See what a company declares about its AI.
Type a web address. We read what the company publishes about its AI from its own site, right now, with no account. What we cannot read, we say so.
Works on any company, even one that has never heard of us.
What the check reads
These are things a company can publish on its own site about its AI and its security. The check looks for each one:
- security.txt (RFC 9116)
- Agent card
- Agent signing-key directory
- MCP endpoint authentication posture
- AI crawler directives in robots.txt
- llms.txt
- AI plugin manifest
How the check behaves
- It only reads. Every request is a GET, sent one at a time.
- Each item shows Observed, Not observed or Could not read, and the result gives the date it was read.
- A check writes nothing to our database and calls no AI model.
- Nothing is scored. Each item is reported on its own.