agenticweb.wiki

vapi.ai agentic web readiness

B Manifest validity: 75% (3/4 valid, 4 errors, 6 warnings) · Surface score 43 (coverage 30 + breadth 3 + conformance 10). 3 standards observed across 3 of 9 steps; 4 manifests present (+ robots.txt), 4 errors, 6 warnings. Checked 2026-10-25 09:29:01 UTC. This grades the agent-facing files published at vapi.ai, not the organisation's products.

Badge for a README: ![agentic web grade](https://agenticweb.wiki/badge/vapi.ai.svg) · JSON · Markdown · Re-check now

Coverage by step

01 DiscoverRFC 972702 Identifynothing observed03 Permitnothing observed04 Readllms.txt05 ActAgent Skills06 Coordinatenothing observed07 Paynothing observed08 Presentnothing observed

Manifests

ManifestResultFindings
Agentic Resource Discovery
/.well-known/ard.json		absent HTTP 404
AI Catalog well-known file
/.well-known/ai-catalog.json		absent HTTP 404
MCP Server Cards (SEP-2127)
/.well-known/mcp/server-card.json		errors
  • $schema missing (required: https://static.modelcontextprotocol.io/schemas/v1/server-card.schema.json)
  • name missing
  • version missing
  • description missing
  • Content-Type is application/json; charset=utf-8; SEP-2127 says serve application/mcp-server-card+json
  • pre-final card shape (url/transport/tools); the final SEP-2127 card uses name, version, description and remotes[]
  • remotes missing: a card with no remotes gives clients nothing to connect to
View valid /mcp/server-card template for vapi.ai
{
  "$schema": "https://static.modelcontextprotocol.io/schemas/v1/server-card.schema.json",
  "name": "ai.vapi/vapi",
  "title": "Vapi",
  "version": "1.0.0",
  "description": "Vapi and what it offers to agents",
  "websiteUrl": "https://vapi.ai/",
  "icons": [
    {
      "src": "https://vapi.ai/icon.png",
      "mimeType": "image/png",
      "sizes": [
        "180x180"
      ]
    }
  ],
  "remotes": [
    {
      "type": "streamable-http",
      "url": "https://vapi.ai/mcp",
      "supportedProtocolVersions": [
        "2025-11-25",
        "2025-06-18",
        "2025-03-26"
      ]
    }
  ]
}
Agent2Agent Protocol
/.well-known/agent-card.json		absent HTTP 404
llms.txt
/llms.txt		valid
AGENTS.md
/AGENTS.md		absent HTTP 404
Agent Skills
/.well-known/agent-skills/index.json		valid
api-catalog: A Well-Known URI and Link Relation to Help Discovery of APIs
/.well-known/api-catalog		valid
AI Crawler User-Agent Tokens in robots.txt
/robots.txt		no AI tokens
  • no AI crawler token named (GPTBot, OAI-SearchBot, ChatGPT-User, ClaudeBot, ...); the policy for them is whatever User-agent: * says (partial)
  • no Agentmap: line (optional convention pointing agents at /.well-known/ard.json)
  • no Content-Signal: line (optional; states ai-train / search / ai-input preferences)
security.txt (RFC 9116)
/.well-known/security.txt		absent HTTP 404
auth.md
/auth.md		absent HTTP 404
Open Knowledge Format
/okf/index.md		absent HTTP 404

What an agent can call

Standards observed

Cheapest next steps

  1. Agentic Resource Discovery: a catalog at /.well-known/ard.json lets agents discover your APIs, MCP servers and data in one fetch (emerging spec — publish only if you run the underlying endpoints; generate via MCP template({"id": "ard", "domain": "vapi.ai"}))
  2. AGENTS.md: instructions for coding agents working on or with the site
    Generate starter /AGENTS.md for vapi.ai
    # Vapi for agents

Vapi and what it offers to agents

## Read the data, not the HTML
- Index: https://vapi.ai/llms.txt
- API description: https://vapi.ai/openapi.json
- Discovery catalog: https://vapi.ai/.well-known/ard.json

## Calling
- MCP server (Streamable HTTP): https://vapi.ai/mcp
- Rate limits and authentication: describe them here

## Conventions
- How to cite or attribute content
- What not to do (no scraping of /account/, no automated sign-ups, etc.)

Contact: security@vapi.ai
  3. security.txt (RFC 9116): RFC 9116 contact and expiry, read by agents and people
    Generate starter /.well-known/security.txt for vapi.ai
    Contact: mailto:security@vapi.ai
Expires: 2027-09-20T23:42:18Z
Canonical: https://vapi.ai/.well-known/security.txt
Preferred-Languages: en
Policy: https://vapi.ai/security-policy

Agent pre-flight & practical readiness

Preferred mode: openapi (fallback agent_skills). Read the published API description and call those operations. Scraping HTML skips the interface the site already gave you.

Fetch: GET https://docs.vapi.ai/openapi/api-reference.yaml GET the API description and call the documented operations.

Practical readability: exa_parsable yes, markdown negotiation no, render ssr_rich, HTML quality high, first content at byte 10900, HTML-to-llms.txt token ratio 30.894×, JSON-LD Organization, WebSite, SearchAction, EntryPoint.

AI crawler posture: open_to_all · Assistant access: OpenAI allowed, Anthropic allowed, Google allowed, Perplexity allowed, Exa allowed.

Readiness subscores: reach 19/20, readability 22/30, capabilities 17/35, conformance 10/15, total 68/100, grade A.

How the grade is made

+10 per lifecycle step with a standard observed, counting manifests that validate or that the probe rule for the standard recognises (a valid MCP server card counts for MCP; max 90); +3 per observed standard beyond the first two (max 15); conformance +15 (+10 with one manifest) minus 5 per agent-facing manifest with errors, never below 0 (security.txt is reported, not scored). Lifecycle grade: A+ >= 60, A >= 45, B >= 30, C >= 20, D >= 10. Strict 100-point composite (subscores.total_100 / subscores.grade_100): reach_and_policy (20) + readability (30) + capabilities (35) + conformance (15), where A+ >= 80, A >= 65, B >= 45, C >= 28, D >= 15. Errors are specification violations; warnings are best-practice gaps. Only public paths are fetched, without credentials, so standards that need a login (skipped in the probe) are not counted either way. The same report is the validate_manifest tool on the MCP server.

JSON · Markdown · probe rules