Finalizing the report
Preparing the stored Is Agentic score
Essential—
Recommended—
Bonus signals—
Preparing the stored Is Agentic score
mazehq.com
These checks describe whether an ordinary agent can enter, read, and operate the public site.
Agents can reach the site
Crawler access and bot defenses.
Core content is available
Useful content remains accessible without a fragile browser-only path.
Navigation fails safely
Redirects and missing pages give agents a recoverable path.
Controls are understandable
Forms and interactive controls expose usable names and structure.
The public website is always evaluated. Optional surfaces appear when the scan finds positive evidence that they apply.
Ready with gaps
Weighted across 16 applicable checks
Ready with gaps
Weighted across 12 applicable checks
Ready with gaps
Weighted across 1 applicable check
Critical access gaps come first, followed by other applicable readiness gaps.
Return a real HTTP 404 (or 410) status for nonexistent paths - never a 200 with your app shell, which makes agents believe every path exists. For full credit, give the 404 response a short markdown body pointing agents at your sitemap, llms.txt, or docs index. Verify with curl -s -o /dev/null -w "%{http_code}" https://yourdomain.com/some-path-that-does-not-exist - it must print 404.
On the responses that serve text/markdown via Accept negotiation, add Accept to the Vary header (Vary: Accept, Accept-Encoding). Without it, CDNs can serve the cached HTML variant to an agent asking for markdown (or vice versa), depending on which variant landed in cache first.
Make sure a clean search for your brand name returns your own domain in the top results. If it does not, your brand may be too generic, conflict with a more established term, or not yet indexed. Strengthen brand-name search by claiming consistent NAP across listings, earning press mentions that link to the canonical domain, and avoiding redirect chains that mask the apex domain in search results.
Publish an official CLI tool on npm, PyPI, or Homebrew. A CLI lets agents and developers script interactions with your product without building API integrations from scratch.
Return standard rate-limit headers on your API responses (the RFC RateLimit headers, plus Retry-After on a 429) so agents can self-throttle in real time, and document the conventions alongside your API.
Checks are grouped by relevance for Docs & content sites.
4182 chars, semantic headings (1 H1 + 7 H2s + 17 H3s), 5.8% content ratio
Site accessible to 6 AI agent user-agents
No meta-refresh stubs, JavaScript-redirect stubs, or cross-domain hops across 6 checked pages
All 5 sampled pages are publicly readable (5 with substantive content)
OpenAPI spec found at https://mazehq.com/openapi.json (version: 3.1.1)
Not acceptmarkdown.com compliant: Accept: text/markdown returned text/html; charset=utf-8; Vary header missing Accept (got "accept-encoding")
How to pass
On the responses that serve text/markdown via Accept negotiation, add Accept to the Vary header (Vary: Accept, Accept-Encoding). Without it, CDNs can serve the cached HTML variant to an agent asking for markdown (or vice versa), depending on which variant landed in cache first.
API returns JSON error responses (404 at https://api.mazehq.com)
Nonexistent paths return a real HTTP 404. For full credit, include a short markdown body (site map links, where to look next) so agents can recover.
How to pass
Return a real HTTP 404 (or 410) status for nonexistent paths - never a 200 with your app shell, which makes agents believe every path exists. For full credit, give the 404 response a short markdown body pointing agents at your sitemap, llms.txt, or docs index. Verify with curl -s -o /dev/null -w "%{http_code}" https://yourdomain.com/some-path-that-does-not-exist - it must print 404.
Name search surfaced no pages on mazehq.com, although developer resources exist on the site (API docs, OpenAPI spec, developer portal, MCP server) - weak search indexing or transient search noise
How to pass
Make your developer resources (API docs, OpenAPI spec, auth docs, developer portal, MCP server) discoverable by name. Publish them at predictable URLs, list them in llms.txt, and include your product name in page titles and headings so search engines surface them for name-based queries.
"Maze" search returned 8 results but domain did not appear - brand may be too generic or not indexed
How to pass
Make sure a clean search for your brand name returns your own domain in the top results. If it does not, your brand may be too generic, conflict with a more established term, or not yet indexed. Strengthen brand-name search by claiming consistent NAP across listings, earning press mentions that link to the canonical domain, and avoiding redirect chains that mask the apex domain in search results.
Valid sitemap found at https://mazehq.com/sitemap_index.xml with multiple sitemaps entries
Rich JSON-LD identity: Organization with name, description, url, and sameAs/logo/address (1 block)
Documentation site found at https://docs.mazehq.com
When-to-use guidance found in llms.txt
All metadata signals present: canonical URL, lang="en-US", og:image, og:type
Organization schema complete with contactPoint and address
About, Privacy pages verified - missing: Contact
How to pass
Publish real /about, /contact, and /privacy pages with at least 500 characters of content each. These are the pages AI agents check to verify your business is legitimate before recommending you.
All 7 measured pages fit an agent context budget (largest ~5K tokens)
Code fences balanced across 1 markdown document
Developer documentation portal found at https://docs.mazehq.com
REST API documentation found at https://mazehq.com/blog/ai-remediation-developers-actually-want-to-use. GraphQL endpoint at https://graphql.mazehq.com/graphql is reachable; introspection requires authentication (API key / OAuth), which is expected for agent access. Best-of-protocols score: 7/7.
Live MCP server at https://mcp.mazehq.com requires authentication (OAuth challenge at initialize) - properly scoped. Upgrade to public tool listing for full 6/6.
How to pass
Build an MCP (Model Context Protocol) server exposing your API as tools. Use Streamable HTTP transport for full score. This lets Claude, ChatGPT, and other AI agents call your product natively.
No REST rate-limit headers found on probed endpoints (GraphQL signal: fail 0).
How to pass
Return standard rate-limit headers on your API responses (the RFC RateLimit headers, plus Retry-After on a 429) so agents can self-throttle in real time, and document the conventions alongside your API.
Partial typed error model: error schema defined but not consistently referenced (or vice versa)
How to pass
Document your error responses in your OpenAPI spec: give 4xx and 5xx responses a typed error schema (or use RFC 9457 application/problem+json). A consistent error object with a machine-readable code and a human-readable message lets agents handle failures without guessing.
API versioning found (URL versioning (servers or paths)) but no deprecation or sunset policy detected - add Sunset/Deprecation headers or a deprecation policy page
How to pass
Declare a versioning policy agents can rely on: version your API (in the URL path or a version header) and publish how you signal deprecation (a Sunset/Deprecation header or a documented timeline). Agents avoid integrating against a surface that can change without warning.
No CLI tool found
How to pass
Publish an official CLI tool on npm, PyPI, or Homebrew. A CLI lets agents and developers script interactions with your product without building API integrations from scratch.
100% of operations define typed response schemas, 73% use application/json
REST: agent-friendly schema (22 operations, 100% with operationIds, 100% documented by description or summary) | GraphQL: introspection auth-gated and no schema evidence in docs | Combined score: 1/2
How to pass
Make your API spec self-describing: a unique operationId and a description on every operation, typed parameters, and response schemas. For GraphQL, a fully typed schema with a documented cost or rate limit reads best.
Compatible: 22/22 ops with IDs, 17/22 with typed schemas
MCP server at https://mcp.mazehq.com - consider adding /.well-known/mcp for standard discovery
How to pass
Serve your MCP server at /.well-known/mcp, publish a server-card.json at /.well-known/mcp/server-card.json, or reference it in llms.txt so agents can discover it automatically without manual URL input.
RFC 8288 Link header advertises: service-desc, alternate(markdown)
Full markdown fallback support. Homepage (https://mazehq.com/index.md) and all 1 sampled content pages return markdown: https://mazehq.com/blog/ai-remediation-developers-actually-want-to-use.md
100% of 25 sampled sitemap entries carry lastmod; newest is 7 day(s) old
Found the llms.txt at https://mazehq.com/llms.txt.
The llms.txt is well-formatted: 80 lines with markdown links, 8,826 characters in total.
Entity linking to linkedin.com - add more authority profiles (Wikipedia, Wikidata, LinkedIn, GitHub)
How to pass
Add sameAs links in your JSON-LD structured data pointing to your Wikipedia page, Wikidata entry, GitHub org, and social profiles. This helps AI disambiguate your brand from similarly named entities.
Some extended schema types found: BreadcrumbList - add FAQPage, Service, or AggregateRating for full coverage
How to pass
Expand your JSON-LD beyond Organization/WebSite. Add FAQPage for common questions, Service or Product for offerings, AggregateRating or Review for social proof, and BreadcrumbList for navigation context.
All 5 probed llms.txt links resolve to real content
Markdown alternate advertised and verified: https://mazehq.com/index.md serves markdown
Path-suffix markdown docs served with text/markdown content-type: /index.md
product MCP requires authentication but no standard OAuth discovery metadata
How to pass
Protect your MCP server with OAuth 2.0 authentication. Publish authorization server metadata at /.well-known/oauth-authorization-server for automatic agent auth flows.
Server HTML is a well-structured document (main=true, landmarks=4/4, h1=1, maxHeadingSkip=1).
65 native controls, 1 non-native div-soup affordances (98% native).
65/65 interactive elements have a computable accessible name (100%).
No hidden instruction text detected in accessibility-tree attributes or off-screen content.
What does mazehq.com do and who is it for? Explain it back to me.
Sign me up for Vercel product updates and marketing emails.
Unsubscribe anytime. Privacy Notice
Source: Ora API
What does mazehq.com do and who is it for? Explain it back to me.
28 steps10 reasoning steps12 searches
The agent could not complete the task fully because mazehq.com itself was inaccessible (403 blocking), forcing reliance on web search results and third-party sources to construct an answer. It successfully assembled a coherent overview of Maze's core value proposition (AI-powered vulnerability investigation), target audience (enterprise security teams), and differentiation (context-based exploitability + unified code/cloud coverage), but critical gaps remained: pricing could not be verified, the free tier / trial structure was unknown, and specific product features could not be confirmed from primary sources. The agent was transparent about these gaps, making the response useful but incomplete.