Agent Ready Scan — GitHub Action

Scan a URL with agent-ready.dev from your CI, post the result as a PR comment, and fail the check when the AI agent-readability score drops below your threshold.

Agent Ready runs 69 checks against the Vercel Agent Readability Spec, the llmstxt.org standard, and agent-protocol manifests (MCP server cards, A2A, agents.json, agent-permissions.json, and more), returning a 0–100 score with a plain-English fix for every failing check. This action wraps the REST API as a composite action — plain bash + curl + jq, all preinstalled on GitHub runners. No Docker image, no Node build.

Usage

The typical setup scans the Vercel preview deployment of every pull request:

# .github/workflows/scan.yml
name: Agent Ready scan
on:
  pull_request:

jobs:
  scan:
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
    steps:
      - name: Wait for Vercel preview
        id: preview
        uses: patrickedqvist/wait-for-vercel-preview@v1.3.2
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          max_timeout: 300

      - name: Agent Ready scan
        uses: mlava/agent-ready-action@v1
        with:
          api-key: ${{ secrets.AGENT_READY_API_KEY }}
          url: ${{ steps.preview.outputs.url }}
          min-vercel-score: "70"

Any publicly reachable URL works — production, staging, or a preview deployment from any host.

API key

The action calls the Agent Ready REST API, which requires a Pro API key (ar_live_…). Issue one from agent-ready.dev/dashboard/api-keys and store it as the AGENT_READY_API_KEY repository secret.

Permissions

pull-requests: write is needed only for the PR comment. If you set comment: "false" you can drop it.

Inputs

Input	Required	Default	Description
api-key	yes	—	ar_live_… key from agent-ready.dev/dashboard/api-keys
url	yes	—	URL to scan (typically a Vercel preview URL)
min-vercel-score	no	70	Fail the step if the Vercel score is below this value (0–100)
pages	no	25	Page limit for the scan (bounded by your key's tier quota)
api-base	no	https://agent-ready.dev	API base URL override for self-hosted or staging
comment	no	true	Post a PR comment with the scan summary (pull_request events only)

Outputs

Output	Description
vercel-score	Final Vercel score, 0–100
llmstxt-score	Final llmstxt.org score, 0–100
scan-url	Shareable scan result URL
scan-id	Scan id, for follow-up calls to GET /api/v1/scans/{id}

Outputs are emitted before the threshold gate, so they are available from steps.<id>.outputs.* even when the step fails on a low score — useful for building custom summaries or opening regression issues.

What the PR comment looks like

On pull_request events (with comment: "true", the default) the action posts a summary comment: both scores, pages scanned, and a table of every failing check with its message, linking to the full shareable report on agent-ready.dev.

Behaviour details

• The scan is gated on the Vercel score against min-vercel-score. The llmstxt score is reported and exported but does not gate.
• The API key is registered with ::add-mask:: so it never appears in logs.
• Polling: every 5s for up to 5 minutes by default (override with AR_POLL_INTERVAL_SECS / AR_POLL_MAX_ATTEMPTS env vars if your scans run long).
• A scan that ends in any status other than completed fails the step.

Other CI systems

GitLab CI, CircleCI, or anything with shell access can use the equivalent curl recipe — see the CI/CD section of the API docs or the "GitLab / CircleCI / other" tab on the same page.

Development

The worker scripts are plain bash, kept separate from action.yml so they can be shellchecked and tested against a local mock API without the GitHub Actions runtime:

shellcheck scan.sh comment.sh tests/action-scripts.test.sh
bash tests/action-scripts.test.sh   # spins up a Python mock API

License

MIT © Agent Ready — https://agent-ready.dev