/.well-known/agent.json returns HTML app shell instead of agent manifest JSON
/.well-known/agent.json is a proposed manifest location for declaring what an AI agent may do on a site, sometimes described as a robots.txt for agents. This check requested that path and received the site's HTML app shell rather than JSON, which normally means the router falls back to the homepage for unrecognised URLs.
Why this matters
Keep expectations calibrated: this is a proposal, not an adopted standard, and there is no public evidence that the major agent products read it. The protocol that actually won the agent-to-tool layer is MCP, which was donated to the Linux Foundation in February 2026 and is adopted by Anthropic, OpenAI, Google and Microsoft. The finding worth acting on is the catch-all routing, which returns 200 with HTML for any unknown URL and makes automated checks believe files exist when they do not.
How to fix it
Your developer needs about 30 minutes. The current setup routes every unmatched address through the site's catch-all page (common in single-page apps). Exclude /.well-known/agent.json from that catch-all and serve a real JSON file there instead, with the response header set to application/json, describing what the site lets agents do. Alternatively, remove the route so the address returns a plain 404 (page not found) instead of a misleading success response.
Turn website findings into an action plan
Create an account to start a Full Audit of your website, with supporting evidence and a prioritised action plan.
Start Full Audit