Join the waitlist→

///// Features

Your server, from outside

What Backwatch does today in the free CLI, and the one thing that's coming.

///// Sign-in

Sign-in, the way each host does it

Backwatch follows the chain a host walks before a login page: the 401 challenge, protected-resource metadata, the authorization server and PKCE. On your own server, --register proves each host's callback can register, and lists every client it created.

How each host signs in→
The sign-in chain every host follows
AI host
/mcpyour server
  1. 401 challengeWWW-Authenticate: resource_metadata
  2. Protected-resource metadata/.well-known/oauth-protected-resource
  3. Authorization-server metadata/.well-known/oauth-authorization-server
  4. PKCEcode_challenge_methods_supported: S256
  5. Client registrationregistration_endpoint

The host stops here, and nothing looks wrong on your side.

///// Checks

132 checks, four questions

Can agents read your site, find your server, sign in and call tools, and find you where they look? Every verdict comes with the evidence it was reached on. A check that can't be resolved is shown as unresolved and left out of the score.

Every check→
Catalogue 1.38.0132 checks
  • Readability38
  • Discoverability28
  • Connectability44
  • Presence6
  • Reported, not scored16

Free CLI 64 Deep scan 6812 core, always counted

///// Fix prompts

A fix prompt for every failure

Each failing check comes with plain text you paste into Claude Code, Codex or Cursor: what the scan saw, what good looks like, and how to verify the fix.

See a sample report→
Fix prompt · sitemapexample.com
Fix the "Sitemap exists" agent-readiness check (sitemap) for https://example.com/.
What the scan observed: 0 valid sitemap documents, 0 URL entries, 0 invalid documents. 
What good looks like: Add a valid XML sitemap at /sitemap.xml listing all indexable URLs. Include lastmod dates and keep it under 50MB.
Make the smallest change that satisfies this, then tell me how to verify it with `backwatch` again.

///// CI

Fail the deploy that breaks sign-in

The first run writes a baseline. After that the job fails only when a check gets worse, so existing gaps don't block you. The report lands in the run's summary.

Set up the CI gate→
Example runexit 1
$ npx backwatch your-site.com --ci --baseline .backwatch.json

1 check regressed against .backwatch.json:
x oauth-protected-resource     pass → fail

Error: Process completed with exit code 1.

///// Free tools

One page per question

MCP Inspector, the sign-in checker, the llms.txt checker and nine more. Each runs a focused set of checks, from your terminal today and from the page at launch.

All free tools→
Free tools12 tools

///// Coming

Watched every day

The hosted monitor will run the same checks on a schedule and tell you when one breaks, and whether it was your deploy or the host. Join the waitlist to hear when it's ready.

Join the waitlist→
your-site.comIllustration · planned monitor

What it does not do