Can AI agents actually reach your site?
Your robots.txt says one thing. Your WAF may be doing another, and you can't see it from the inside. AgentCapable measures it: the same page requested with 14 agent identities from two independent networks, judged against what your robots.txt declares.
Real scans, real contradictions
From our 12-site ground-truth validation (18 Aug 2026). Click any of them to run a fresh scan now; results are measured live, never replayed.
Every probed agent served from both vantages; llms.txt present.
robots.txt disallows 11 AI crawlers and the edge enforces exactly that. Declared policy, enforced consistently: full credit, no penalty.
robots.txt allows ClaudeBot, Applebot and Meta-ExternalAgent; the edge turned them away from both vantages.
What one scan measures
The same request, two networks
Every agent identity is probed from a Cloudflare Worker and an independent Hetzner server. A finding counts only when both vantages agree; disagreement is reported as inconclusive, never as a block.
Declared policy vs edge behavior
We parse robots.txt the way agents do (RFC 9309, longest match) and set it against what the edge actually returned per agent. The flagship finding: agents your robots.txt invites that your edge turns away.
Three honest states
Every check resolves to pass, fail, or inconclusive. Inconclusive is excluded from the score: a site we cannot measure gets “unknown”, never a fake low number.
What we will never claim. Our probes come from datacenter networks (where AI agents actually run from), but we cannot send traffic from AI vendors' verified IP ranges. So the strongest claim a report ever makes is that your edge treats agent-identifying requests from cloud servers as hostile, not that a specific vendor's verified bot is blocked. Every report carries its full method statement, and everything we assert is expandable to the per-vantage evidence underneath it.
Scans respect declared policy: a robots.txt block that your edge enforces consistently is full credit, not a deficiency. We measure coherence, not compliance with our preferences.
Also an API
The same fresh scan, as JSON. No key, no signup. One scan per domain per minute.
curl -X POST https://agentcapable.dev/scan \
-H 'content-type: application/json' \
-d '{"domain":"yourdomain.com"}'