Aso Audit MCP server

aso-mcp — the free Agent Readiness Scanner

What's your ASO score?

SEO made you visible to search engines. ASO (Agent Signal Optimization) makes you discoverable, trustable, and payable by the AI agents that are becoming the web's next visitors.

aso-mcp is the free, open-source ASO Scanner — an MCP server that scans any website and produces an Agent Readiness Report scored on the open ASO framework. The beta npm package is @forgemeshlabs/aso-audit-mcp.

This release tracks Google's current agent-readiness guidance without overstating it: Google Search says traditional SEO fundamentals still apply to generative AI search, llms.txt is ignored by Google Search itself, and browser agents benefit from clean DOM, screenshot, and accessibility-tree signals. The scanner keeps llms.txt because non-Google agents use it, and adds a browser-agent UX check for semantic controls, linked labels, ARIA/role fallbacks, and hidden-overlay risk.

Beta. Experimental ASO scanner for evaluating whether agents can discover, trust, understand, and use a website/API/tool. ASO scoring is experimental and will evolve as agent standards mature.

=== Agent Readiness Report: https://example.com ===
ASO Score: 70/100
Agent Readiness: Ready
Level: ASO-4 Trustable — Agents can verify trust, reputation, and operational signals.

Discoverability  20/20    Identity  15/20    Trust   11/15
Commerce          5/15    Reputation 4/15    Memory  15/15

What it checks — 34 signals across 6 pillars

Find gaps in discovery, trust, interoperability, and commerce — every emerging agent standard in one scan:

Deterministic x402 v2 endpoint audit

The MCP tool auditx402endpoint complements the origin-wide ASO scan with a no-spend protocol audit of one paid endpoint. It returns a 0-100 score, A-F grade, compliance verdict, per-check booleans, failed checks, and observed schemes/networks/extensions. It validates the live 402 challenge but never sends PAYMENT-SIGNATURE, so it cannot authorize or settle a payment.

Checks: HTTPS/TLS, HTTP 402, PAYMENT-REQUIRED, Base64 JSON, x402Version: 2, non-empty accepts, CAIP-2 networks, required payment fields, and JSON content type. For body-gated routes, pass method, body, and optionally content_type.

This is deliberately reported separately from the ASO Score: protocol compliance does not prove discoverability, trust, settlement, idempotency, or paid-response quality.

Living standards model

Shortened. The full README is on GitHub.