beehiiv.com agentic web readiness

A+ Manifest validity: 83% (5/6 valid, 1 error, 9 warnings) · Surface score 65 (coverage 40 + breadth 15 + conformance 10). 9 standards observed across 4 of 9 steps; 6 manifests present, 1 error, 9 warnings. Checked 2026-10-25 13:56:07 UTC via www.beehiiv.com. This grades the agent-facing files published at beehiiv.com, not the organisation's products.

Badge for a README: ![agentic web grade](https://agenticweb.wiki/badge/beehiiv.com.svg) · JSON · Markdown · Re-check now

Coverage by step

01 DiscoverAI Catalog well-known file, RFC 9727 02 Identifynothing observed 03 PermitContent Signals Policy, AI Crawler User-Agent Tokens in robots.txt, OAuth Protected Resource and Authorization Server Metadata (as used for agent authorization)04 Readllms.txt, Markdown for Agents 05 Act 06 Coordinatenothing observed 07 Paynothing observed 08 Presentnothing observed 09 Accountnothing observed

Manifests

Manifest	Result	Findings
Agentic Resource Discovery `/.well-known/ard.json`	absent HTTP 404
AI Catalog well-known file `/.well-known/ai-catalog.json`	valid	entries[0] has no description; registries index on it entries[1] has no description; registries index on it served only at deprecated /.well-known/ai-catalog.json; ARD v0.91+ expects /.well-known/ard.json (serve both during migration)
MCP Server Cards (SEP-2127) `/mcp/server-card`	valid	Content-Type is application/json; SEP-2127 says serve application/mcp-server-card+json description is over 100 characters remotes[0].supportedProtocolVersions missing; clients use it to pick a version before connecting no Cache-Control max-age; clients should be able to cache the card no ETag
Agent2Agent Protocol `/.well-known/agent-card.json`	absent HTTP 404
llms.txt `/llms.txt`	valid
AGENTS.md `/AGENTS.md`	absent HTTP 404
Agent Skills `/.well-known/agent-skills/index.json`	absent HTTP 404
api-catalog: A Well-Known URI and Link Relation to Help Discovery of APIs `/.well-known/api-catalog`	valid
AI Crawler User-Agent Tokens in robots.txt `/robots.txt`	valid
security.txt (RFC 9116) `/.well-known/security.txt`	absent HTTP 404
auth.md `/auth.md`	errors	none of the auth.md mechanism names found (identity_assertion, service_auth, anonymous) View valid `/auth.md` template for beehiiv.com # Authenticating to Beehiiv as an agent This file is the agent-auth skill for beehiiv.com. It is linked from the authorization server's metadata (`agent_auth.skill`). ## Discovery 1. Call the API. A `401` carries `WWW-Authenticate: Bearer resource_metadata="https://beehiiv.com/.well-known/oauth-protected-resource"`. 2. Read `/.well-known/oauth-protected-resource` (RFC 9728) for `resource` and `authorization_servers`. 3. Read the authorization server's `/.well-known/oauth-authorization-server` (RFC 8414); the `agent_auth` block lists the endpoints below. ## Methods we accept - `identity_assertion`: you hold a session for a user and can mint an ID-JAG with `aud` = our `resource`. Preferred. - `service_auth`: you only know the user's email. A claim ceremony (6-digit code) is required. - `anonymous`: no user. Immediate limited scopes; the user can claim later. ## Register POST `agent_auth.identity_endpoint` with `{"type": "<method>", ...}`; exchange the returned `identity_assertion` at the token endpoint for an access token. ## Scopes - `api.read`: read - `api.write`: write (claimed registrations only) ## Rules - Show the user our name and the scopes before asserting their identity. - Keep `claim_token` in memory only. - Revocation events arrive as Security Event Tokens at your registered events endpoint.
Open Knowledge Format `/okf/index.md`	absent HTTP 404

What an agent can call

MCP endpoint https://www.beehiiv.com/api/mcp (streamable-http) — from /mcp/server-card
MCP endpoint https://www.beehiiv.com/api/mcp (streamable-http) — from /.well-known/mcp/server-card.json
API description https://developers.beehiiv.com/openapi/api-reference.json (application/json)
API description https://developers.beehiiv.com/ (text/html)
llms.txt: beehiiv, 94 links, llms-full.txt present
robots.txt AI policy: unlisted crawlers partial; Agentmap https://www.beehiiv.com/.well-known/ai-catalog.json
OAuth protected resource https://api.beehiiv.com/, authorization servers: https://app.beehiiv.com/
ARD bridge (/.well-known/ai-catalog.json): 1/2 valid, 0 legacy, 0 dead/broken (served at deprecated path only)

Standards observed

llms.txt https://beehiiv.com/llms.txt
Content Signals Policy https://beehiiv.com/robots.txt
AI Catalog well-known file https://beehiiv.com/.well-known/ai-catalog.json
api-catalog: A Well-Known URI and Link Relation to Help Discovery of APIs https://beehiiv.com/.well-known/api-catalog
AI Crawler User-Agent Tokens in robots.txt https://beehiiv.com/robots.txt
OAuth Protected Resource and Authorization Server Metadata (as used for agent authorization) https://beehiiv.com/.well-known/oauth-protected-resource
Markdown for Agents https://beehiiv.com/
MCP Server Cards (SEP-2127)
Model Context Protocol

Cheapest next steps

Agentic Resource Discovery: a catalog at /.well-known/ard.json lets agents discover your APIs, MCP servers and data in one fetch (emerging spec — publish only if you run the underlying endpoints; generate via MCP template({"id": "ard", "domain": "beehiiv.com"}))

AGENTS.md: instructions for coding agents working on or with the site

Generate starter /AGENTS.md for beehiiv.com

# Beehiiv for agents

Beehiiv and what it offers to agents

## Read the data, not the HTML
- Index: https://beehiiv.com/llms.txt
- API description: https://beehiiv.com/openapi.json
- Discovery catalog: https://beehiiv.com/.well-known/ard.json

## Calling
- MCP server (Streamable HTTP): https://beehiiv.com/mcp
- Rate limits and authentication: describe them here

## Conventions
- How to cite or attribute content
- What not to do (no scraping of /account/, no automated sign-ups, etc.)

Contact: security@beehiiv.com

security.txt (RFC 9116): RFC 9116 contact and expiry, read by agents and people

Generate starter /.well-known/security.txt for beehiiv.com

Contact: mailto:security@beehiiv.com
Expires: 2027-09-20T18:32:31Z
Canonical: https://beehiiv.com/.well-known/security.txt
Preferred-Languages: en
Policy: https://beehiiv.com/security-policy

Agent pre-flight & practical readiness

Preferred mode: mcp (fallback openapi). Call the MCP endpoint at https://www.beehiiv.com/api/mcp first. Do not scrape the HTML when a tool can answer.

Fetch: POST https://www.beehiiv.com/api/mcp POST a JSON-RPC tools/list, or server/discover on the 2026-07-28 revision, before reading HTML.

Practical readability: exa_parsable yes, markdown negotiation yes, render markdown_native, HTML quality high, first content at byte 0.

AI crawler posture: open_to_all · Assistant access: OpenAI partial, Anthropic allowed, Google allowed, Perplexity allowed, Exa allowed.

Readiness subscores: reach 20/20, readability 30/30, capabilities 31/35, conformance 10/15, total 91/100, grade A+.

How the grade is made

+10 per lifecycle step with a standard observed, counting manifests that validate or that the probe rule for the standard recognises (a valid MCP server card counts for MCP; max 90); +3 per observed standard beyond the first two (max 15); conformance +15 (+10 with one manifest) minus 5 per agent-facing manifest with errors, never below 0 (security.txt is reported, not scored). Lifecycle grade: A+ >= 60, A >= 45, B >= 30, C >= 20, D >= 10. Strict 100-point composite (subscores.total_100 / subscores.grade_100): reach_and_policy (20) + readability (30) + capabilities (35) + conformance (15), where A+ >= 80, A >= 65, B >= 45, C >= 28, D >= 15. Errors are specification violations; warnings are best-practice gaps. Only public paths are fetched, without credentials, so standards that need a login (skipped in the probe) are not counted either way. The same report is the validate_manifest tool on the MCP server.

JSON · Markdown · probe rules