# huggingface.co: agentic web grade A

Score 57 (coverage 30 + breadth 12 + conformance 15); 6 standards observed across 3 of 9 steps; checked 2026-10-18T22:06:01Z. This grades the agent-facing files published at huggingface.co, not the organisation's products.

## Manifests

| Manifest | Path | Result | Errors | Warnings |
| --- | --- | --- | --- | --- |
| Agentic Resource Discovery | /.well-known/ard.json | absent |  |  |
| AI Catalog well-known file | /.well-known/ai-catalog.json | valid |  | entries[1] has no description; registries index on it |
| MCP Server Cards (SEP-2127) | /mcp/server-card | valid |  | remotes[0].supportedProtocolVersions missing; clients use it to pick a version before connecting |
| Agent2Agent Protocol | /.well-known/agent-card.json | absent |  |  |
| llms.txt | /llms.txt | absent |  |  |
| AGENTS.md | /AGENTS.md | absent |  |  |
| api-catalog: A Well-Known URI and Link Relation to Help Discovery of APIs | /.well-known/api-catalog | valid |  |  |
| AI Crawler User-Agent Tokens in robots.txt | /robots.txt | valid |  | no AI crawler token named (GPTBot, OAI-SearchBot, ChatGPT-User, ClaudeBot, ...); the policy for them is whatever User-agent: * says (allowed); no Agentmap: line (optional convention pointing agents at /.well-known/ard.json); no Content-Signal: line (optional; states ai-train / search / ai-input preferences) |
| security.txt (RFC 9116) | /.well-known/security.txt | errors | Contact: security@huggingface.co is not a mailto:, https: or tel: URI | Canonical: missing |
| auth.md | /auth.md | absent |  |  |

## Standards observed

- AI Catalog well-known file: https://huggingface.co/.well-known/ai-catalog.json (https://agenticweb.wiki/protocols/ai-catalog-well-known-file/)
- api-catalog: A Well-Known URI and Link Relation to Help Discovery of APIs: https://huggingface.co/.well-known/api-catalog (https://agenticweb.wiki/protocols/api-catalog-rfc9727/)
- OAuth Protected Resource and Authorization Server Metadata (as used for agent authorization): https://huggingface.co/.well-known/oauth-protected-resource (https://agenticweb.wiki/protocols/oauth-metadata-for-agents/)
- MCP Server Cards (SEP-2127): undefined (https://agenticweb.wiki/protocols/mcp-server-cards/)
- Model Context Protocol: undefined (https://agenticweb.wiki/protocols/mcp/)
- AI Crawler User-Agent Tokens in robots.txt: undefined (https://agenticweb.wiki/protocols/ai-crawler-tokens-robots/)

## Cheapest next steps

1. llms.txt: one Markdown index file; the most widely read agent-facing file (https://agenticweb.wiki/protocols/llms-txt/)
2. Agentic Resource Discovery: a catalog at /.well-known/ard.json lets agents discover your APIs, MCP servers and data in one fetch (https://agenticweb.wiki/protocols/ard/)
3. AGENTS.md: instructions for coding agents working on or with the site (https://agenticweb.wiki/protocols/agents-md/)

## Rubric

+10 per lifecycle step with a standard observed, counting manifests that validate or that the probe rule for the standard recognises (a valid MCP server card counts for MCP; max 90); +3 per observed standard beyond the first two (max 15); conformance +15 (+10 with one manifest) minus 5 per agent-facing manifest with errors, never below 0 (security.txt is reported, not scored). A+ >= 60, A >= 45, B >= 30, C >= 20, D >= 10.

JSON: https://agenticweb.wiki/check/huggingface.co/index.json · badge: https://agenticweb.wiki/badge/huggingface.co.svg