Agent-Readiness Grade

Agent-Readiness Grade / Fix guides / MCP endpoint and census

Fix MCP census entry: answer at /mcp and sell through x402

This check asks whether agents can call you, not just read you. It gives one point for an MCP endpoint at /mcp and one for being listed among the hosts that sell to agents through x402.

Checked 2026-09-30 against grader version 1.3.0 and the 8 sources listed below.

Area: MCP census entry. 2 of the 12 points.

What the grade checksWhy it mattersHow to fix itVerifyQuestionsSources

What the grade checks

  • Endpoint (1 point): GET https://example.com/mcp with a 7-second timeout. Any answer other than HTTP 404 or a 200 HTML page counts. Under the MCP 2026-07-28 transport, a POST-only endpoint answers GET with 405 Method Not Allowed, which counts.
  • Census (1 point): the host (with or without www.) appears in the agent-economy index hosts file, a daily walk of the Coinbase x402 Bazaar discovery catalog. Listing follows x402 routes in that catalog; there is no form to fill in.
  • Both are Agent Exchange's own measurements, described on the methodology page.

2 of the 12 points. The full scoring rules are on the methodology page.

Why it matters for AI agents and crawlers

The MCP Streamable HTTP transport, revision 2026-07-28, requires a single endpoint path that accepts POST, for example https://example.com/mcp. That revision removed the GET stream and protocol-level sessions, so GET and DELETE on the endpoint answer 405. Servers must validate the Origin header on every request and answer 403 when it is invalid.

Authorization is optional in MCP. When a server requires it, the MCP authorization spec requires OAuth 2.0 Protected Resource Metadata (RFC 9728) naming at least one authorization server, advertised in the WWW-Authenticate header of 401 answers.

The x402 Bazaar is the catalog of x402 services; routes become discoverable when they declare the bazaar extension and settle through a facilitator that supports it.

How to fix it

  1. Start from an official template or SDK

    Hand-rolling the protocol is not worth it; each stack has a maintained starting point.

    Cloudflare

    Cloudflare's remote MCP server guide scaffolds a Worker whose endpoint is /mcp:

    shell

    npm create cloudflare@latest -- remote-mcp-server-authless --template=cloudflare/ai/demos/remote-mcp-authless

    Next.js

    The mcp-handler package is a framework-agnostic HTTP adapter for MCP servers; its README shows the Next.js route setup.

    shell

    npm install mcp-handler

    WordPress

    The official WordPress MCP Adapter exposes WordPress abilities as MCP tools, resources and prompts.

    Static site

    A static host cannot run an MCP server. Run one on a Worker or a serverless function and route /mcp on your domain to it.

  2. Check the endpoint

    A browser cannot talk to /mcp; use curl for the status and the MCP Inspector for a real session.

    shell

    curl -s -o /dev/null -w "%{http_code} %{content_type}\n" https://example.com/mcp
# 405 (POST-only, 2026-07-28), 400, 401 or 406: an endpoint answers. 404 or a text/html 200: none.
npx @modelcontextprotocol/inspector

  3. If it requires OAuth, publish protected-resource metadata

    RFC 9728 places the metadata for the resource https://example.com/mcp at https://example.com/.well-known/oauth-protected-resource/mcp (the well-known suffix goes between the host and the path). Advertise the exact URL in the 401 answer.

    /.well-known/oauth-protected-resource/mcp

    {
  "resource": "https://example.com/mcp",
  "authorization_servers": ["https://auth.example.com"],
  "scopes_supported": ["mcp:tools"],
  "bearer_methods_supported": ["header"]
}

    401 answer from /mcp

    HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer resource_metadata="https://example.com/.well-known/oauth-protected-resource/mcp"

  4. Census listing (only if you sell to agents)

    Sell a route through x402 with the bazaar extension and a Bazaar-enabled facilitator; the index picks the host up on its next daily walk. See the x402 guide.

How to verify

Check the endpoint status, then re-grade. The evidence shows the /mcp status and whether the census lists the host.

shell

curl -s -o /dev/null -w "%{http_code} %{content_type}\n" https://example.com/mcp

Anything but 404 or a text/html 200. For the census point, the host appears on index.agentexchange.work the day after its x402 routes are in the Bazaar.

Then re-grade your site: the result lists the evidence for this check.

$49 AI Visibility Full Report

The fixes on this site are free. The paid next step is the $49 AI Visibility Full Report (what ChatGPT, Claude and Perplexity say about your brand, with a prioritized fix list) from aivisibility.agentexchange.work. It includes:

  • 8 real buyer questions tested across ChatGPT-class models
  • Competitor share-of-voice: who AI names, how often, versus you
  • Full GEO site audit with prioritized, specific fixes
  • Agent-Readiness Score: crawler access, llms.txt, schema, discovery manifest
  • Custom 30/60/90-day action plan to get cited by ChatGPT, Perplexity and Google AI Overviews
  • Shareable report, generated in about 60 seconds after checkout

Get the Full Report — $49 Stripe checkout; you enter your brand and site right after paying.

Questions

Why does GET /mcp return 405 on my working server?

Revision 2026-07-28 made the endpoint POST-only; GET and DELETE answer 405 Method Not Allowed. The grade counts that as an endpoint.

Do I need OAuth for an MCP server?

No. Authorization is optional in MCP. When a server does require it over HTTP, the MCP authorization spec requires RFC 9728 protected-resource metadata.

How do I get listed in the census?

The census is a daily copy of the Coinbase x402 Bazaar catalog, so it lists hosts whose x402 routes are in that catalog. There is no submission form.

My site is content only. Should I build an MCP server for the points?

No. This area shows which sites agents can call. A content site that is readable and well described (robots.txt, llms.txt, structured data) is in good shape with 0/2 here.

Sources

Primary documentation, read 2026-09-30. Vendors change these pages; follow the link before relying on a detail.