Skip to content

Agentic audit

Agentic audit #17

Triggered via schedule September 20, 2026 10:33
Status Failure
Total duration 10m 50s
Artifacts 1

agentic-audit.yml

on: schedule
Fit to window
Zoom out
Zoom in

Annotations

4 errors and 8 warnings
audit
Process completed with exit code 1.
Agentic regression
essential checks fell from 7 to 6
Agentic regression
score fell from 84 to 76
Agentic regression
score 76 is below the floor of 80
audit
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-node@v4, actions/upload-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Stale report
The scan is 91h old, so this run measured an old snapshot. Rescan from https://is-agentic.com/scan/buzzkit.dev.
OAuth 2.0 support
Implement OAuth 2.0 for API authentication. Publish your authorization server metadata at /.well-known/oauth-authorization-server.
Scoped permissions
Declare scoped API permissions where machines can read them: named OAuth scopes in your OpenAPI security schemes, or scopes_supported in RFC 9728 protected-resource metadata. Prose descriptions of roles help humans, but agents need the machine-readable declaration to request least-privilege access.
Content without JavaScript
Serve at least 500 characters of meaningful homepage content in raw HTML. Add a clear H1, keep deeper heading levels sequential, and remove excessive non-content markup.
Not blocked by bot detection
Allowlist known AI agent User-Agents (ChatGPT-User, ClaudeBot, Google-Extended, DeepSeekBot) in your WAF or bot-detection rules.
Agent-friendly 404s
This check awards partial credit for a real HTTP 404/410 status and full credit when a Markdown error body is also available. If the status is already correct, keep it and add the Markdown body. Include at least 20 characters explaining the error and point agents to your docs, sitemap, or llms.txt. Verify with `curl -sS -L -i -H 'Accept: text/markdown' https://yourdomain.com/some-path-that-does-not-exist`. Check both the final 404/410 status and the Markdown body, served with Content-Type: text/markdown. A correct status with an HTML error page still earns only partial credit.
Agent crawler reachability
Verify that major agent User-Agents can reach the homepage. If your WAF or bot rules block them, remove or narrow the blocking rule. Add an allow rule only when your security setup denies them by default.

Artifacts

Produced during runtime
Name Size Digest
agentic-audit-35505399689
22 KB
sha256:5a6c99b58230c8e104258a616702c8218e97aa3a519298ddbd78eb88ec78ead6