c2pa.org agentic web readiness

A+ Manifest validity: 100% (3/3 valid, 0 errors, 8 warnings) · Surface score 64 (coverage 40 + breadth 9 + conformance 15). 5 standards observed across 4 of 9 steps; 3 manifests present (+ robots.txt), 0 errors, 8 warnings. Checked 2026-10-25 22:05:52 UTC. This grades the agent-facing files published at c2pa.org, not the organisation's products.

Badge for a README: ![agentic web grade](https://agenticweb.wiki/badge/c2pa.org.svg) · JSON · Markdown · Re-check now

Coverage by step

01 DiscoverRFC 9727 02 Identifynothing observed 03 PermitContent Signals Policy 04 Readllms.txt, Markdown for Agents 05 ActAgent Skills 06 Coordinatenothing observed 07 Paynothing observed 08 Presentnothing observed 09 Accountnothing observed

Manifests

Manifest	Result	Findings
Agentic Resource Discovery `/.well-known/ard.json`	absent HTTP 404
AI Catalog well-known file `/.well-known/ai-catalog.json`	absent HTTP 404
MCP Server Cards (SEP-2127) `/mcp/server-card`	absent HTTP 404
Agent2Agent Protocol `/.well-known/agent-card.json`	absent HTTP 404
llms.txt `/llms.txt`	valid	no blockquote summary under the title
AGENTS.md `/AGENTS.md`	absent HTTP 404
Agent Skills `/.well-known/agent-skills/index.json`	valid	skills[0].digest missing skills[1].digest missing skills[2].digest missing skills[3].digest missing
api-catalog: A Well-Known URI and Link Relation to Help Discovery of APIs `/.well-known/api-catalog`	valid	linkset[0].service-desc has no type (e.g. application/openapi+json)
AI Crawler User-Agent Tokens in robots.txt `/robots.txt`	no AI tokens	no AI crawler token named (GPTBot, OAI-SearchBot, ChatGPT-User, ClaudeBot, ...); the policy for them is whatever User-agent: * says (partial) no Agentmap: line (optional convention pointing agents at /.well-known/ard.json)
security.txt (RFC 9116) `/.well-known/security.txt`	absent HTTP 404
auth.md `/auth.md`	absent HTTP 404
Open Knowledge Format `/okf/index.md`	absent HTTP 404

What an agent can call

API description https://c2pa.org/wp-json/ (service-desc)
API description https://developer.wordpress.org/rest-api/ (service-doc)
llms.txt: Coalition for Content Provenance and Authenticity (C2PA), 13 links
robots.txt AI policy: no AI crawler tokens named; unlisted crawlers allowed on public paths (subpaths disallowed under User-agent: *)

Standards observed

llms.txt https://c2pa.org/llms.txt
Content Signals Policy https://c2pa.org/robots.txt
api-catalog: A Well-Known URI and Link Relation to Help Discovery of APIs https://c2pa.org/.well-known/api-catalog
Agent Skills https://c2pa.org/.well-known/agent-skills/index.json
Markdown for Agents https://c2pa.org/

Cheapest next steps

Agentic Resource Discovery: a catalog at /.well-known/ard.json lets agents discover your APIs, MCP servers and data in one fetch (emerging spec — publish only if you run the underlying endpoints; generate via MCP template({"id": "ard", "domain": "c2pa.org"}))

AGENTS.md: instructions for coding agents working on or with the site

Generate starter /AGENTS.md for c2pa.org

# C2pa for agents

C2pa and what it offers to agents

## Read the data, not the HTML
- Index: https://c2pa.org/llms.txt
- API description: https://c2pa.org/openapi.json
- Discovery catalog: https://c2pa.org/.well-known/ard.json

## Calling
- MCP server (Streamable HTTP): https://c2pa.org/mcp
- Rate limits and authentication: describe them here

## Conventions
- How to cite or attribute content
- What not to do (no scraping of /account/, no automated sign-ups, etc.)

Contact: security@c2pa.org

security.txt (RFC 9116): RFC 9116 contact and expiry, read by agents and people

Generate starter /.well-known/security.txt for c2pa.org

Contact: mailto:security@c2pa.org
Expires: 2027-09-20T22:05:52Z
Canonical: https://c2pa.org/.well-known/security.txt
Preferred-Languages: en
Policy: https://c2pa.org/security-policy

Agent pre-flight & practical readiness

Preferred mode: openapi (fallback agent_skills). Read the published API description and call those operations. Scraping HTML skips the interface the site already gave you.

Fetch: GET https://c2pa.org/wp-json/ GET the API description and call the documented operations.

Practical readability: exa_parsable yes, markdown negotiation yes, render markdown_native, HTML quality high, first content at byte 0, HTML-to-llms.txt token ratio 5.489×.

AI crawler posture: open_to_all · Assistant access: OpenAI allowed, Anthropic allowed, Google allowed, Perplexity allowed, Exa allowed.

Readiness subscores: reach 20/20, readability 30/30, capabilities 19/35, conformance 15/15, total 84/100, grade A+.

How the grade is made

+10 per lifecycle step with a standard observed, counting manifests that validate or that the probe rule for the standard recognises (a valid MCP server card counts for MCP; max 90); +3 per observed standard beyond the first two (max 15); conformance +15 (+10 with one manifest) minus 5 per agent-facing manifest with errors, never below 0 (security.txt is reported, not scored). Lifecycle grade: A+ >= 60, A >= 45, B >= 30, C >= 20, D >= 10. Strict 100-point composite (subscores.total_100 / subscores.grade_100): reach_and_policy (20) + readability (30) + capabilities (35) + conformance (15), where A+ >= 80, A >= 65, B >= 45, C >= 28, D >= 15. Errors are specification violations; warnings are best-practice gaps. Only public paths are fetched, without credentials, so standards that need a login (skipped in the probe) are not counted either way. The same report is the validate_manifest tool on the MCP server.

JSON · Markdown · probe rules