# Backwatch

> Backwatch checks whether AI agents can read a site, find its MCP server, sign in, and find it in agent registries. `npx backwatch <url>`; MIT licensed, no account, no telemetry.

## Docs

- [Overview](https://backwatch.dev/index.md): what Backwatch checks, verdicts, CI use and limits
- [CI](https://backwatch.dev/ci.md): Run Backwatch in CI. The first run writes a baseline; after that the job fails when a check gets worse.
- [Planned pricing](https://backwatch.dev/pricing.md): The CLI is free and open source. The hosted monitor is planned with a free plan and paid plans from $149 a month.
- [The Backwatch bot](https://backwatch.dev/bot.md): User-Agent, what it requests, how to block it

## Checks

- [Checks](https://backwatch.dev/checks.md): All 132 Backwatch checks across four pillars: what each looks for, where it runs and how it is scored.
- [Content without JavaScript (content-no-js)](https://backwatch.dev/checks/content-no-js.md): Whether your pages show their content with JavaScript turned off.
- [Not blocked by bot detection (bot-detection)](https://backwatch.dev/checks/bot-detection.md): Whether bot protection turns AI agents away before they reach your content.
- [robots.txt AI crawler policy (robots-ai-policy-quality)](https://backwatch.dev/checks/robots-ai-policy-quality.md): Whether robots.txt lets AI search crawlers read your public pages.
- [Listed in MCP registries (mcp-registry-listed)](https://backwatch.dev/checks/mcp-registry-listed.md): Whether your MCP server is listed in the official MCP Registry, matched to your domain.
- [MCP well-known discovery (mcp-well-known-discovery)](https://backwatch.dev/checks/mcp-well-known-discovery.md): Whether agents can find your MCP server from your domain, through /.well-known discovery files and server cards.
- [HTTP Link headers (RFC 8288) (link-headers-discovery)](https://backwatch.dev/checks/link-headers-discovery.md): Whether your homepage sends HTTP Link headers to your sitemap, service docs or API descriptions.
- [Markdown URL fallback (markdown-url-fallback)](https://backwatch.dev/checks/markdown-url-fallback.md): Whether /index.md, and .md versions of your pages, return Markdown with a Markdown content type and a heading.
- [Modular llms.txt per product area (modular-llms-txt)](https://backwatch.dev/checks/modular-llms-txt.md): Whether large sections, such as /docs, have their own llms.txt.
- [robots.txt agent-user policy (robots-agent-user-policy)](https://backwatch.dev/checks/robots-agent-user-policy.md): Whether robots.txt permits the agents that fetch pages for a user, such as ChatGPT-User and Claude-User.
- [llms.txt exists (llms-txt-exists)](https://backwatch.dev/checks/llms-txt-exists.md): Whether your site serves /llms.txt, or /.well-known/llms.txt.
- [llms.txt formatting (llms-txt-formatting)](https://backwatch.dev/checks/llms-txt-formatting.md): Whether the file parses: a heading at the top, Markdown links, and enough content to navigate by.
- [JSON-LD structured data (json-ld)](https://backwatch.dev/checks/json-ld.md): Whether your homepage has JSON-LD structured data, and how complete it is.
- [Public API/docs linked from homepage (public-api-docs)](https://backwatch.dev/checks/public-api-docs.md): Whether your homepage links to API or developer docs that you own.
- [JSON-LD entity linking (sameAs) (json-ld-entity-linking)](https://backwatch.dev/checks/json-ld-entity-linking.md): Whether your structured data links your official profiles with sameAs.
- [MCP server identity (mcp-server-identity)](https://backwatch.dev/checks/mcp-server-identity.md): Whether your MCP server gives its name, version and instructions when a client connects.
- [Organization schema completeness (org-schema-completeness)](https://backwatch.dev/checks/org-schema-completeness.md): Whether your Organization structured data includes contact details.
- [Schema type breadth (schema-type-breadth)](https://backwatch.dev/checks/schema-type-breadth.md): Which schema.org types your homepage marks up beyond the basics.
- [llms.txt links resolve (llms-txt-links-resolve)](https://backwatch.dev/checks/llms-txt-links-resolve.md): Whether the links listed in your llms.txt answer, rather than redirect to nowhere or return errors.
- [Markdown alternate link (markdown-link-alternate)](https://backwatch.dev/checks/markdown-link-alternate.md): Whether pages point to their Markdown version with a rel=alternate link or an HTTP Link header, and whether that target serves Markdown.
- [Page token budget (page-token-budget)](https://backwatch.dev/checks/page-token-budget.md): Whether each page's extracted text fits a budget an agent can read whole, about 25,000 tokens.
- [OpenAPI spec published (openapi-spec)](https://backwatch.dev/checks/openapi-spec.md): Whether you publish an OpenAPI description of your API that agents can find.
- [MCP auth mechanism (mcp-auth-mechanism)](https://backwatch.dev/checks/mcp-auth-mechanism.md): Whether your MCP server's sign-in matches what it does: public for docs, OAuth for product data.
- [MCP OAuth metadata (mcp-oauth-metadata)](https://backwatch.dev/checks/mcp-oauth-metadata.md): Whether your authorization server publishes its metadata (RFC 8414) with the endpoints a host needs.
- [MCP PKCE S256 support (mcp-pkce-s256)](https://backwatch.dev/checks/mcp-pkce-s256.md): Whether your authorization server advertises PKCE with the S256 method.
- [API catalog (RFC 9727) (api-catalog-rfc9727)](https://backwatch.dev/checks/api-catalog-rfc9727.md): Whether /.well-known/api-catalog (RFC 9727) lists your APIs.
- [OAuth Protected Resource metadata (RFC 9728) (oauth-protected-resource)](https://backwatch.dev/checks/oauth-protected-resource.md): Whether your server publishes protected-resource metadata (RFC 9728) naming its authorization servers.
- [Agent auth discovery metadata (agent-auth-discovery-metadata)](https://backwatch.dev/checks/agent-auth-discovery-metadata.md): Whether your OAuth discovery documents carry the agent sign-in details your auth docs describe.
- [Agent auth WWW-Authenticate hint (agent-auth-www-authenticate)](https://backwatch.dev/checks/agent-auth-www-authenticate.md): The first step of sign-in: whether an anonymous request to your server gets a 401 with a WWW-Authenticate header that points to your protected-resource metadata.
- [agent_auth endpoints reachable (agent-auth-endpoints-reachable)](https://backwatch.dev/checks/agent-auth-endpoints-reachable.md): Whether the registration and other sign-in endpoints your discovery documents advertise actually respond.
- [MCP server / manifest (mcp-server)](https://backwatch.dev/checks/mcp-server.md): Whether your product offers a Model Context Protocol server.
- [Markdown agent docs (markdown-negotiation)](https://backwatch.dev/checks/markdown-negotiation.md): Whether a request with Accept: text/markdown gets Markdown back from your homepage or docs.
- [Markdown content negotiation (acceptmarkdown.com) (markdown-negotiation-vary)](https://backwatch.dev/checks/markdown-negotiation-vary.md): Whether the homepage answers Markdown to agents and HTML to browsers, with Vary: Accept on the Markdown response.
- [MCP server-card.json (mcp-server-card)](https://backwatch.dev/checks/mcp-server-card.md): Whether each MCP server has a server card that says what it is and where to connect.
- [Bot-UA markdown serving (agent-ua-markdown)](https://backwatch.dev/checks/agent-ua-markdown.md): What AI crawlers such as GPTBot get back when they ask for HTML: Markdown, or the full HTML page.
- [Agent-friendly 404s (agent-friendly-404)](https://backwatch.dev/checks/agent-friendly-404.md): What an agent gets on a path that doesn't exist: a real 404 status, and whether the error body is readable Markdown.
- [Agent crawler reachability (agent-crawler-reachability)](https://backwatch.dev/checks/agent-crawler-reachability.md): Whether your homepage answers the agents that act for users and for search, such as ChatGPT-User and Claude-User.

## Tools

- [Free tools](https://backwatch.dev/tools.md): Free checks for MCP servers and agent-readable sites: sign-in, OAuth discovery, llms.txt, Markdown, bots and more.
- [MCP Inspector](https://backwatch.dev/tools/mcp-inspector.md): See your MCP server the way an agent finds it from outside: discovery, server card, identity and the sign-in challenge.
- [MCP OAuth Discovery Tester](https://backwatch.dev/tools/oauth-discovery-tester.md): Follow the discovery half of MCP sign-in: the 401 challenge, protected-resource metadata and authorization-server metadata.
- [MCP Sign-In Checker](https://backwatch.dev/tools/mcp-sign-in-checker.md): Check the whole sign-in chain a host follows, and on your own server prove each host's callback can register.
- [llms.txt Checker](https://backwatch.dev/tools/llms-txt-checker.md): Check that your llms.txt exists, parses, and that every link in it resolves.
- [Markdown Negotiation Tester](https://backwatch.dev/tools/markdown-negotiation-tester.md): Check that agents get Markdown when they ask for it, by Accept header or .md URL, with the right Vary header.
- [Agent 404 Tester](https://backwatch.dev/tools/agent-404-tester.md): See what an agent gets on a page that doesn't exist: the status code and whether the body explains where to go.
- [MCP Server Card Validator](https://backwatch.dev/tools/mcp-server-card-validator.md): Check that your MCP server has a server card agents can find, and that the server introduces itself when a client connects.
- [AI Bot Access Checker](https://backwatch.dev/tools/ai-bot-access-checker.md): Check whether AI agents and crawlers can reach your site, what your robots.txt allows them, and whether bot protection turns them away.
- [OpenAPI Discoverability Checker](https://backwatch.dev/tools/openapi-discoverability-checker.md): Check that agents can find your API: an OpenAPI description, an API catalog, Link headers and docs linked from your homepage.
- [Structured Data Checker](https://backwatch.dev/tools/schema-checker.md): Check the JSON-LD on your homepage: what it says you are, how complete it is, and whether it links your official profiles.
- [Page Token Budget Checker](https://backwatch.dev/tools/page-token-budget-checker.md): Check that your pages fit an agent's reading budget and still show their content with JavaScript off.
- [Agent Readiness Report](https://backwatch.dev/tools/agent-readiness-report.md): The full report: all four pillars, every check that applies, and a fix prompt for each failure.

## Hosts

- [AI hosts](https://backwatch.dev/hosts.md): How ChatGPT, Claude, Cursor, Codex, Claude Code and Gemini CLI sign in to MCP servers, and the callback each registers.
- [MCP sign-in for ChatGPT](https://backwatch.dev/hosts/chatgpt.md): How ChatGPT signs in to MCP servers, the callback it registers, and what to check on your server.
- [MCP sign-in for Claude](https://backwatch.dev/hosts/claude.md): How Claude signs in to MCP servers, the callback it registers, and what to check on your server.
- [MCP sign-in for Cursor](https://backwatch.dev/hosts/cursor.md): How Cursor signs in to MCP servers, the callback it registers, and what to check on your server.
- [MCP sign-in for Codex and Claude Code](https://backwatch.dev/hosts/codex-and-claude-code.md): How Codex and Claude Code signs in to MCP servers, the callback it registers, and what to check on your server.
- [MCP sign-in for Gemini CLI](https://backwatch.dev/hosts/gemini-cli.md): How Gemini CLI signs in to MCP servers, the callback it registers, and what to check on your server.

## Blog

- [Blog](https://backwatch.dev/blog.md): Research and guides on MCP sign-in and agent-readable sites.
- [The MCP sign-in chain, step by step](https://backwatch.dev/blog/mcp-sign-in-chain.md): What ChatGPT, Claude, Cursor, Codex and Gemini CLI do before a user sees your login page, and the five places it can break.
- [1 in 9 MCP servers that use sign-in break before a login page](https://backwatch.dev/blog/mcp-sign-in-study-2026-11.md): We checked 1,000 servers from the official MCP Registry. Of those that use sign-in, 11% fail before a user ever sees a login page, most often at the first step.

## Optional

- [Source](https://github.com/backwatch/backwatch): CLI, GitHub Action and badge