Agent Operability & Safety
Check secure access, stable responses and signals that support safe use. Each check includes its proof, limits and effect on the score.
operability-safety/accessible-namesGrade AScoredButtons and links have accessible names
AI browser agents identify clickable elements by their accessible name in the accessibility tree. Buttons and links (including icon-only controls) without text, aria-label, or aria-labelledby are invisible to agents, so they cannot navigate the site or trigger actions.
operability-safety/agent-ua-content-divergence-diffGrade BScoredAgent-UA Content Divergence Diff
Compares the main content, and the JSON-LD, that a request naming each AI crawler in its User-Agent receives against the same URL fetched as Chrome, and reports where they diverge. An unrecognised control bot is probed too, so bot management is told apart from deliberate agent-specific branching, and a crawler User-Agent that is simply refused is reported without lowering the score. The probes come from the scanner's address, so they show how the site answers the User-Agent, not what the real crawler, verified by IP range or signature, receives.
operability-safety/aria-attributesGrade AScoredValid ARIA attributes
ARIA states and properties carry the machine-readable state agents act on (expanded, checked, disabled, labels). Invalid attributes or values corrupt that state.
operability-safety/aria-hidden-bodyGrade AScoredPage exposed to the accessibility tree
aria-hidden="true" on the document body removes the entire page from the accessibility tree. AI browser agents that navigate via the accessibility tree would see nothing at all.
operability-safety/aria-landmarksGrade AScoredARIA landmarks complete
Claude computer use and browser agents rely on ARIA landmarks to identify page regions (navigation, main content, footer). Missing landmarks force agents to guess page structure from raw HTML, leading to misclicked elements and incorrect content extraction.
operability-safety/aria-layer-injection-scanGrade AScoredAccessibility-Layer Injection Scan
Audit the text that reaches an agent through the accessibility tree and non-visual attributes rather than through body copy: alt, aria-label, aria-labelledby targets, aria-description, title, placeholder, hidden input values, <option> labels, document title and og:* metadata. Flag instruction-shaped content, anomalously long values, and aria-label/visible-text divergence.
operability-safety/aria-relationshipsGrade AScoredComplete ARIA relationships
Composite widgets (menus, listboxes, tabs, grids) require specific child/parent roles and attributes. Missing pieces break the structure agents traverse.
operability-safety/aria-rolesGrade AScoredValid ARIA roles
AI agents map elements to behaviors by their ARIA role. Invalid, deprecated, or disallowed roles make an element’s purpose ambiguous, so agents may mis-classify or skip it.
operability-safety/autocompleteGrade AScoredForm fields use valid autocomplete tokens
Form-filling agents map fields to known data (name, email, address, payment) via autocomplete tokens. Invalid tokens break that mapping.
operability-safety/c2pa-manifest-survives-deliveryGrade BScoredContent Credentials survive the image delivery pipeline
Fetches the images a page actually serves and looks for a C2PA manifest store in the bytes. Where a served image is a transformed variant — Next.js image optimization, Cloudflare Image Resizing, a WordPress rendition — the origin asset is fetched too and the two are compared. An origin that carries a manifest whose variant does not is a pipeline stripping provenance in transit.
operability-safety/c2pa-signer-trust-statusGrade BScoredContent Credentials are signed by a certificate that can be trusted
Reads the signing certificate out of each Content Credential and reports what the certificate itself says: self-signed or CA-issued, inside its validity window or outside it, and whether a timestamp token is present. A self-signed or expired signer surfaces as untrusted in every conforming validator, however well-formed the manifest is.
operability-safety/change-password-urlGrade CAdvisoryChange-password URL redirects to the form
On a site with accounts, checks that `/.well-known/change-password` redirects to the page where a user changes their password. Safari, Chrome's password manager and Chrome's automated password change open this URL for the user. Reported, not scored: none of those consumers is documented as an AI agent.
operability-safety/contact-formGrade CAdvisoryContact/lead form endpoint
AI agents increasingly handle tasks like "contact this company for a quote" on behalf of users. Without a machine-submittable contact form, agents cannot complete these requests, sending users to competitors who have one. Provide an HTML form or an API endpoint.
operability-safety/dialog-nameGrade AScoredDialogs have accessible names
AI browser agents detect modals via role="dialog"/"alertdialog" and need an accessible name to understand the dialog’s purpose. Unlabeled dialogs trap agents in unknown UI states, blocking confirmations, forms, or cookie-consent flows.
operability-safety/document-titleGrade AScoredPage has a non-empty <title>
The document title is the page’s identity in the accessibility tree and in agent context windows. A missing/empty title leaves the page unnamed.
operability-safety/drag-and-slider-dependencyGrade BScoredGesture-only controls with no discrete alternative
Flags controls whose only operation path is a continuous pointer gesture — range sliders, drag-to-reorder lists on transaction paths, drag-only upload zones, swipe carousels — with no click, keyboard, or typed-value alternative. Each finding names the discrete control that is missing.
operability-safety/duplicate-idGrade AScoredUnique IDs for ARIA references
aria-labelledby / aria-describedby / for resolve by id. Duplicate ids make resolution ambiguous, so an agent may read the wrong label or description.
operability-safety/first-contact-consent-gate-operabilityGrade CAdvisoryFirst-contact consent gate: cost to get past it
Reports the cold-session consent layer an agent meets before any task work: whether the primary content exists in the served HTML behind it, whether the accept and reject controls carry accessible names and live in the top document rather than a cross-origin iframe, whether main content is hidden from the accessibility tree while the layer is open, and how many clicks a refusal costs. Diagnostic only — it never moves the score.
operability-safety/form-actionabilityGrade AScoredForm backend actionability
Autonomous agents fill forms by reading the DOM directly — they cannot see placeholders rendered visually or guess what a custom div-based widget expects. Fields without a native element, a name attribute, an explicit label (label[for], wrapping label, aria-label, or aria-labelledby), or a standard autocomplete attribute for identity data (email, phone, name, address) force agents to guess, producing failed or incorrect submissions. Keep every fillable field a native input/select/textarea with a name, an explicit label and standard autocomplete tokens.
operability-safety/form-autofill-token-coverageGrade BScoredForm Autofill Token Coverage
Whether each sign-in, sign-up and one-time-code field declares the matching WHATWG autocomplete token (username, current-password, new-password, one-time-code), a stable name or id, and the matching input type. Agents are documented to sign in through a password manager (Gemini in Chrome with Google Password Manager, Claude with 1Password), and 1Password says these attributes make the fields easier to identify. On a sign-in or sign-up form with a password field and no separate username field, the first email field is the account identifier and may declare username or email. Scored as covered fields over credential fields across the scanned forms. Also counts, on those forms, fields marked mandatory only by an asterisk and error elements a field does not reference.
operability-safety/form-error-messagesGrade AScoredForm fields wired to their validation messages
An agent filling a form reads the accessibility tree, where a message is attached to a field by aria-errormessage or aria-describedby. Fields the server rendered as aria-invalid are checked directly; where a page carries no invalid state — the normal case on a GET, since error markup is injected after a failed submit — the required fields are checked instead, because those are the ones that can fail.
operability-safety/forms-no-jsGrade CAdvisoryForms work without JavaScript
Many AI agents do not execute JavaScript, so forms that rely on JS for submission are invisible to them. Adding standard HTML action and method attributes ensures forms work via simple HTTP requests, making them accessible to all AI agents.
operability-safety/frame-titleGrade CAdvisoryFrames are titled
Agents need a title to understand what each iframe contains. Untitled or duplicate-titled frames are opaque embedded contexts.
operability-safety/ghost-clickable-element-ratioGrade BScoredGhost-clickable elements: click targets an agent cannot address
Measures the share of on-page click targets that a DOM/accessibility-tree agent cannot address at all: elements that look and behave clickable to a human or a vision model but expose no native or ARIA role and no accessible name, so they never appear in a Playwright-MCP style snapshot. Reported as semantic / (semantic + ghost) over the served markup and its same-origin stylesheets, with the reason each ghost is unaddressable.
operability-safety/hover-only-content-and-navigationGrade BScoredHover-only navigation and content
Detects navigation subtrees and information that exist in the DOM only while a pointer hovers — `:hover`-revealed submenus with no focus or `aria-expanded` equivalent, and content carried solely in `title` attributes or hover cards. Reports each destination URL an agent never discovers.
operability-safety/invisible-instruction-scanGrade AScoredInvisible Instruction Payload Scan
Detect text that is present in the byte stream or DOM but not perceivable by a human, and that reads like an instruction addressed to an AI. Covers CSS-hidden text (color ≈ background, font-size:0, opacity:0, off-screen absolute positioning, zero-size + overflow:hidden, visibility:hidden, display:none), plus channels that never render at all: HTML comments, <noscript>, <template>, oversized data-* attribute values, <script type="text/plain">/application/json blobs, non-standard <meta name> content, and inline <svg><text> with fill-opacity:0 or display:none.
operability-safety/labelGrade AScoredForm inputs have associated labels
AI agents filling forms identify fields by their accessible name (label, aria-label, or aria-labelledby). Unlabeled inputs are invisible to form-filling agents, so automated workflows like "sign me up" or "submit a contact request" fail.
operability-safety/landmark-uniqueGrade AScoredLandmarks are uniquely identifiable
AI browser agents traverse the accessibility tree and use a landmark’s role plus accessible name to target the right region. Two landmarks of the same role (e.g. a primary <nav> and a footer <nav>) without unique labels are indistinguishable, causing agents to act on the wrong region. A single unlabeled landmark is unambiguous and is not flagged.
operability-safety/meta-refreshGrade AScoredNo time-based auto-refresh/redirect
A <meta http-equiv="refresh"> that reloads/redirects after a delay disrupts an agent mid-read and can trap it in unexpected navigation.
operability-safety/native-control-substitutionGrade AScoredNative Control Substitution Index
Counts choice, date and file-input controls built as custom widgets instead of the native HTML elements, weighted by whether they sit on a conversion path (checkout, cart, signup, booking, order, search). Reports the weighted substitution index, and fails a custom widget that lacks a usable ARIA combobox contract or a drop zone with no file input.
operability-safety/nested-interactiveGrade AScoredNo nested interactive controls
Interactive elements nested inside other interactive elements (e.g. a button inside a link) create ambiguous targets in the accessibility tree.
operability-safety/no-blocking-captchaGrade AScoredForms don't use blocking CAPTCHA
Blocking CAPTCHAs like reCAPTCHA and hCaptcha prevent AI agents from completing forms on behalf of users. When someone asks an AI assistant to "fill out the contact form on Example.com," the CAPTCHA blocks the action entirely. Use honeypot fields or invisible server-side validation instead.
operability-safety/organization-identifier-registry-resolutionGrade BScoredThe organization identifier resolves in the authoritative registry
Reads `leiCode` / `iso6523Code` off the Organization markup, checks the identifier’s shape and ISO/IEC 7064 check digits locally, then resolves it against GLEIF’s public registry: exactly one record, an active entity, an issued registration, and a registered legal name that agrees with the name in the markup.
operability-safety/presentation-conflictGrade AScoredNo presentation-role conflicts
An element marked role="presentation"/"none" while still focusable or carrying ARIA sends contradictory signals about whether it exists in the accessibility tree.
operability-safety/profile-autofill-token-coverageGrade CAdvisoryProfile Autofill Token Coverage
Whether each contact, address and payment field declares the matching WHATWG autocomplete token (email, tel, given-name, postal-code, address-level2, cc-number and the rest), a stable name or id, and the matching input type. Browsers and password managers fill by these tokens; no AI agent documents filling them, so the check is informative and does not score. Reported as covered fields over profile fields across the scanned forms. Also counts, on forms with no credential field, fields marked mandatory only by an asterisk and error elements a field does not reference.
operability-safety/reflected-parameter-injection-canaryGrade BScoredReflected-Parameter Injection Canary
Sends at most five read-only GET probes carrying a random per-scan token, then reports whether the site echoes that token back into its title, meta description, canonical link, JSON-LD, or rendered text — the fields an answer engine lifts verbatim, which would let any third party mint a URL on this domain that shows a visiting agent arbitrary text.
operability-safety/security-header-hygieneGrade CAdvisorysecurity.txt (RFC 9116)
Reports whether a published /.well-known/security.txt conforms to RFC 9116 — plain text, a Contact field, and an Expires date in the future. RFC 9116 is an Informational document whose stated consumers are human security researchers and vulnerability-notification tooling; no AI crawler, retrieval pipeline or answer engine is documented to read it, so this audit is informative only — it carries weight 0 and never affects your score. A site that publishes no security.txt is reported as not applicable rather than warned.
operability-safety/stateful-control-introspectabilityGrade BScoredStateful controls: current state readable by an agent
Checks that every control whose purpose is to hold a state — toggles, switches, checkboxes, radio groups, tabs, accordions, disclosure triggers, sort direction, filter chips — exposes that state through a machine-readable attribute rather than a CSS class alone. Reports the count of state-bearing controls whose current value an agent cannot read, each with the class that carries the state instead.
operability-safety/synthetic-media-disclosure-validityGrade BScoredAI-generated-image disclosure is machine-readable and self-consistent
Reads `Iptc4xmpExt:DigitalSourceType` out of each image’s XMP packet and tests it against the ratified IPTC NewsCodes vocabulary. The property is typed as a URI. Free text or a concept outside the vocabulary reads as nothing to a consumer and fails. A bare token, an `https` variant of the `http` vocabulary URI or a trailing slash is a near miss and warns: IPTC defines the `http` URI, and Google's documentation shows bare codes linked to `https` URIs without saying which spelling it reads. Also compares the XMP declaration against what the asset’s own C2PA manifest says.
operability-safety/tabindexGrade CAdvisoryNo positive tabindex (logical focus order)
Positive tabindex values force a non-DOM focus order. Agents that traverse the page by focus order then encounter a confusing, non-linear sequence.
operability-safety/table-headersGrade BScoredData tables have header associations
Agents extracting tabular data rely on header↔cell associations (th scope / headers attr) to know what each value means. Missing associations make tables ambiguous.
operability-safety/third-party-dom-write-blast-radiusGrade BScoredThird-party DOM-write blast radius
Counts how many separate companies can write text into the DOM an agent reads: every registrable domain shipping a script or stylesheet into the page, judged against whether the Content-Security-Policy actually constrains what may run, and whether each resource is pinned with an `integrity` hash. Cross-origin frames with no `sandbox` are reported alongside. The origin list is the deliverable.
operability-safety/trust-txt-reciprocity-coherenceGrade CAdvisorytrust.txt associations are reciprocated and agree with robots.txt
For publishers who maintain a trust.txt: validates the attribute names, resolves each `belongto=` against that association’s own trust.txt to see whether it lists this domain back, and compares `datatrainingallowed=` against what robots.txt actually tells AI crawlers. Reported as a trust signal only — no AI engine is documented as a trust.txt consumer, so nothing here affects the score.
operability-safety/ugc-trust-boundary-markersGrade BScoredUGC Trust-Boundary Markers
Locates visitor-contributed regions — comments, reviews, Q&A, forum posts, submission forms — and checks whether any machine-readable boundary separates them from editorial copy: `data-nosnippet` containment on a span, div or section, `rel="ugc"` on their outbound links, and whether raw markup survives the sanitizer inside them.
operability-safety/unicode-covert-channel-scanGrade BScoredInvisible codepoints carrying hidden text
Scans rendered text, the attributes an agent reads, every JSON-LD string value and the site’s root files for codepoints that carry information invisibly: the Unicode Tags block (U+E0000–U+E007F), bidirectional overrides and isolates (U+202A–U+202E, U+2066–U+2069), and zero-width or filler characters (U+200B–U+200D, U+2060, U+FEFF, U+00AD, U+115F, U+1160, U+3164, U+FFA0). Decodes any tag-block run back to ASCII and prints the invisible sentence sitting on the page.
operability-safety/unsafe-agent-triggerable-affordancesGrade BScoredState-changing links an agent can trigger by fetching them
Finds links and GET forms whose URL changes state on the server — delete, cancel, revoke, unsubscribe, logout, add-to-cart, confirm — with no POST, no confirmation affordance and no `rel="nofollow"` in the way. Markup analysis only: a flagged URL is reported, never fetched.
operability-safety/url-addressable-state-and-pagination-fallbackGrade BScoredListings walkable by URL: pagination and facet fallback
Checks that a listing exposes its later pages through real `href` pagination or a `rel="next"` link rather than infinite-scroll machinery alone, and that each facet changes what the server returns rather than only what the browser shows. Reports the deepest item index reachable by URL alone, and any facet that turns out to be client-only.
operability-safety/wikidata-round-trip-verificationGrade CAdvisoryThe Wikidata entity this site claims points back at this site
Takes the Wikidata Q-id the site claims in its Organization or Person `sameAs`, asks Wikidata what that entity gives as its official website (P856), and compares registrable domains. A `sameAs` is self-asserted and any site can claim any entity; only the round trip is evidence. No search engine or AI vendor documents performing this check, so it is reported and not scored.