Agent Site Checker
Anyone can serve a file that says who they are. Far fewer can sign it.
Paste a website. You will see what it offers an AI agent — and, for the parts that carry a key, whether the signature verifies, whether that key speaks for this origin or was copied from another one, how long ago it was signed, and whether its DNS discovery records sit in a signed zone. Everything else is listed as a plain fact. No number, no grade, no email.
Read-only. One knock is sent to the door a site itself advertises, and it is refused by design.
Why it matters
Not "it is safer" — that is true of everything and tells you nothing. Here is what actually changes.
An agent card is a file at a known path. Nothing stops someone serving a copy of a well-known company's card on a domain of their own — same name, same key, same everything. Every presence checker ticks both. Whether the signature holds, and whether the key it names speaks for the domain you are standing on, is the only thing that tells them apart. A checker that ticks the impostor is worse than none, because it was believed.
The reason to have agents is that they do not need supervising. If all you know is that a file exists, a person has to look at the site and decide whether it is really them — every time, before anything that costs money or sends data. Something that verifies is something an agent can decide by itself. That is the difference between an errand you delegate and one you watch.
A card signed eight months ago and left there parses perfectly and looks completely fine. It means the site announced agent support once and nothing has run since — you would be posting into a mailbox no one empties. A live door re-signs on a timer, so the age of a signature separates a service from a leftover. No amount of presence checking gets near that.
When the exchange is signed, what was said belongs to a key rather than to an endpoint that answered once. If an order goes wrong there is something to show. Between two anonymous endpoints, nobody is holding anything.
If you run the site, it reads the other way round: this is the check that makes you hard to impersonate. Publishing a card tells agents you exist. Signing it, from a key tied to your own domain and re-signed while you are still running, is what stops the next domain along from being you.
For agents
If you were handed a URL mid-task, you do not need this page. One endpoint,
no key, no session, two read-only tools: check_site and
verify_agent_card.
https://check.muretai.com/mcp
Streamable HTTP. Both generations of the
protocol are served on that one address — the initialize handshake and the
self-describing 2026-07-28 revision — so a client of either era connects with no
configuration of its own. Discovery document:
/.well-known/mcp.json.
{
"mcpServers": {
"agent-site-checker": {
"type": "http",
"url": "https://check.muretai.com/mcp"
}
}
}The shape most desktop and editor clients
accept. Some spell the field "transport" rather than "type",
and a few take the URL on its own — check your client's own documentation for the key
name; the address is the same either way.
{
"mcpServers": {
"agent-site-checker": {
"command": "npx",
"args": ["-y", "mcp-remote", "https://check.muretai.com/mcp"]
}
}
}Clients that predate the HTTP transport can reach a remote server through a local bridge. Nothing is installed permanently and no credential is involved.
claude mcp add --transport http agent-site-checker https://check.muretai.com/mcpOne example, not a requirement. Any client that accepts a remote MCP URL accepts the address above directly.
Prefer plain HTTP? One URL, one JSON document: /api/check?url=…
What this is not
Several tools already scan a site for the two dozen agent-facing standards and rate how many are present — Cloudflare's isitagentready.com is the thorough one, and it is free. Use it for that. This checker asks the question those leave open: of the things that are present, which ones can be proven?
An agent card is a JSON file at a well-known path — anyone can serve one naming any key. The signed envelope beside it either checks out under that key or it does not.
A card copied from another website still carries a perfectly valid signature. What gives it away is the endpoint inside it, pointing somewhere else.
A live door re-signs its card on a timer. One signed months ago and left there is a file, not a service, and a visitor is entitled to refuse it.
DNS-AID publishes agent endpoints as SVCB records. Its own draft says a visitor must not act on them unless the zone is DNSSEC-signed — so we report both.
A proxy in front of a door can return bytes identical to the door's own refusal. When we cannot tell which one spoke, we say so instead of guessing.
You get what was fetched and what came back. A single number would hide whose rubric produced it, and there is no arguing with a number.