for each AI agent you want (GPTBot, ClaudeBot, PerplexityBot, OAI-SearchBot), placed after the wildcard rule so it wins.
The generated robots.txt in the Fix it section below has the exact lines for this site. Copy it, or merge the blocks into your existing file.
→ https://mehmetozen.dev/robots.txt
Paste into Claude Code, Cursor, or any assistant with your repository open. It carries this finding, the steps, and the shortcuts to avoid.
What to check
After deploying, open yoursite.com/robots.txt and confirm the new blocks are live, not cached.
Hit Re-scan above: "robots.txt allows AI agents" should flip to PASS.
The free robots.txt checker at /tools/robots-txt-checker shows per-agent allow/block for your live file.
What to avoid
Don’t delete rules you added deliberately. If you block a specific scraper for a reason, keep that block; just don’t let a blanket rule catch the assistants too.
Allowing crawlers you actually want blocked just to raise a score is backwards. The score measures readiness for agents you WANT; decide the policy first, then express it precisely.
Don’t serve a different robots.txt to different visitors. Inconsistent answers get you treated as unreliable by every crawler.
No HTTP Link: response headers. Emit canonical/alternate/describedby relations so HEAD-only or stream-rendering agents get them without parsing HTML.
Show me exactly what to do
What this means
HTTP responses can carry a Link header: the same canonical and alternate-language information your HTML declares, but delivered in the response envelope itself. Agents that only send a HEAD request, or that decide what to do while the page is still streaming, read the header without parsing any HTML. Yours is missing (or carries none of the relations agents use: canonical, alternate, describedby).
Why it matters
An agent triaging fifty URLs doesn’t want to download and parse fifty pages to learn which are duplicates of which. The Link header answers at the cheapest possible layer. Sites that provide it get correctly de-duplicated and correctly language-routed even by the most minimal fetchers.
Do this
Emit a Link header alongside each page, mirroring what your HTML head already declares. Example: Link: <https://yoursite.com/page>; rel="canonical".
Most stacks set this in one place: Next.js headers() config, an nginx add_header line, or a CDN response-header rule.
If you serve translations, add rel="alternate" entries with hreflang, matching your HTML.
Paste into Claude Code, Cursor, or any assistant with your repository open. It carries this finding, the steps, and the shortcuts to avoid.
What to check
Run: curl -sI https://yoursite.com | grep -i "^link:" and confirm the relations appear.
Hit Re-scan above: "Link response headers" flips to PASS.
What to avoid
The header must AGREE with the HTML. A Link header pointing one place while the in-page canonical points another gives machines two contradictory answers, which is worse than one missing answer.
Don’t inject the same site-wide canonical on every page via a blanket CDN rule; each page names its own clean URL, exactly as in the HTML tag.
Visible text is 1.0% of HTML weight (584/61443 bytes). 80% of the document is inline script, 19% is markup.
Show me exactly what to do
What this means
Of everything your server sends for this page, very little is actual readable text. The rest is code, styling, and markup wrapper. Agents fetched a lot of bytes and found few words.
Why it matters
Agents work with retrieval budgets. A page that is 2% text either gets skimmed (and mis-summarised) or skipped. More signal per byte means more of your actual message survives into the agent’s summary.
Do this
Confirm your real copy is server-rendered. See the JavaScript check; these two usually fail together.
Cut boilerplate wrappers: deeply nested divs, inline SVG logos repeated per section, base64 images inlined into HTML.
Move large inline styles and scripts into external files.
Check how much of the document is inline script: your report now says. If most of it is, that is your framework serializing state for hydration, often a second copy of text already in the HTML. Send only the props a component cannot recompute, and render statically where a page does not need to hydrate.
Paste into Claude Code, Cursor, or any assistant with your repository open. It carries this finding, the steps, and the shortcuts to avoid.
What to check
Re-scan: "Text-to-markup ratio" improves, and "Page weight" often improves alongside.
What to avoid
Don’t pad the page with keyword text to inflate the ratio. The ratio is a proxy for substance, and stuffing is the opposite of substance.
Your page HAS structured data, but it is malformed: broken JSON syntax, or types and fields that don’t exist in the schema.org vocabulary. Machines can see the block but can’t parse it.
Why it matters
Invalid JSON-LD is worse than it looks. The agent spends its attention budget on the block, fails to parse it, and falls back to guessing from prose anyway. You pay the cost of structured data without getting the benefit.
Do this
Paste the failing page into validator.schema.org. It names the exact line and field that breaks.
The most common breaks: a trailing comma (invalid JSON), a typo’d type name, or a price written as "$79" instead of "79" with a separate priceCurrency.
Fix in place, redeploy, revalidate.
Paste into Claude Code, Cursor, or any assistant with your repository open. It carries this finding, the steps, and the shortcuts to avoid.
What to check
validator.schema.org reports zero errors for the page.
Re-scan: "Structured data validates" flips to PASS.
What to avoid
Don’t delete the block to make the error disappear. That trades "invalid" for "absent" and fails the presence check instead; fix it.
Don’t hand-edit generated JSON-LD in the page. Fix the template or plugin that generates it, or the error returns on the next publish.
No valid MCP Server Card at /.well-known/mcp/server-card.json. Publish one so agents can discover your tools without HTML scraping.
Show me exactly what to do
What this means
MCP (Model Context Protocol) is how AI assistants call tools. A server card is a small JSON file at /.well-known/mcp/server-card.json that announces "this site offers these tools" so an assistant can find them without scraping your pages. We requested that file from your site and found none.
Why it matters
Assistants that support MCP look for the card at that exact address. With one, "book an appointment on yoursite.com" can become a tool call instead of screen-driving your UI. This is an emerging standard, so it weighs little today; publishing early costs one static file and makes you visible to the assistants adopting it.
Do this
If you already run an MCP server, describe it: name, description, and endpoint URL in the card.
If you don’t, a minimal truthful card naming your site and linking your API docs is still valid. The generated starter in the Fix it section below is filled in for this site.
Serve it at exactly /.well-known/mcp/server-card.json with content type application/json.
No RFC 8414 metadata at /.well-known/oauth-authorization-server. Agents that act on behalf of users need this to discover your authorization endpoints.
Show me exactly what to do
What this means
RFC 8414 metadata is a JSON file at /.well-known/oauth-authorization-server that tells software where your sign-in endpoints live: where to send a user to authorise, where to exchange tokens. We requested it and found none. This only applies if your site has accounts or an API that third parties connect to.
Why it matters
Agents acting on a user’s behalf (booking, purchasing, managing an account) need permission first, and OAuth is how they get it without ever seeing a password. The metadata file is how they discover your endpoints programmatically instead of a developer hand-configuring each integration. No file means every agent integration starts with manual setup, so most never start.
Do this
If you run an OAuth authorization server (Auth0, Keycloak, Okta, or your own), enable its metadata endpoint; most providers publish RFC 8414 metadata with a setting.
Serve or proxy it at /.well-known/oauth-authorization-server on this domain.
If your site has no user accounts or API, this check simply isn’t your priority; it is one reason it carries a small weight.
Paste into Claude Code, Cursor, or any assistant with your repository open. It carries this finding, the steps, and the shortcuts to avoid.
What to check
Open yoursite.com/.well-known/oauth-authorization-server and confirm JSON with an "issuer" field matching your domain.
Hit Re-scan above: "OAuth authorization metadata" flips to PASS.
What to avoid
Don’t publish metadata naming endpoints that don’t answer; broken discovery is worse than none, because clients trust the file over their own guesses.
Don’t copy another provider’s metadata as a template and leave their URLs in it. Every URL in the file must be yours.
Right now, only you know this score. Your buyers ask AI before they buy, and certification is how you show them, and anyone comparing you to a competitor, that assistants can actually read, quote, and use your site.
A public verification URL you can drop into a sales deck, a procurement questionnaire, or a partner review. Anyone can check it, dated and signed.
An embeddable badge for your site, the visible version of a property competitors can’t claim without earning the score.
Weekly re-checks for a full year. A deploy that breaks agent access gets caught before it costs you recommendations, and before the certificate would lapse.
Sites under 70 can’t buy this at any price. That’s what makes displaying it mean something.