forgemeshlabs/aso-audit-mcp

**What's your ASO score?**
SEO made you visible to search engines. **ASO (Agent Signal Optimization)** makes you discoverable, trustable, and payable by the AI agents that are becoming the web's next visitors.
aso-mcp is the free, open-source **ASO Scanner** — an MCP server that scans any website and produces an **Agent Readiness Report** scored on the open ASO framework. The beta npm package is @forgemeshlabs/aso-audit-mcp.
This release tracks Google's current agent-readiness guidance without overstating it: Google Search says traditional SEO fundamentals still apply to generative AI search, llms.txt is ignored by Google Search itself, and browser agents benefit from clean DOM, screenshot, and accessibility-tree signals. The scanner keeps llms.txt because non-Google agents use it, and adds a browser-agent UX check for semantic controls, linked labels, ARIA/role fallbacks, and hidden-overlay risk.
> **Beta.** Experimental ASO scanner for evaluating whether agents can discover, trust, understand, and use a website/API/tool. ASO scoring is experimental and will evolve as agent standards mature.
What it checks — 34 signals across 6 pillars
Find gaps in **discovery, trust, interoperability, and commerce** — every emerging agent standard in one scan:
| Pillar / Category | Checks |
|---|---|
| **Discovery** | robots.txt, sitemap.xml, Link headers, DNS-AID (_agent. ), /.well-known/ai |
| **Content** | Markdown content negotiation, llms.txt, LLM-readable docs (/index.md, llms-full.txt) |
| **Bot Access** | Explicit AI crawler rules (GPTBot, ClaudeBot, Google-Extended, PerplexityBot…), Content Signals, Web Bot Auth |
| **Interoperability** | API Catalog (RFC 9727), OAuth discovery (RFC 8414), OAuth Protected Resource (RFC 9728), auth.md, **MCP Server Card** (/.well-known/mcp/server-card.json), **Google A2A Agent Card** (/.well-known/agent-card.json, required fields validated), Agent Skills, WebMCP |
| **Commerce** | x402, MPP, UCP, ACP, machine-readable pricing |
| **Identity & Trust** | HTTPS enforcement, JSON-LD/schema.org, agent-friendly browser UX, OpenAPI, agent.json, security.txt, status endpoint, versioning, cross-file identity & signal consistency |
Deterministic x402 v2 endpoint audit
The MCP tool audit_x402_endpoint complements the origin-wide ASO scan with a
no-spend protocol audit of one paid endpoint. It returns a 0-100 score, A-F
grade, compliance verdict, per-check booleans, failed checks, and observed
schemes/networks/extensions. It validates the live 402 challenge but never
sends PAYMENT-SIGNATURE, so it cannot authorize or settle a payment.
Checks: HTTPS/TLS, HTTP 402, PAYMENT-REQUIRED, Base64 JSON, x402Version: 2,
non-empty accepts, CAIP-2 networks, required payment fields, and JSON content
type. For body-gated routes, pass method, body, and optionally
content_type.
This is deliberately reported separately from the ASO Score: protocol
compliance does not prove discoverability, trust, settlement, idempotency, or
paid-response quality.
Living standards model
Agent protocols are changing quickly. The scanner is maintained as part of a
living framework: checks are versioned, and stable standards, optional
capabilities, release candidates, drafts, and vendor conventions are labeled
separately. See the dated scanner source list and the canonical
ASO source registry.
Every check returns **pass / partial / fail** with concrete evidence and a fix recommendation. Results roll up into the six ASO pillars (Discoverability 20, Identity 20, Trust 15, Commerce 15, Reputation 15, Memory 15) → your **ASO Score** and maturity level.
Install
Requires Node.js ≥ 20. Published on npm as @forgemeshlabs/aso-audit-mcp — no clone or build needed.
Or skip the install entirely and run it with npx (recommended for MCP clients):
Claude Code