FOR AGENTS · /for-agents

Copy one file. Your coding agent does the rest.

The audit tells you what is wrong. This page hands the fixing to the agent you already use: Claude Code, Codex, Cursor, Copilot, Gemini CLI. It reads the instructions, works out how your site is built, generates the files, and re-runs the audit until the checks pass.

  1. 01

    Paste the prompt

    In your repository, open your coding agent and paste the one-line prompt below. The agent fetches the full instructions itself. Offline? Copy the whole file into the repo instead.

  2. 02

    Answer three questions

    Training opt-out (yes, no, or no preference), a security contact, and the public domain if the repo does not say. Everything else the agent derives from your site's own content.

  3. 03

    Read the before and after

    The agent runs the audit first, then again after its changes, and reports the numbers: readiness checks passing, the WebMCP grade if you register tools, and the report link.

The prompt

Read https://webmcp-audit.com/agent-instructions.md and follow it for this repository. The site is https://YOUR-SITE. Run the audit before and after, ask me only the questions the file marks ASK, and finish with the summary it describes.

Replace YOUR-SITE. If your agent cannot fetch URLs, download the file and put it in the repository root, then say "follow agent-instructions.md".

curl -sO https://webmcp-audit.com/agent-instructions.md Download the file

What the agent will produce

Only what the audit found missing, in the directory your framework serves as the web root. Nothing is invented: facts come from your pages or from you.

/robots.txt
Crawl allowed, AI search and on-demand fetchers allowed, a stated training policy, a Content-Signal line, the sitemap declared. Existing rules kept.
/llms.txt
A markdown index in the llmstxt.org format: who or what the site is, and links to the pages that matter, written from your content.
/sitemap.xml
Every public URL, generated by your framework where it can, static otherwise.
/.well-known/security.txt
Contact and Expires, the two fields RFC 9116 requires.
<head> metadata
Title, description, canonical, lang, Open Graph and a JSON-LD block (Person, Organization, Product or Article) in the server-rendered HTML.
WebMCP registration
Only for sites with real actions: tools that pass the security rulepack, with annotations and an origin-trial token so real visitors see them.

The full instructions

Plain markdown, served at /agent-instructions.md. Read it yourself first: it is also a decent human checklist.

Loading /agent-instructions.md…

Test your WebMCP tools with Claude today

Download the bridge

Chrome exposes a page's tools to agents running in the browser, but Claude's extension still clicks through the DOM and does not look for them. Until it does, this one-file bridge reads the tools of the page open in your Chrome over the DevTools protocol and hands them to Claude Code or Claude Desktop as ordinary MCP tools. Claude then calls search_roles or apply itself, instead of guessing which button to press.

Site owners need none of this: register your tools, ship the origin-trial token, and any agent that supports WebMCP will find them. The bridge is for testing your own page with Claude before that day comes.

"/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" --enable-blink-features=WebMCP --remote-debugging-port=9222 --user-data-dir="$HOME/chrome-webmcp-profile" https://YOUR-SITE
claude mcp add webmcp -- node /path/to/webmcp-bridge.js

Node 22 or newer, no dependencies. The README covers Claude Desktop, a busy port 9222, and a walkthrough on the demo page, which registers two tools you can call right away.

Why these files, and whose advice this is

Every check in the audit rests on a published document from the company whose agent it concerns: OpenAI, Anthropic and Perplexity describe their crawlers and which robots.txt tokens control training, search and user-requested fetches; Google states that no special AI files are needed for Google Search and that robots.txt and nosnippet are the controls; Cloudflare's Content Signals Policy adds a one-line usage preference to robots.txt; Chrome Lighthouse now audits llms.txt and WebMCP under "agentic browsing"; RFC 9116 defines security.txt. The checks page lists each source next to the check it supports.