Agent Readiness is nineteen dimensions and a hundred and thirty-nine points. Fifty-eight of those points are earned by publishing documents about an API you already have — not by changing a line of it.
That number is not a slogan. It is the sum of nine dimensions, and we have published the blueprint listing which files earn which points, because most of what an agent needs to know about an API was never in the API. It was in a portal, a PDF, and somebody’s head.
| document | dimension | points |
|---|---|---|
/.well-known/oauth-authorization-server |
Auth Clarity, Registration, Delegated Identity | 21 |
| MCP server card, with a server that answers | MCP Server | 12 |
/.well-known/agent-card.json |
A2A Agent Card | 8 |
/.well-known/oauth-protected-resource |
Protected Resource Metadata | 5 |
| Agent skills index | Agent Skills | 5 |
/.well-known/api-catalog |
Well-Known Catalog | 4 |
| HTTP message signatures directory | Consent & Bot Identity | 3 |
The largest single entry is the one most providers already have and have never declared. If you run OAuth, your authorization server metadata is a description of infrastructure that exists. Publishing it is worth twenty-one points, and it is the difference between an agent registering itself and a developer filling in a form at 2am.
Serving the file is half of it
Several of these are read from the common[] pointers in your APIs.json, not from a blind sweep of your domain. A document served at the right path and never declared is a document nothing has a reason to go looking for. Publish the file and list it.
MCP is the exception in the other direction: it is scored on a probe, not a pointer. A server card describing an endpoint that does not respond earns exactly what no card earns.
The cheapest big win almost nobody takes
Declare Idempotency-Key on your mutating operations. Nine points, and the header is usually already supported — saying so in the contract is a schema edit. An agent that cannot tell whether a retry will double-charge a customer does not retry, and an agent that does not retry is an integration that fails on the first timeout.
The same logic runs through the rest of it. Documented reversibility is six points because an agent that cannot undo will not act. Rate-limit headers are seven because a caller that can read its budget does not have to discover it by being throttled.
What it earns beyond the number
Every provider in the exemplar band is measured on Model Visibility, free — what Claude, ChatGPT and Gemini say about your API, whether it is true, and whether any of it came from us.
That is the loop, and it is why the blueprint is worth an afternoon: the documents that raise your score are the documents that make assistants describe you correctly. An OpenAPI a model can read is an OpenAPI a model can quote.
The blueprint also lists what we do not serve, and where our own numbers fall short. It would be a worse document without that.