# WebMCP Score: What A+ to F Means (and How to Stop Failing) *Your site just got a D. Now what?* --- We built WebMCP Verify because nobody could answer a simple question: **how ready is my website for AI agents?** Chrome 146 shipped WebMCP in early preview three weeks ago. The W3C spec is moving fast. And most websites? They're completely unprepared. We've been scanning sites since launch, and the numbers are rough — the average score across all scans is somewhere around 40 out of 100. ![WebMCP Verify full report — mdconvrt.com scores 63/100 (D grade)](https://photo.webmcpverify.com/blog-images/report-full-mdconvrt.jpg) *mdconvrt.com scan result: 63/100, Grade D. Scores 28/30 on AI Discoverability but 0/10 on Best Practices.* This post breaks down exactly what the score means, what each grade looks like in practice, and — most importantly — what to fix first to climb from F to A. ## The Scoring System WebMCP Verify runs 15 automated checks across 4 categories. Each category has a different weight because, frankly, not everything matters equally. - **A. WebMCP Tool Registration (40%)** — Are you actually exposing tools to agents? - **B. AI Discoverability (30%)** — Can agents find and understand your site? - **C. Security & Compatibility (20%)** — Is your site safe for agent interactions? - **D. Best Practices (10%)** — Are your tools well-documented and properly annotated? The weights reflect reality: it doesn't matter how good your Schema.org markup is if you haven't registered a single tool. Tool Registration gets 40% because that's the whole point of WebMCP. ## What Each Grade Actually Means **A+ (95-100) — Agent-Native** Your site was built with AI agents in mind. Both declarative and imperative APIs are implemented, structured data is thorough, security headers are locked down, and your tools have proper descriptions, schemas, and annotations. You're ready for the agentic web. Sites like this are rare right now — we've seen maybe a handful. **A (85-94) — Excellent** Nearly everything is in place. You might be missing one or two minor things — maybe a tool annotation here, a slightly sparse inputSchema there. An agent can reliably discover and use your site's tools. **B (70-84) — Good Foundation** You've done the important work. Tools are registered (at least one API type), discoverability is solid, HTTPS is set up. But there are gaps: maybe your inputSchema definitions are incomplete, or you haven't added llms.txt yet. A few hours of work gets you to A. **C (50-69) — Partially Ready** This is where most "modern" sites land. You've got HTTPS, probably decent meta tags, maybe some Schema.org markup. But no WebMCP tool registration at all. It's like having a storefront with no door — agents can see you exist but can't actually do anything. **D (30-49) — Minimal** Basic web hygiene is there (HTTPS, some meta tags), but that's about it. No tool registration, limited discoverability, possibly missing robots.txt rules for AI bots. This was mdconvrt.com's score when we first scanned it — 63 points thanks to strong discoverability, but zero on Best Practices. **F (0-29) — Not Ready** The site fails on multiple fronts. Maybe it's HTTP-only, blocking AI bots in robots.txt, has no structured data, and obviously no WebMCP implementation. GitHub.com scored 33 in our tests — surprising for a tech giant, but they haven't implemented WebMCP yet. ## The 15 Checks, Explained Let's walk through every check. This is what you'll see on your report page. ### Category A: WebMCP Tool Registration (40 points) **A1. Declarative Tool Registration (15 pts)** Does your HTML have forms with `toolname` and `tooldescription` attributes? ```html ``` This is the easiest way to expose tools. If your site already has forms (search bars, contact forms, checkout flows), you're just adding attributes. No JavaScript required. **A2. Imperative Tool Registration (15 pts)** Is `navigator.modelContext.registerTool()` being called? ```javascript if ('modelContext' in navigator) { navigator.modelContext.registerTool({ name: 'add-to-cart', description: 'Add a product to the shopping cart by product ID and quantity', inputSchema: { type: 'object', properties: { productId: { type: 'string', description: 'Product SKU or ID' }, quantity: { type: 'number', description: 'Number of items (1-99)' } }, required: ['productId'] }, execute: async ({ productId, quantity = 1 }) => { const result = await cartAPI.add(productId, quantity); return { content: [{ type: 'text', text: JSON.stringify(result) }] }; } }); } ``` Use this for anything interactive, stateful, or dynamic. If your declarative forms cover the basics, the imperative API handles the complex stuff. **A3. Form Input Quality (10 pts)** Do your form inputs have `name`, `type`, `required`, and `pattern` attributes? Bad: ```html ``` Good: ```html ``` Agents use these attributes to understand what data to provide. An input with no `name` is invisible. An input with no `type` is ambiguous. ### Category B: AI Discoverability (30 points) **B1. Structured Data / Schema.org (8 pts)** Is there JSON-LD or microdata on the page? ```html ``` This helps agents understand *what* your site is before they even look at your tools. **B2. llms.txt (7 pts)** Does `/llms.txt` or `/llms-full.txt` exist? This relatively new standard gives LLMs a plain-text overview of your site. Think of it as `robots.txt` but for AI understanding rather than crawling permissions. Bluehost, Yoast, and others are already shipping plugins for it. **B3. Meta Description (5 pts)** Is there a descriptive `` tag? Basic, but you'd be surprised how many SPAs forget this. **B4. Open Graph Tags (5 pts)** Are `og:title`, `og:description`, `og:type`, `og:url` present? These aren't just for social sharing — agents use them for context too. **B5. Robots.txt AI Bots (5 pts)** Does your `robots.txt` explicitly allow AI crawlers? ``` User-agent: GPTBot Allow: / User-agent: Claude-Web Allow: / User-agent: PerplexityBot Allow: / ``` Many sites accidentally block AI bots by being too aggressive with their robots.txt. If your robots.txt only says `User-agent: * / Allow: /` without specific AI bot rules, you'll get partial credit. Explicit rules for GPTBot, Claude-Web, and others get full marks. ### Category C: Security & Compatibility (20 points) **C1. HTTPS / Secure Context (10 pts)** Is the site served over HTTPS? WebMCP APIs require a secure context. No HTTPS = no `navigator.modelContext`. Period. **C2. Content Security Policy (5 pts)** Does the CSP allow WebMCP to function? Overly restrictive CSP headers can block the inline scripts needed for tool registration. **C3. Mixed Content (5 pts)** Are there HTTP resources loaded on an HTTPS page? Mixed content breaks the secure context chain and causes unpredictable agent behavior. ### Category D: Best Practices (10 points) **D1. Tool Naming Quality (3 pts)** Are tool names descriptive and verb-based? Bad: `tool1`, `handler`, `form_submit` Good: `search-products`, `add-to-cart`, `book-appointment` Agents parse tool names to decide which tool to call. `search-products` is self-explanatory. `handler` tells them nothing. **D2. Tool Description Quality (2 pts)** Are descriptions at least 20 characters and actually descriptive? Bad: `"Search stuff"` Good: `"Search the product catalog by name, category, or price range. Returns up to 20 results sorted by relevance."` More context = better agent decisions = fewer failed tool calls. **D3. Input Schema Completeness (3 pts)** Does the inputSchema define types, descriptions, and required fields for every parameter? **D4. Tool Annotations (2 pts)** Are `readOnlyHint`, `destructiveHint`, and other annotations present? ```javascript { name: 'delete-account', annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false } } ``` These hints tell agents about the consequences of calling a tool. An agent should be extra careful before calling something marked `destructiveHint: true`. Only 2 points, but it matters for agent safety. ## The Fastest Path from F to A If your site is stuck at F or D, here's the priority order. Each step gets you the most points for the least effort: ### Step 1: HTTPS (instant +10) If you're still on HTTP, fix this first. Let's Encrypt is free. This unlocks 10 points AND is a prerequisite for all WebMCP APIs. ### Step 2: Meta tags + OG tags (+10) Add a meta description and basic Open Graph tags. Five minutes of work, 10 points. ### Step 3: robots.txt AI bot rules (+5) Add explicit Allow rules for GPTBot, Claude-Web, Google-Extended, and PerplexityBot. ### Step 4: Schema.org JSON-LD (+8) Add a single `