packagist.org
Finalizing the report
Preparing the stored Is Agentic score
Essential—
Recommended—
Bonus signals—
packagist.org
Preparing the stored Is Agentic score
packagist.org
These checks describe whether an ordinary agent can enter, read, and operate the public site.
Agents can reach the site
Crawler access and bot defenses.
Core content is available
Useful content remains accessible without a fragile browser-only path.
Navigation fails safely
Redirects and missing pages give agents a recoverable path.
Controls are understandable
Forms and interactive controls expose usable names and structure.
The public website is always evaluated. Optional surfaces appear when the scan finds positive evidence that they apply.
Needs work
Weighted across 15 applicable checks
Blocked
Weighted across 8 applicable checks
Blocked
Weighted across 1 applicable check
Critical access gaps come first, followed by other applicable readiness gaps.
Keep the correct HTTP 404 status. The remaining requirement is a Markdown error body when agents request Accept: text/markdown. Include at least 20 characters explaining the error and a link to your docs, sitemap, or llms.txt. Verify with curl -sS -L -i -H 'Accept: text/markdown' https://yourdomain.com/some-path-that-does-not-exist. Check both the final 404 status and the Markdown body with Content-Type: text/markdown. Checking the status alone does not verify the missing requirement.
Serve your content pages without a login wall. Agents cannot complete auth flows while browsing - a 401/403 or a login-form page is invisible content. Keep public documentation public; if some content must stay gated, publish an ungated summary so agents can still represent it.
Publish an OpenAPI (Swagger) specification at /openapi.json or /api/openapi.yaml. This is how agents understand your API surface automatically.
Implement OAuth 2.0 for API authentication. Publish your authorization server metadata at /.well-known/oauth-authorization-server.
Declare scoped API permissions where machines can read them: named OAuth scopes in your OpenAPI security schemes, or scopes_supported in RFC 9728 protected-resource metadata. Prose descriptions of roles help humans, but agents need the machine-readable declaration to request least-privilege access.
Checks are grouped by relevance for App sites.
3482 chars, semantic headings (1 H1 + 3 H2s + 10 H3s), 32.9% content ratio
Site accessible to 6 AI agent user-agents
No meta-refresh stubs, JavaScript-redirect stubs, or cross-domain hops across 6 checked pages
Some sampled pages are auth-gated: 1 looks like a login wall (https://packagist.org/register/)
How to pass
Serve your content pages without a login wall. Agents cannot complete auth flows while browsing - a 401/403 or a login-form page is invisible content. Keep public documentation public; if some content must stay gated, publish an ungated summary so agents can still represent it.
No OpenAPI/Swagger specification found
How to pass
Publish an OpenAPI (Swagger) specification at /openapi.json or /api/openapi.yaml. This is how agents understand your API surface automatically.
Homepage https://packagist.org does not meet the Markdown negotiation requirements: Accept: text/markdown returned text/html; charset=utf-8; Vary header missing Accept (got "accept-encoding")
How to pass
Enable Markdown negotiation on the scanned homepage. Supporting it only on /docs or a separate .md URL does not satisfy this check. Requests with Accept: text/markdown must receive a nonempty Markdown body with Content-Type: text/markdown and Vary: Accept. Keep serving HTML for Accept: text/html. Adding Vary alone does not create a Markdown response. Verify both with curl -sS -L -i -H 'Accept: text/markdown' https://yourdomain.com/ and curl -sS -L -i -H 'Accept: text/html' https://yourdomain.com/. Check the final response headers and body: Markdown with Vary: Accept for the first request, HTML for the second.
No OAuth 2.0 or OpenID Connect support detected
How to pass
Implement OAuth 2.0 for API authentication. Publish your authorization server metadata at /.well-known/oauth-authorization-server.
No declared OAuth scopes, security schemes, or scoped-permission documentation found
How to pass
Declare scoped API permissions where machines can read them: named OAuth scopes in your OpenAPI security schemes, or scopes_supported in RFC 9728 protected-resource metadata. Prose descriptions of roles help humans, but agents need the machine-readable declaration to request least-privilege access.
The nonexistent path https://packagist.org/__ora-404-probe-27fniew5 correctly returns HTTP 404. Partial credit: no Markdown error body was detected.
How to pass
Keep the correct HTTP 404 status. The remaining requirement is a Markdown error body when agents request Accept: text/markdown. Include at least 20 characters explaining the error and a link to your docs, sitemap, or llms.txt. Verify with curl -sS -L -i -H 'Accept: text/markdown' https://yourdomain.com/some-path-that-does-not-exist. Check both the final 404 status and the Markdown body with Content-Type: text/markdown. Checking the status alone does not verify the missing requirement.
No sitemap found
How to pass
Add a valid XML sitemap at /sitemap.xml listing all indexable URLs. Include lastmod dates and keep it under 50MB.
No JSON-LD structured data found on homepage
How to pass
Add JSON-LD structured data to your homepage using the identity type that matches your site - SoftwareApplication for products, Organization or LocalBusiness for companies, Person for personal sites, Article for blogs - with name, description, url, and type-appropriate fields (offers, sameAs, author) so AI can parse your identity programmatically.
API/docs link found on homepage and resolves: /apidoc
No metadata signals found - missing: canonical URL, HTML lang attribute, og:image, og:type
How to pass
Add all four signals to your homepage: <link rel="canonical">, <html lang="...">, <meta property="og:image">, and <meta property="og:type">. Agents use these for entity resolution and attribution.
About, Contact pages verified - missing: Privacy
How to pass
Publish real /about, /contact, and /privacy pages with at least 500 characters of content each. These are the pages AI agents check to verify your business is legitimate before recommending you.
All 6 measured pages fit an agent context budget (largest ~2K tokens)
No publicly reachable API surface detected (REST and GraphQL both absent or auth-gated)
How to pass
Expose a public REST or GraphQL API. AI agents need programmatic access - not just a web UI - to integrate with your product.
Onboarding signals described but not verified live: self-serve key generation
How to pass
Offer a free tier or trial, self-serve API key generation, and a sandbox environment. Agents can't fill out 'contact sales' forms.
MCP mentioned at https://packagist.org/packages/mcp/sdk but no standard manifest endpoint found
How to pass
Build an MCP (Model Context Protocol) server exposing your API as tools. Use Streamable HTTP transport for full score. This lets Claude, ChatGPT, and other AI agents call your product natively.
No CLI tool found
How to pass
Publish an official CLI tool on npm, PyPI, or Homebrew. A CLI lets agents and developers script interactions with your product without building API integrations from scratch.
Agent discovered 1 developer-resource type by name (SDK documentation) across 2 pages
packagist.org ranks #1 for "packagist package repository"
Wikidata Q108311377 (Packagist) verified - draft a Wikipedia page with cited references to complete knowledge graph coverage
How to pass
Establish a Wikipedia article and a Wikidata entity for your brand, with the domain set as the official website (Wikidata property P856) and a corresponding external link on Wikipedia. Wikipedia is the largest single source of citations in ChatGPT and a primary input to Knowledge Graphs across Google, Bing, and LLM training data. Earn third-party press coverage first to satisfy notability, then draft the article with cited references rather than self-promotion.
Agent config found: github.com/composer/packagist/blob/main/CLAUDE.md
Server HTML is a well-structured document (main=true, landmarks=4/4, h1=1, maxHeadingSkip=1).
45 native controls, 0 non-native div-soup affordances (100% native).
44/45 interactive elements have a computable accessible name (98%).
No hidden instruction text detected in accessibility-tree attributes or off-screen content.
What does packagist.org do and who is it for? Explain it back to me.
Sign me up for Vercel product updates and marketing emails.
Unsubscribe anytime. Privacy Notice
Source: Ora API
What does packagist.org do and who is it for? Explain it back to me.
8 steps2 reasoning steps1 search
The agent successfully gathered a complete, well-rounded explanation of Packagist's purpose, pricing, and competitive position. The site provided core identity information (what it is, who it's for, free public offering), but comparative differentiation required external search results; pricing details required navigating to the separate packagist.com domain.