warp.dev agentic web readiness

A Manifest validity: 50% (3/6 valid, 5 errors, 8 warnings) · Surface score 52 (coverage 40 + breadth 12 + conformance 0). 6 standards observed across 4 of 9 steps; 6 manifests present, 5 errors, 8 warnings. Checked 2026-10-25 18:29:33 UTC via www.warp.dev. This grades the agent-facing files published at warp.dev, not the organisation's products.

Badge for a README: ![agentic web grade](https://agenticweb.wiki/badge/warp.dev.svg) · JSON · Markdown · Re-check now

Coverage by step

Manifests

{
  "specVersion": "1.0",
  "host": {
    "displayName": "Warp",
    "identifier": "did:web:warp.dev",
    "documentationUrl": "https://warp.dev/AGENTS.md"
  },
  "entries": [
    {
      "identifier": "urn:air:warp.dev:mcp:warp",
      "displayName": "Warp MCP server",
      "type": "application/mcp-server-card+json",
      "url": "https://warp.dev/mcp/server-card",
      "description": "Warp and what it offers to agents. Streamable HTTP MCP server.",
      "representativeQueries": [
        "what can the Warp MCP server do",
        "use Warp tools from an agent"
      ],
      "tags": [
        "mcp",
        "mcp-server"
      ]
    },
    {
      "identifier": "urn:air:warp.dev:api:openapi",
      "displayName": "Warp API description",
      "type": "application/openapi+json",
      "url": "https://warp.dev/openapi.json",
      "description": "OpenAPI description of the Warp API.",
      "representativeQueries": [
        "Warp API reference"
      ],
      "tags": [
        "openapi",
        "api"
      ]
    }
  ]
}

{
  "$schema": "https://static.modelcontextprotocol.io/schemas/v1/server-card.schema.json",
  "name": "dev.warp/warp",
  "title": "Warp",
  "version": "1.0.0",
  "description": "Warp and what it offers to agents",
  "websiteUrl": "https://warp.dev/",
  "icons": [
    {
      "src": "https://warp.dev/icon.png",
      "mimeType": "image/png",
      "sizes": [
        "180x180"
      ]
    }
  ],
  "remotes": [
    {
      "type": "streamable-http",
      "url": "https://warp.dev/mcp",
      "supportedProtocolVersions": [
        "2025-11-25",
        "2025-06-18",
        "2025-03-26"
      ]
    }
  ]
}

# Authenticating to Warp as an agent

This file is the agent-auth skill for warp.dev. It is linked from the authorization server's metadata (`agent_auth.skill`).

## Discovery
1. Call the API. A `401` carries `WWW-Authenticate: Bearer resource_metadata="https://warp.dev/.well-known/oauth-protected-resource"`.
2. Read `/.well-known/oauth-protected-resource` (RFC 9728) for `resource` and `authorization_servers`.
3. Read the authorization server's `/.well-known/oauth-authorization-server` (RFC 8414); the `agent_auth` block lists the endpoints below.

## Methods we accept
- `identity_assertion`: you hold a session for a user and can mint an ID-JAG with `aud` = our `resource`. Preferred.
- `service_auth`: you only know the user's email. A claim ceremony (6-digit code) is required.
- `anonymous`: no user. Immediate limited scopes; the user can claim later.

## Register
POST `agent_auth.identity_endpoint` with `{"type": "<method>", ...}`; exchange the returned `identity_assertion` at the token endpoint for an access token.

## Scopes
- `api.read`: read
- `api.write`: write (claimed registrations only)

## Rules
- Show the user our name and the scopes before asserting their identity.
- Keep `claim_token` in memory only.
- Revocation events arrive as Security Event Tokens at your registered events endpoint.

What an agent can call

• MCP endpoint https://warp.mcp.kapa.ai — from /.well-known/mcp.json
• API description https://docs.warp.dev/openapi.json (application/vnd.oai.openapi+json;version=3.0)
• API description https://docs.warp.dev/openapi.json (application/json)
• API description https://docs.warp.dev/openapi.yaml (text/yaml)
• API description https://docs.warp.dev/api (text/html)
• llms.txt: Warp, 13 links, llms-full.txt present
• robots.txt AI policy: allows GPTBot, ChatGPT-User, ClaudeBot, anthropic-ai, Google-Extended, PerplexityBot, CCBot, Applebot-Extended, meta-externalagent, Amazonbot, cohere-ai; unlisted crawlers partial
• ARD bridge (/.well-known/ard.json): 1/3 valid, 1 legacy, 0 dead/broken

Standards observed

• llms.txt https://warp.dev/llms.txt
• Agentic Resource Discovery https://warp.dev/.well-known/ard.json
• api-catalog: A Well-Known URI and Link Relation to Help Discovery of APIs https://warp.dev/.well-known/api-catalog
• AI Crawler User-Agent Tokens in robots.txt https://warp.dev/robots.txt
• MCP Server Cards (SEP-2127)
• Model Context Protocol

Cheapest next steps

1. AGENTS.md: instructions for coding agents working on or with the site
   Generate starter /AGENTS.md for warp.dev

   # Warp for agents
   
   Warp and what it offers to agents
   
   ## Read the data, not the HTML
   - Index: https://warp.dev/llms.txt
   - API description: https://warp.dev/openapi.json
   - Discovery catalog: https://warp.dev/.well-known/ard.json
   
   ## Calling
   - MCP server (Streamable HTTP): https://warp.dev/mcp
   - Rate limits and authentication: describe them here
   
   ## Conventions
   - How to cite or attribute content
   - What not to do (no scraping of /account/, no automated sign-ups, etc.)
   
   Contact: security@warp.dev
   

2. security.txt (RFC 9116): RFC 9116 contact and expiry, read by agents and people
   Generate starter /.well-known/security.txt for warp.dev

   Contact: mailto:security@warp.dev
   Expires: 2027-09-20T18:29:33Z
   Canonical: https://warp.dev/.well-known/security.txt
   Preferred-Languages: en
   Policy: https://warp.dev/security-policy
   

Agent pre-flight & practical readiness

Preferred mode: mcp (fallback openapi). Call the MCP endpoint at https://warp.mcp.kapa.ai first. Do not scrape the HTML when a tool can answer.

Fetch: POST https://warp.mcp.kapa.ai POST a JSON-RPC tools/list, or server/discover on the 2026-07-28 revision, before reading HTML.

Practical readability: exa_parsable yes, markdown negotiation no, render ssr_rich, HTML quality high, first content at byte 18240, HTML-to-llms.txt token ratio 217.169×, JSON-LD Organization, ImageObject, WebSite, SoftwareApplication, Offer, AggregateRating, FAQPage, Question, Answer.

AI crawler posture: open_to_all · Assistant access: OpenAI allowed, Anthropic allowed, Google allowed, Perplexity allowed, Exa allowed.

Readiness subscores: reach 20/20, readability 22/30, capabilities 24/35, conformance 0/15, total 66/100, grade A.

How the grade is made

+10 per lifecycle step with a standard observed, counting manifests that validate or that the probe rule for the standard recognises (a valid MCP server card counts for MCP; max 90); +3 per observed standard beyond the first two (max 15); conformance +15 (+10 with one manifest) minus 5 per agent-facing manifest with errors, never below 0 (security.txt is reported, not scored). Lifecycle grade: A+ >= 60, A >= 45, B >= 30, C >= 20, D >= 10. Strict 100-point composite (subscores.total_100 / subscores.grade_100): reach_and_policy (20) + readability (30) + capabilities (35) + conformance (15), where A+ >= 80, A >= 65, B >= 45, C >= 28, D >= 15. Errors are specification violations; warnings are best-practice gaps. Only public paths are fetched, without credentials, so standards that need a login (skipped in the probe) are not counted either way. The same report is the validate_manifest tool on the MCP server.

JSON · Markdown · probe rules