Beta · free while we build

Website audits built for AI agents.

Q: What does AgentSiteAudit check?

The v1 registry defines 60 checks across nine categories: transport, TLS, DNS, performance, SEO, links, accessibility, mobile and security. During the beta, checks are switched on in stages; any check not yet live is reported as NOT_TESTED, never as a pass.

Q: How does an AI agent use it?

Make one GET request to https://agentsiteaudit.com/v1/audit?url= followed by the page address. The response is a JSON report with a score, a priority-ordered issue list and, for every check, the evidence and a concrete fix.

Q: Is it safe to point at any website?

The audit is passive. It only fetches the page, its robots.txt, its sitemap and the resources it links to. It never submits forms or probes for hidden files, and it refuses private, internal and reserved network addresses.

Q: How much does it cost?

It is free during the beta, within a rate limit of 10 audits a minute and 500 a day per IP address. Pay-per-request pricing using the x402 protocol is planned.

Q: Why does a check say NOT_TESTED?

NOT_TESTED means the check could not or should not run, for example because it does not apply, the time budget ran out, or the check is not live yet. A reason code is always given, and untested checks never count as passes.

Send one URL. Get back one structured JSON report: stable issue codes, honest results, evidence for every finding and a fix an agent can apply without guessing.

request

$ curl "https://agentsiteaudit.com/v1/audit?url=https://example.com"

60checks
9categories
<10 stime budget
0trackers

Try it live

Runs a real audit against the public API. During the beta, all 60 checks across the nine categories are live.

Why agents can trust the report

Honest results

Every check ends PASS, WARNING, FAIL or NOT_TESTED. Untested always carries a reason and never counts as a pass.

Stable issue codes

IDs like seo.title.present are permanent. Wording can improve; the code an agent relies on never changes or gets reused.

Deterministic scores

Whole-number maths, published weights. A critical failure caps the score at 49, so a broken certificate can never hide behind a good average.

Evidence and fixes

Each finding shows what was observed, what was expected, why it matters and the exact fix, with a copy-paste snippet where it helps.

Safe by design

Passive checks only. Private, internal and cloud-metadata addresses are refused, and every redirect is re-checked before it's followed.

Same shape, every time

Complete, partial, failed, rejected or rate-limited: the response always has the same 15 fields and all nine categories.

What it checks

The full registry, with every ID, severity and threshold, is published at /v1/checks.json.

Security

HSTS, CSP, clickjacking, mixed content, cookie flags · 9 checks live

SEO

Title, description, H1, canonical, indexability, sitemap, structured data · 16 checks live

TLS

Certificate trust, expiry, protocol version · 3 checks live

Performance

HTML size, page weight, blocking scripts, images · 7 checks live

Transport

Reachability, HTTPS, redirects, HTTP/2, compression, caching, TTFB · 9 checks live

Accessibility

Language, alt text, labels, link and button names · 6 checks live

Links

Broken internal and external links, up to 50 per page · 2 checks live

Mobile

Viewport, device width, zoom · 3 checks live

DNS

IPv6, MX, SPF, DMARC, CAA · 5 checks live

The number on each card is that category's weight in the overall score, out of 100.

What comes back

response (shortened)

{
  "status": "complete",
  "summary": { "score": 49, "grade": "F",
    "cap_applied": { "limit": 49, "reason": "critical_failure", "uncapped_score": 92 } },
  "issues": ["tls.certificate.valid", "tls.certificate.expiry"],
  "checks": [{
    "id": "tls.certificate.valid", "result": "FAIL", "severity": "CRITICAL",
    "title": "SSL certificate has expired",
    "evidence": { "observed": "certificate has expired", "expected": "Trusted, in-date certificate" },
    "fix": "Renew the certificate now. On cPanel, run AutoSSL."
  }]
}

API

Endpoint	Returns
`GET /v1/audit?url=…`	The audit report for one page.
`GET /v1/checks.json`	Every check ID, severity, category and threshold, plus scoring weights.
`GET /v1/health`	Service status and versions.

HTTP	Meaning
`200`	The audit ran. Read `status`: complete, partial or failed (the site was unreachable).
`400`	The URL was invalid or used a disallowed scheme or port.
`403`	The URL points to a private, internal or reserved address.
`429`	Rate limited. Retry after the `Retry-After` seconds.
`500`	Our error. Safe to retry.

Pricing

Beta

Free

10 audits a minute and 500 a day per IP address. No account, no key.

Pay per request

Planned

A small charge per audit using the x402 protocol, so agents pay as they go without signing up.

Questions

What does AgentSiteAudit check?

The v1 registry defines 60 checks across nine categories: transport, TLS, DNS, performance, SEO, links, accessibility, mobile and security. During the beta, checks are switched on in stages; any check not yet live is reported as NOT_TESTED, never as a pass.

How does an AI agent use it?

Make one GET request to https://agentsiteaudit.com/v1/audit?url= followed by the page address. The response is a JSON report with a score, a priority-ordered issue list and, for every check, the evidence and a concrete fix.

Is it safe to point at any website?

The audit is passive. It only fetches the page, its robots.txt, its sitemap and the resources it links to. It never submits forms or probes for hidden files, and it refuses private, internal and reserved network addresses.

How much does it cost?

It is free during the beta, within a rate limit of 10 audits a minute and 500 a day per IP address. Pay-per-request pricing using the x402 protocol is planned.

Why does a check say NOT_TESTED?

NOT_TESTED means the check could not or should not run, for example because it does not apply, the time budget ran out, or the check is not live yet. A reason code is always given, and untested checks never count as passes.