gitlab.com agentic web readiness

B Manifest validity: 100% (1/1 valid, 0 errors, 5 warnings) · Surface score 33 (coverage 30 + breadth 3 + conformance 0). 3 standards observed across 3 of 9 steps; 1 manifest present, 0 errors, 5 warnings. Checked 2026-10-25 23:38:06 UTC. This grades the agent-facing files published at gitlab.com, not the organisation's products.

Badge for a README: ![agentic web grade](https://agenticweb.wiki/badge/gitlab.com.svg) · JSON · Markdown · Re-check now

Coverage by step

Manifests

What an agent can call

• MCP endpoint https://gitlab.com/api/v4/mcp (streamable-http) — from /.well-known/oauth-protected-resource
• robots.txt AI policy: no AI crawler tokens named; unlisted crawlers allowed on public paths (subpaths disallowed under User-agent: *)
• OAuth protected resource https://gitlab.com/api/v4/mcp, authorization servers: https://gitlab.com

Standards observed

• OAuth Protected Resource and Authorization Server Metadata (as used for agent authorization) https://gitlab.com/.well-known/oauth-protected-resource
• Markdown for Agents https://gitlab.com/
• Model Context Protocol

Cheapest next steps

1. llms.txt: one Markdown index file; the most widely read agent-facing file
   Generate starter /llms.txt for gitlab.com

   # Gitlab
   
   > Gitlab and what it offers to agents
   
   Short notes an agent should know before using the site: what it is for, who runs it, how to cite it.
   
   ## Docs
   - [Getting started](https://gitlab.com/docs/getting-started): the first page to read
   - [API reference](https://gitlab.com/openapi.json): OpenAPI description
   
   ## Optional
   - [Changelog](https://gitlab.com/changelog): what changed, newest first
   

2. Agentic Resource Discovery: a catalog at /.well-known/ard.json lets agents discover your APIs, MCP servers and data in one fetch (emerging spec — publish only if you run the underlying endpoints; generate via MCP template({"id": "ard", "domain": "gitlab.com"}))
3. AGENTS.md: instructions for coding agents working on or with the site
   Generate starter /AGENTS.md for gitlab.com

   # Gitlab for agents
   
   Gitlab and what it offers to agents
   
   ## Read the data, not the HTML
   - Index: https://gitlab.com/llms.txt
   - API description: https://gitlab.com/openapi.json
   - Discovery catalog: https://gitlab.com/.well-known/ard.json
   
   ## Calling
   - MCP server (Streamable HTTP): https://gitlab.com/mcp
   - Rate limits and authentication: describe them here
   
   ## Conventions
   - How to cite or attribute content
   - What not to do (no scraping of /account/, no automated sign-ups, etc.)
   
   Contact: security@gitlab.com
   

Agent pre-flight & practical readiness

Preferred mode: mcp (fallback markdown_negotiation). Call the MCP endpoint at https://gitlab.com/api/v4/mcp first. Do not scrape the HTML when a tool can answer. gitlab.com publishes no root agent discovery manifests, but docs.gitlab.com serves /llms.txt (445 links). Probe docs.gitlab.com or publish /.well-known/ard.json on gitlab.com to link them.

Fetch: POST https://gitlab.com/api/v4/mcp POST a JSON-RPC tools/list, or server/discover on the 2026-07-28 revision, before reading HTML.

Subdomain discovery hint (subdomain_stranded): gitlab.com publishes no root agent discovery manifests, but docs.gitlab.com serves /llms.txt (445 links). Probe docs.gitlab.com or publish /.well-known/ard.json on gitlab.com to link them. (check docs.gitlab.com)

Practical readability: exa_parsable yes, markdown negotiation yes, render markdown_native, HTML quality high, first content at byte 0.

AI crawler posture: open_to_all · Assistant access: OpenAI allowed, Anthropic allowed, Google allowed, Perplexity allowed, Exa allowed.

Readiness subscores: reach 20/20, readability 30/30, capabilities 16/35, conformance 0/15, total 66/100, grade A.

How the grade is made

+10 per lifecycle step with a standard observed, counting manifests that validate or that the probe rule for the standard recognises (a valid MCP server card counts for MCP; max 90); +3 per observed standard beyond the first two (max 15); conformance +15 (+10 with one manifest) minus 5 per agent-facing manifest with errors, never below 0 (security.txt is reported, not scored). Lifecycle grade: A+ >= 60, A >= 45, B >= 30, C >= 20, D >= 10. Strict 100-point composite (subscores.total_100 / subscores.grade_100): reach_and_policy (20) + readability (30) + capabilities (35) + conformance (15), where A+ >= 80, A >= 65, B >= 45, C >= 28, D >= 15. Errors are specification violations; warnings are best-practice gaps. Only public paths are fetched, without credentials, so standards that need a login (skipped in the probe) are not counted either way. The same report is the validate_manifest tool on the MCP server.

JSON · Markdown · probe rules