Agent Operability & Safety
Check secure access, stable responses and signals that support safe use. Each check includes its proof, limits and effect on the score.
operability-safety/accessible-namesGrade AScoredButtons and links have accessible names
AI browser agents identify clickable elements by their accessible name in the accessibility tree. Buttons and links (including icon-only controls) without text, aria-label, or aria-labelledby are invisible to agents, so they cannot navigate the site or trigger actions.
operability-safety/agent-ua-content-divergence-diffGrade BScoredAgent-UA Content Divergence Diff
Compares the main content, and the JSON-LD, that each AI-crawler User-Agent receives against the same URL fetched as Chrome, and reports where they diverge. An unrecognised control bot is probed too, so bot management is told apart from deliberate agent-specific branching, and a crawler that is simply blocked is reported without lowering the score.
operability-safety/aria-attributesGrade AScoredValid ARIA attributes
ARIA states and properties carry the machine-readable state agents act on (expanded, checked, disabled, labels). Invalid attributes or values corrupt that state.
operability-safety/aria-hidden-bodyGrade AScoredPage exposed to the accessibility tree
aria-hidden="true" on the document body removes the entire page from the accessibility tree. AI browser agents that navigate via the accessibility tree would see nothing at all.
operability-safety/aria-landmarksGrade AScoredARIA landmarks complete
Claude computer use and browser agents rely on ARIA landmarks to identify page regions (navigation, main content, footer). Missing landmarks force agents to guess page structure from raw HTML, leading to misclicked elements and incorrect content extraction.
operability-safety/aria-layer-injection-scanGrade AScoredAccessibility-Layer Injection Scan
Audit the text that reaches an agent through the accessibility tree and non-visual attributes rather than through body copy: alt, aria-label, aria-labelledby targets, aria-description, title, placeholder, hidden input values, <option> labels, document title and og:* metadata. Flag instruction-shaped content, anomalously long values, and aria-label/visible-text divergence.
operability-safety/aria-relationshipsGrade AScoredComplete ARIA relationships
Composite widgets (menus, listboxes, tabs, grids) require specific child/parent roles and attributes. Missing pieces break the structure agents traverse.
operability-safety/aria-rolesGrade AScoredValid ARIA roles
AI agents map elements to behaviors by their ARIA role. Invalid, deprecated, or disallowed roles make an element’s purpose ambiguous, so agents may mis-classify or skip it.
operability-safety/autocompleteGrade AScoredForm fields use valid autocomplete tokens
Form-filling agents map fields to known data (name, email, address, payment) via autocomplete tokens. Invalid tokens break that mapping.
operability-safety/c2pa-manifest-survives-deliveryGrade BScoredContent Credentials survive the image delivery pipeline
Fetches the images a page actually serves and looks for a C2PA manifest store in the bytes. Where a served image is a transformed variant — Next.js image optimization, Cloudflare Image Resizing, a WordPress rendition — the origin asset is fetched too and the two are compared. An origin that carries a manifest whose variant does not is a pipeline stripping provenance in transit.
operability-safety/c2pa-signer-trust-statusGrade BScoredContent Credentials are signed by a certificate that can be trusted
Reads the signing certificate out of each Content Credential and reports what the certificate itself says: self-signed or CA-issued, inside its validity window or outside it, and whether a timestamp token is present. A self-signed or expired signer surfaces as untrusted in every conforming validator, however well-formed the manifest is.
operability-safety/contact-formGrade CAdvisoryContact/lead form endpoint
AI agents increasingly handle tasks like "contact this company for a quote" on behalf of users. Without a machine-submittable contact form, agents cannot complete these requests, sending users to competitors who have one. Provide an HTML form or an API endpoint.
operability-safety/dialog-nameGrade AScoredDialogs have accessible names
AI browser agents detect modals via role="dialog"/"alertdialog" and need an accessible name to understand the dialog’s purpose. Unlabeled dialogs trap agents in unknown UI states, blocking confirmations, forms, or cookie-consent flows.
operability-safety/document-titleGrade AScoredPage has a non-empty <title>
The document title is the page’s identity in the accessibility tree and in agent context windows. A missing/empty title leaves the page unnamed.
operability-safety/drag-and-slider-dependencyGrade BScoredGesture-only controls with no discrete alternative
Flags interactions on task-critical paths whose only operation path is a continuous pointer gesture — range sliders, drag-to-reorder lists, drag-only upload zones, swipe carousels — with no click, keyboard, or typed-value alternative. Each finding names the discrete control that is missing.
operability-safety/duplicate-idGrade AScoredUnique IDs for ARIA references
aria-labelledby / aria-describedby / for resolve by id. Duplicate ids make resolution ambiguous, so an agent may read the wrong label or description.
operability-safety/first-contact-consent-gate-operabilityGrade CAdvisoryFirst-contact consent gate: cost to get past it
Reports the cold-session consent layer an agent meets before any task work: whether the primary content exists in the served HTML behind it, whether the accept and reject controls carry accessible names and live in the top document rather than a cross-origin iframe, whether main content is hidden from the accessibility tree while the layer is open, and how many clicks a refusal costs. Diagnostic only — it never moves the score.
operability-safety/form-actionabilityGrade AScoredForm backend actionability
Autonomous agents fill forms by reading the DOM directly — they cannot see placeholders rendered visually or guess what a custom div-based widget expects. Fields without a native element, a name attribute, an explicit label (label[for], wrapping label, aria-label, or aria-labelledby), or a standard autocomplete attribute for identity data (email, phone, name, address) force agents to guess, producing failed or incorrect submissions. Keep every fillable field a native input/select/textarea with a name, an explicit label and standard autocomplete tokens.
operability-safety/form-autofill-token-coverageGrade AScoredForm Autofill Token Coverage
Per-form score for whether every field an agent must populate carries the machine-readable identity an agent needs: a stable name/id, a correct input type, a WHATWG autocomplete token when the field maps to a standard autofill concept, programmatic constraints, and error wiring via aria-invalid/aria-describedby. Scored as covered-fields / autofillable-fields per form.
operability-safety/form-error-messagesGrade AScoredForm fields wired to their validation messages
An agent filling a form reads the accessibility tree, where a message is attached to a field by aria-errormessage or aria-describedby. Fields the server rendered as aria-invalid are checked directly; where a page carries no invalid state — the normal case on a GET, since error markup is injected after a failed submit — the required fields are checked instead, because those are the ones that can fail.
operability-safety/forms-no-jsGrade CAdvisoryForms work without JavaScript
Many AI agents do not execute JavaScript, so forms that rely on JS for submission are invisible to them. Adding standard HTML action and method attributes ensures forms work via simple HTTP requests, making them accessible to all AI agents.
operability-safety/frame-titleGrade CAdvisoryFrames are titled
Agents need a title to understand what each iframe contains. Untitled or duplicate-titled frames are opaque embedded contexts.
operability-safety/ghost-clickable-element-ratioGrade BScoredGhost-clickable elements: click targets an agent cannot address
Measures the share of on-page click targets that a DOM/accessibility-tree agent cannot address at all: elements that look and behave clickable to a human or a vision model but expose no native or ARIA role and no accessible name, so they never appear in a Playwright-MCP style snapshot. Reported as semantic / (semantic + ghost) over the served markup and its same-origin stylesheets, with the reason each ghost is unaddressable.
operability-safety/hover-only-content-and-navigationGrade BScoredHover-only navigation and content
Detects navigation subtrees and information that exist in the DOM only while a pointer hovers — `:hover`-revealed submenus with no focus or `aria-expanded` equivalent, and content carried solely in `title` attributes or hover cards. Reports each destination URL an agent never discovers.
operability-safety/invisible-instruction-scanGrade AScoredInvisible Instruction Payload Scan
Detect text that is present in the byte stream or DOM but not perceivable by a human, and that reads like an instruction addressed to an AI. Covers CSS-hidden text (color ≈ background, font-size:0, opacity:0, off-screen absolute positioning, zero-size + overflow:hidden, visibility:hidden, display:none), plus channels that never render at all: HTML comments, <noscript>, <template>, oversized data-* attribute values, <script type="text/plain">/application/json blobs, non-standard <meta name> content, and inline <svg><text> with fill-opacity:0 or display:none.
operability-safety/labelGrade AScoredForm inputs have associated labels
AI agents filling forms identify fields by their accessible name (label, aria-label, or aria-labelledby). Unlabeled inputs are invisible to form-filling agents, so automated workflows like "sign me up" or "submit a contact request" fail.
operability-safety/landmark-uniqueGrade AScoredLandmarks are uniquely identifiable
AI browser agents traverse the accessibility tree and use a landmark’s role plus accessible name to target the right region. Two landmarks of the same role (e.g. a primary <nav> and a footer <nav>) without unique labels are indistinguishable, causing agents to act on the wrong region. A single unlabeled landmark is unambiguous and is not flagged.
operability-safety/meta-refreshGrade AScoredNo time-based auto-refresh/redirect
A <meta http-equiv="refresh"> that reloads/redirects after a delay disrupts an agent mid-read and can trap it in unexpected navigation.
operability-safety/native-control-substitutionGrade AScoredNative Control Substitution Index
Counts choice, date, and file-input controls implemented as custom div widgets instead of the native HTML elements, weighted by whether they sit on a conversion-critical path (search, filter, checkout, signup). Reports each substituted control with the number of agent actions it costs versus its native equivalent.
operability-safety/nested-interactiveGrade AScoredNo nested interactive controls
Interactive elements nested inside other interactive elements (e.g. a button inside a link) create ambiguous targets in the accessibility tree.
operability-safety/no-blocking-captchaGrade AScoredForms don't use blocking CAPTCHA
Blocking CAPTCHAs like reCAPTCHA and hCaptcha prevent AI agents from completing forms on behalf of users. When someone asks an AI assistant to "fill out the contact form on Example.com," the CAPTCHA blocks the action entirely. Use honeypot fields or invisible server-side validation instead.
operability-safety/organization-identifier-registry-resolutionGrade BScoredThe organization identifier resolves in the authoritative registry
Reads `leiCode` / `iso6523Code` off the Organization markup, checks the identifier’s shape and ISO/IEC 7064 check digits locally, then resolves it against GLEIF’s public registry: exactly one record, an active entity, an issued registration, and a registered legal name that agrees with the name in the markup.
operability-safety/presentation-conflictGrade AScoredNo presentation-role conflicts
An element marked role="presentation"/"none" while still focusable or carrying ARIA sends contradictory signals about whether it exists in the accessibility tree.
operability-safety/reflected-parameter-injection-canaryGrade BScoredReflected-Parameter Injection Canary
Sends at most five read-only GET probes carrying a random per-scan token, then reports whether the site echoes that token back into its title, meta description, canonical link, JSON-LD, or rendered text — the fields an answer engine lifts verbatim, which would let any third party mint a URL on this domain that shows a visiting agent arbitrary text.
operability-safety/security-header-hygieneGrade CAdvisorysecurity.txt (RFC 9116)
Reports whether a published /.well-known/security.txt conforms to RFC 9116 — plain text, a Contact field, and an Expires date in the future. RFC 9116 is an Informational document whose stated consumers are human security researchers and vulnerability-notification tooling; no AI crawler, retrieval pipeline or answer engine is documented to read it, so this audit is informative only — it carries weight 0 and never affects your score. A site that publishes no security.txt is reported as not applicable rather than warned.
operability-safety/stateful-control-introspectabilityGrade BScoredStateful controls: current state readable by an agent
Checks that every control whose purpose is to hold a state — toggles, switches, checkboxes, radio groups, tabs, accordions, disclosure triggers, sort direction, filter chips — exposes that state through a machine-readable attribute rather than a CSS class alone. Reports the count of state-bearing controls whose current value an agent cannot read, each with the class that carries the state instead.
operability-safety/synthetic-media-disclosure-validityGrade BScoredAI-generated-image disclosure is machine-readable and self-consistent
Reads `Iptc4xmpExt:DigitalSourceType` out of each image’s XMP packet and tests it against the ratified IPTC NewsCodes vocabulary. The property is typed as a URI, so a bare token, an `https` variant of the `http` vocabulary URI, a trailing slash or free text all read as nothing to a consumer. Also compares the XMP declaration against what the asset’s own C2PA manifest says.
operability-safety/tabindexGrade CAdvisoryNo positive tabindex (logical focus order)
Positive tabindex values force a non-DOM focus order. Agents that traverse the page by focus order then encounter a confusing, non-linear sequence.
operability-safety/table-headersGrade BScoredData tables have header associations
Agents extracting tabular data rely on header↔cell associations (th scope / headers attr) to know what each value means. Missing associations make tables ambiguous.
operability-safety/third-party-dom-write-blast-radiusGrade BScoredThird-party DOM-write blast radius
Counts how many separate companies can write text into the DOM an agent reads: every registrable domain shipping a script or stylesheet into the page, judged against whether the Content-Security-Policy actually constrains what may run, and whether each resource is pinned with an `integrity` hash. Cross-origin frames with no `sandbox` are reported alongside. The origin list is the deliverable.
operability-safety/trust-txt-reciprocity-coherenceGrade CAdvisorytrust.txt associations are reciprocated and agree with robots.txt
For publishers who maintain a trust.txt: validates the attribute names, resolves each `belongto=` against that association’s own trust.txt to see whether it lists this domain back, and compares `datatrainingallowed=` against what robots.txt actually tells AI crawlers. Reported as a trust signal only — no AI engine is documented as a trust.txt consumer, so nothing here affects the score.
operability-safety/ugc-trust-boundary-markersGrade BScoredUGC Trust-Boundary Markers
Locates visitor-contributed regions — comments, reviews, Q&A, forum posts, submission forms — and checks whether any machine-readable boundary separates them from editorial copy: `data-nosnippet` containment on a span, div or section, `rel="ugc"` on their outbound links, and whether raw markup survives the sanitizer inside them.
operability-safety/unicode-covert-channel-scanGrade BScoredInvisible codepoints carrying hidden text
Scans rendered text, the attributes an agent reads, every JSON-LD string value and the site’s root files for codepoints that carry information invisibly: the Unicode Tags block (U+E0000–U+E007F), bidirectional overrides and isolates (U+202A–U+202E, U+2066–U+2069), and zero-width or filler characters (U+200B–U+200D, U+2060, U+FEFF, U+00AD, U+115F, U+1160, U+3164, U+FFA0). Decodes any tag-block run back to ASCII and prints the invisible sentence sitting on the page.
operability-safety/unsafe-agent-triggerable-affordancesGrade BScoredState-changing links an agent can trigger by fetching them
Finds links and GET forms whose URL changes state on the server — delete, cancel, revoke, unsubscribe, logout, add-to-cart, confirm — with no POST, no confirmation affordance and no `rel="nofollow"` in the way. Markup analysis only: a flagged URL is reported, never fetched.
operability-safety/url-addressable-state-and-pagination-fallbackGrade BScoredListings walkable by URL: pagination and facet fallback
Checks that a listing exposes its later pages through real `href` pagination or a `rel="next"` link rather than infinite-scroll machinery alone, and that each facet changes what the server returns rather than only what the browser shows. Reports the deepest item index reachable by URL alone, and any facet that turns out to be client-only.
operability-safety/wikidata-round-trip-verificationGrade BScoredThe Wikidata entity this site claims points back at this site
Takes the Wikidata Q-id the site claims in its Organization or Person `sameAs`, asks Wikidata what that entity gives as its official website (P856), and compares registrable domains. A `sameAs` is self-asserted and any site can claim any entity; only the round trip is evidence.