agenticweb.wiki

mercury.com agentic web readiness

B Manifest validity: 80% (4/5 valid, 1 error, 14 warnings) · Surface score 39 (coverage 20 + breadth 9 + conformance 10). 5 standards observed across 2 of 9 steps; 5 manifests present (+ robots.txt), 1 error, 14 warnings. Checked 2026-10-25 17:45:36 UTC. This grades the agent-facing files published at mercury.com, not the organisation's products.

Badge for a README: ![agentic web grade](https://agenticweb.wiki/badge/mercury.com.svg) · JSON · Markdown · Re-check now

Coverage by step

01 DiscoverARD, AI Catalog well-known file, RFC 972702 Identifynothing observed03 Permitnothing observed04 Readnothing observed05 Act06 Coordinatenothing observed07 Paynothing observed08 Presentnothing observed

Manifests

ManifestResultFindings
Agentic Resource Discovery
/.well-known/ard.json		valid
  • entries[0] has no description; registries index on it
  • entries[1] has no description; registries index on it
  • entries[2] has no description; registries index on it
  • entries[3] has no description; registries index on it
AI Catalog well-known file
/.well-known/ai-catalog.json		valid
  • entries[0] has no description; registries index on it
  • entries[1] has no description; registries index on it
  • entries[2] has no description; registries index on it
  • entries[3] has no description; registries index on it
MCP Server Cards (SEP-2127)
/.well-known/mcp/server-card.json		valid
  • Content-Type is application/json; SEP-2127 says serve application/mcp-server-card+json
  • remotes[0].supportedProtocolVersions missing; clients use it to pick a version before connecting
  • no ETag
Agent2Agent Protocol
/.well-known/agent-card.json		absent HTTP 404
llms.txt
/llms.txt		absent HTTP 410
AGENTS.md
/AGENTS.md		absent HTTP 404
Agent Skills
/.well-known/agent-skills/index.json		absent HTTP 404
api-catalog: A Well-Known URI and Link Relation to Help Discovery of APIs
/.well-known/api-catalog		valid
AI Crawler User-Agent Tokens in robots.txt
/robots.txt		no AI tokens
  • no AI crawler token named (GPTBot, OAI-SearchBot, ChatGPT-User, ClaudeBot, ...); the policy for them is whatever User-agent: * says (partial)
  • no Agentmap: line (optional convention pointing agents at /.well-known/ard.json)
  • no Content-Signal: line (optional; states ai-train / search / ai-input preferences)
security.txt (RFC 9116)
/.well-known/security.txt		absent HTTP 404
auth.md
/auth.md		errors
  • none of the auth.md mechanism names found (identity_assertion, service_auth, anonymous)
View valid /auth.md template for mercury.com
# Authenticating to Mercury as an agent

This file is the agent-auth skill for mercury.com. It is linked from the authorization server's metadata (`agent_auth.skill`).

## Discovery
1. Call the API. A `401` carries `WWW-Authenticate: Bearer resource_metadata="https://mercury.com/.well-known/oauth-protected-resource"`.
2. Read `/.well-known/oauth-protected-resource` (RFC 9728) for `resource` and `authorization_servers`.
3. Read the authorization server's `/.well-known/oauth-authorization-server` (RFC 8414); the `agent_auth` block lists the endpoints below.

## Methods we accept
- `identity_assertion`: you hold a session for a user and can mint an ID-JAG with `aud` = our `resource`. Preferred.
- `service_auth`: you only know the user's email. A claim ceremony (6-digit code) is required.
- `anonymous`: no user. Immediate limited scopes; the user can claim later.

## Register
POST `agent_auth.identity_endpoint` with `{"type": "<method>", ...}`; exchange the returned `identity_assertion` at the token endpoint for an access token.

## Scopes
- `api.read`: read
- `api.write`: write (claimed registrations only)

## Rules
- Show the user our name and the scopes before asserting their identity.
- Keep `claim_token` in memory only.
- Revocation events arrive as Security Event Tokens at your registered events endpoint.
Open Knowledge Format
/okf/index.md		absent HTTP 404

What an agent can call

Standards observed

Cheapest next steps

  1. llms.txt: one Markdown index file; the most widely read agent-facing file
    Generate starter /llms.txt for mercury.com
    # Mercury

> Mercury and what it offers to agents

Short notes an agent should know before using the site: what it is for, who runs it, how to cite it.

## Docs
- [Getting started](https://mercury.com/docs/getting-started): the first page to read
- [API reference](https://mercury.com/openapi.json): OpenAPI description

## Optional
- [Changelog](https://mercury.com/changelog): what changed, newest first
  2. AGENTS.md: instructions for coding agents working on or with the site
    Generate starter /AGENTS.md for mercury.com
    # Mercury for agents

Mercury and what it offers to agents

## Read the data, not the HTML
- Index: https://mercury.com/llms.txt
- API description: https://mercury.com/openapi.json
- Discovery catalog: https://mercury.com/.well-known/ard.json

## Calling
- MCP server (Streamable HTTP): https://mercury.com/mcp
- Rate limits and authentication: describe them here

## Conventions
- How to cite or attribute content
- What not to do (no scraping of /account/, no automated sign-ups, etc.)

Contact: security@mercury.com
  3. security.txt (RFC 9116): RFC 9116 contact and expiry, read by agents and people
    Generate starter /.well-known/security.txt for mercury.com
    Contact: mailto:security@mercury.com
Expires: 2027-09-20T23:44:18Z
Canonical: https://mercury.com/.well-known/security.txt
Preferred-Languages: en
Policy: https://mercury.com/security-policy

Agent pre-flight & practical readiness

Preferred mode: mcp. Call the MCP endpoint at https://mcp.mercury.com/mcp first. Do not scrape the HTML when a tool can answer.

Fetch: POST https://mcp.mercury.com/mcp POST a JSON-RPC tools/list, or server/discover on the 2026-07-28 revision, before reading HTML.

Practical readability: exa_parsable yes, markdown negotiation no, render ssr_rich, HTML quality high, first content at byte 180960 (~177 KB of head/script markup before main text), JSON-LD Organization, PostalAddress, ContactPoint, Person, FinancialService, OfferCatalog, Offer, WebSite, MobileApplication, AggregateRating.

AI crawler posture: open_to_all · Assistant access: OpenAI allowed, Anthropic allowed, Google allowed, Perplexity allowed, Exa allowed.

Readiness subscores: reach 20/20, readability 22/30, capabilities 15/35, conformance 10/15, total 67/100, grade A.

How the grade is made

+10 per lifecycle step with a standard observed, counting manifests that validate or that the probe rule for the standard recognises (a valid MCP server card counts for MCP; max 90); +3 per observed standard beyond the first two (max 15); conformance +15 (+10 with one manifest) minus 5 per agent-facing manifest with errors, never below 0 (security.txt is reported, not scored). Lifecycle grade: A+ >= 60, A >= 45, B >= 30, C >= 20, D >= 10. Strict 100-point composite (subscores.total_100 / subscores.grade_100): reach_and_policy (20) + readability (30) + capabilities (35) + conformance (15), where A+ >= 80, A >= 65, B >= 45, C >= 28, D >= 15. Errors are specification violations; warnings are best-practice gaps. Only public paths are fetched, without credentials, so standards that need a login (skipped in the probe) are not counted either way. The same report is the validate_manifest tool on the MCP server.

JSON · Markdown · probe rules