AgentMart site check
The site check lists what anyone can see of a website from the outside: its HTTPS setup and response headers, its public DNS and email sender records, whether privacy, terms and contact pages can be found, and files meant for AI agents. Each check says passed, warning, not passed or not checked, with plain steps to fix; a few are only for information.
What it reads
Website and HTTPS
- whether the start page answers over HTTPS with a certificate from a public authority
- how many days the HTTPS certificate has left
- the TLS version (for information, never counted)
- whether plain http:// moves visitors to HTTPS
- the Strict-Transport-Security header
- the Content-Security-Policy header
- whether other sites may show the pages inside a frame (X-Frame-Options or frame-ancestors)
- the X-Content-Type-Options header
- the Referrer-Policy header
- whether the Server and X-Powered-By headers show version numbers (we never show the values)
- whether every cookie the start page sets is limited to HTTPS
- /.well-known/security.txt, the file that says where to report a security problem
Email sender records
- the mail servers of the domain (MX) (for information, never counted)
- the SPF record
- the DMARC record
- DKIM keys under common names (only in the daily checks a domain's owner asks for)
Privacy, terms and contact
- a privacy notice linked from the start page
- terms linked from the start page
- a contact or imprint page, or contact details on the start page
Files for AI agents
- /llms.txt
- /robots.txt, and which AI agents it names
- /openapi.json, /.well-known/oauth-protected-resource and MCP discovery files (for information, never counted)
- when the site names an MCP server: whether its tools have descriptions and read-only or destructive labels
How we read
We read the site's public pages and files with ordinary requests, one of them over plain http:// to see whether the site moves visitors to HTTPS, and we asked public DNS. If the site names an MCP server, we sent it the standard MCP opening messages, asked for its list of tools and closed the session. We did not log in, fill in forms or try to break anything. Our requests name us as AgentMart-Check.
At most 24 requests to a site per check, 3 at a time. We follow the robots.txt rules for AgentMart-Check on every host we read. A result keeps no text from the site, only our own words and numbers. A check anyone asks for is deleted after 7 days.
This is not a security audit. It lists what anyone could see from the outside when we checked: the site's public pages, headers and DNS records. It says nothing about the company's servers, code, staff or how it handles data.
How to run it
- Ask your AI agent: Check example.com with AgentMart.
- MCP server, no sign-in: https://agentmart.ciphyr.ai/mcp/check
- REST: POST https://agentmart.ciphyr.ai/v1/site-checks with {"domain":"example.com"}
How to stop checks of your site
To stop checks of your domain by others, publish a TXT record agentmart-check=no on _agentmart-check.<your domain>. One record covers your domain and every name under it. You can also write to us at mustafaakmese@ciphyr.ai.
Your robots.txt rules for AgentMart-Check limit what we read.
Our requests
Our requests name us in the User-Agent header: AgentMart-Check/1 (+https://agentmart.ciphyr.ai/c)
To report a badge that misleads people, write to mustafaakmese@ciphyr.ai.