# Publish Agent Readiness signals for AI scanners

> Royal MCP 1.5.1+ publishes an MCP Server Card, Skills Index, and OAuth metadata at well-known paths so Cloudflare, Vercel, and Lighthouse scanners find it.

- Canonical: <https://royalplugins.com/support/royal-mcp/agent-readiness/>
- Last updated: 2026-09-21
- HTML version: <https://royalplugins.com/support/royal-mcp/agent-readiness/>

---

Royal MCP 1.5.1 and later publishes three machine-readable discovery documents at the standard well-known paths that Cloudflare’s Agent Readiness scanner, Vercel’s is-agentic, Chrome Lighthouse’s Agentic Browsing audit, and other AI-discovery tools read to recognize your site as agent-ready. This page is a reference for what each document contains, where it lives, and how to verify each one on your own site.

### Zero configuration, published automatically.

Every Royal MCP install serves these documents out of the box. You don’t need to toggle anything on, generate any files, or paste any JSON into your site. The documents auto-populate from whichever integrations are active (WooCommerce, Elementor, Divi, Yoast SEO, and so on) so tool counts and category names stay accurate as you install and remove plugins.

## What Royal MCP publishes

Three JSON documents plus an RFC 8288 `Link` header on every MCP endpoint response:

| Document | Path | Purpose |
| --- | --- | --- |
| **MCP Server Card** | `/.well-known/mcp/server-cards.json` `/.well-known/mcp/server-card.json` (alias) `/.well-known/mcp.json` (alias) | SEP-1649 shape with `serverInfo`, `endpoint`, `capabilities`, supported protocol versions, and category-level tool counts. Read by MCP-aware scanners. |
| **Skills Index** | `/.well-known/skills/index.json` `/.well-known/agent-skills/index.json` (alias) | Cloudflare-proposed agent-skills index. Publishes your tool set grouped by integration category (wordpress-core, woocommerce, elementor, and so on) with a tool count per skill. |
| **OAuth Protected Resource** | `/.well-known/oauth-protected-resource` | RFC 9728 metadata pointing at the OAuth authorization server that protects your MCP endpoint. Read by scanners that verify auth discovery. |
| **Link header** | On every `/mcp` response | RFC 8288 header pointing at the three discovery documents plus the OAuth Authorization Server metadata. Lets agent runtimes that hit your MCP endpoint discover metadata without extra probing. |

## Scanners that recognize these signals

Every scanner below reads at least one of Royal MCP’s discovery documents. You don’t need to configure anything on their end; they auto-detect on the next scan of your domain.

### Cloudflare Agent Readiness

Cloudflare’s beta Diagnostics dashboard grades sites on three tiers (Quick Wins, Technical Groundwork, Advanced Integration). Royal MCP contributes to Level 3 Advanced Integration:

- **Share your AI tool context engine (MCP Server Card)**: reads `/.well-known/mcp/server-cards.json`
- **List what your AI agent can do (Skills Index)**: reads `/.well-known/skills/index.json`
- **Restrict content paths (OAuth Protected Resource)**: reads `/.well-known/oauth-protected-resource`
- **Automate security handshakes for bots (OAuth Discovery)**: reads `/.well-known/oauth-authorization-server` (shipped since Royal MCP 1.4.x)

Access it in the Cloudflare dashboard: select your zone, look for the **Agent Readiness** section in the left sidebar. If the scanner reports any of these as “not found” even though the paths return valid JSON, see the [Cloudflare Cache Rule fix](https://royalplugins.com/support/royal-mcp/cloudflare-cache-rule-for-agent-readiness/).

### Vercel is-agentic

Vercel’s open scanner at [is-agentic.com](https://is-agentic.com/) grades sites on 13 checks across Essential, Recommended, and Bonus tiers. Run it directly:

```
npx is-agentic your-site.com
```

Or hit the API programmatically:

```
curl -sS -X POST https://isitagentready.com/api/scan \
  -H "Content-Type: application/json" \
  -d '{"url": "https://your-site.com"}'
```

### Chrome Lighthouse Agentic Browsing audit

Chrome DevTools ships Lighthouse 13.3+ with an audit category called “Agentic Browsing” that grades sites on the same well-known-path signals Royal MCP publishes. Run it from Chrome DevTools: Lighthouse tab → select Agentic Browsing category → Analyze page load.

## Verify from your terminal

Every document should return HTTP 200 with `Content-Type: application/json; charset=utf-8`. Curl each one:

```
for path in \
  "/.well-known/mcp/server-cards.json" \
  "/.well-known/mcp/server-card.json" \
  "/.well-known/mcp.json" \
  "/.well-known/skills/index.json" \
  "/.well-known/agent-skills/index.json" \
  "/.well-known/oauth-authorization-server" \
  "/.well-known/oauth-protected-resource"; do
  echo "=== $path ==="
  curl -sSI "https://your-site.com$path" | head -3
done
```

Then inspect the Link header on your MCP endpoint response:

```
curl -sSI https://your-site.com/wp-json/royal-mcp/v1/mcp | grep -i link
```

You should see a Link header with three `rel=` values: `mcp-server-card`, `agent-skills`, and `oauth-authorization-server`.

## Customize the published documents

Two WordPress filters let plugins or a mu-plugin add fields or reshape either discovery document before it ships:

| Filter | What it mutates |
| --- | --- |
| `royal_mcp_server_card` | Full MCP Server Card array before caching. Add custom fields, override `vendor`/`documentation`, or narrow `tools_summary.categories`. |
| `royal_mcp_agent_skills_index` | Full Skills Index array before caching. Add extra skills entries, tweak per-category descriptions, or exclude specific categories. |

Both filters fire before the 5-minute transient cache, so a filter change takes effect on the next request that misses the transient (or immediately if you `delete_transient('royal_mcp_server_card_json')` to force a rebuild).

## If a scanner reports one of these as “not found”

Two common causes:

1. **Scanner-side timeout on Cloudflare-fronted sites.** Cloudflare Free doesn’t auto-cache `application/json`. The scanner’s parallel probes race the uncached origin latency. Fix with the [one Cloudflare Cache Rule](https://royalplugins.com/support/royal-mcp/cloudflare-cache-rule-for-agent-readiness/).
2. **Host-level block on `/.well-known/`.** Some hosts (managed WordPress, self-hosted nginx with a locked-down `location /.well-known/` block) intercept every `.well-known/*` path before WordPress can respond. Verify with a curl to any of the paths above: if you get a 404 with an nginx or Apache branded body (not Royal MCP’s JSON error shape), the host is blocking. See the [Royal MCP support hub](https://royalplugins.com/support/royal-mcp/) for host-specific unblock guides (SiteGround, self-hosted nginx, Imunify360, BitNinja, Sucuri).

## Next steps

[Cloudflare Cache Rule for Agent Readiness

If your Cloudflare Agent Readiness dashboard reports Royal MCP discovery documents as “not found” even though the paths return JSON, this one Cache Rule fixes it in 3 minutes.](https://royalplugins.com/support/royal-mcp/cloudflare-cache-rule-for-agent-readiness/)
[Enable browser AI agents (WebMCP)

Let browser-based AI agents call Royal MCP tools using the visitor’s WordPress login. Complements the discovery documents with a live browser-agent path.](https://royalplugins.com/support/royal-mcp/webmcp/)

[Back to Royal MCP Support](https://royalplugins.com/support/royal-mcp/)
[Enable browser AI agents (WebMCP)](https://royalplugins.com/support/royal-mcp/webmcp/)