New64 developer platforms, traced by hand: how long it takes an agent to get an API keySee the benchmark →
AgentsReady
One prompt, tailored to your site

Make your platform
agent-ready in one prompt.

Paste it into Claude Code, Cursor or Codex with access to your site, docs and API repos. It works phase by phase, opens one PR per phase and checks every change it makes.

Step 101

Copy the prompt

Add your domain and we check your site first, so the prompt only covers what you're missing.

Step 202

Give it to your coding agent

Open your repos in Claude Code, Cursor or Codex and paste it. It asks before touching anything security-related.

Step 303

Re-check your score

Run agentsready.dev again and compare before and after.

No domain? This is the general version, covering every phase.

You are making our platform agent-ready: an AI agent acting for a user must be able to
READ our site, UNDERSTAND our product, GET CREDENTIALS and ACT through our API with as
few human steps as possible. Work through the phases below in order. For each phase:
look at what exists, make the smallest change that passes, then verify it with the
check given. Open one PR per phase. Never weaken security or remove an existing
protection without asking me first.

Company: <name>  |  Domain: <example.com>  |  Docs live in: <repo/path or docs platform>
Core product actions an agent should be able to do: <e.g. create a voice agent, send a message>

## Phase 0: baseline
- Run https://agentsready.dev/?check=<domain> and save the grade, time to key and gates.
- List every repo/service that owns: marketing site, docs, API, auth, dashboard.

## Phase 1: Access (don't wall out agents)
- robots.txt: allow user-triggered agents (ChatGPT-User, Claude-User, Perplexity-User,
  OAI-SearchBot, Claude-SearchBot). Decide training crawlers (GPTBot, ClaudeBot,
  Google-Extended, CCBot) as a separate, explicit policy. Reference the sitemap.
- WAF/bot rules: AI user-agents must get the real page (200, real content), not a challenge.
- Server-render the homepage, pricing and docs.
  Check: curl -sA "Claude-User/1.0" https://<domain>/ | sed 's/<[^>]*>//g' | wc -c   (> 1000)

## Phase 2: Context (be cheap to understand)
- /llms.txt at the root and docs host: name, one-paragraph summary, then markdown links:
  Quickstart, Auth & API keys, API reference, OpenAPI spec, MCP server, SDKs, Pricing &
  limits, Errors, Changelog. Keep it under ~20 KB.
- /llms-full.txt: the full docs as one markdown file, regenerated on every docs deploy.
- Every docs page as markdown: <page>.md and Accept: text/markdown.
  Check: curl -s https://<domain>/llms.txt | head -5   (starts with "# ")

## Phase 3: Interfaces (let agents act)
- OpenAPI 3.1 spec at a stable URL (/openapi.json), generated from code, linked in llms.txt.
- A REMOTE MCP server at https://mcp.<domain>/mcp (Streamable HTTP) exposing core actions
  as well-described tools, plus docs search. Publish /.well-known/mcp.json (server card).
- One-click install links for Cursor, VS Code and Claude on a /docs/ai page.
- SDKs (TypeScript + Python) and a CLI with --json output on every command.

## Phase 4: Onboarding (credentials without a babysitter)
- OAuth 2.1 for the MCP server and API: PKCE, RFC 8414 + RFC 9728 metadata, and client
  ID metadata documents or dynamic client registration so any MCP client connects in one click.
- Accept a scoped API key as a Bearer header on the MCP server for headless agents.
- CLI login via browser or device flow that writes a scoped key; let login double as signup.
- Claimable sandbox: an agent creates a temporary test project/key with NO account
  (rate-limited, short TTL, proof-of-work instead of CAPTCHA); a human claims it later.
- Publish /auth.md: the exact commands an agent runs, and where it must pause for a human.
- Keys: self-serve from the first docs page, scoped, expiring, revocable, with a key API.
- First call before friction: test mode or free credits with no card. Move KYC, card and
  business verification to go-live. No CAPTCHA or phone OTP on the API-key page.

## Phase 5: Errors (agents debug themselves)
- Every error: stable code, a message that says how to fix it, docs URL, request id.
  401 says where to get a key; 402/429 state the limit and Retry-After.

## Phase 6: Verify and report
- Re-run https://agentsready.dev/?check=<domain>: report before -> after grade, time to key, gates.
- Act as a brand-new agent: from only "<domain>", find docs, get a test key (stop at any
  human gate and log it), connect the MCP server, make one call. Log every step and minute.
- Output: what changed, the PRs, remaining human gates, the next three fixes by impact.

Want changes specific to your site instead? Check your domain and copy its fix pack. The rules behind this prompt are in the standard.