Most tools that tell you whether a website is "AI ready" are guessing. They fetch a page, hit a timeout or a bot wall, and publish their own failure as a fault of the site. We built Scovant Core because we needed the opposite: a scanner whose every verdict carries the evidence it came from, and which says "I could not look" instead of inventing an answer.
Scovant is an AI agent readiness testing platform that scans, simulates, and continuously monitors websites to determine how reliably AI agents can discover, understand, and interact with them. Scovant Core is the open-source engine behind the first of those three layers: a passive scanner you can run yourself, against your own site, with no account.
What it checks
69 checks across six categories — 51 readiness checks, eight of them experimental (reported, but excluded from the score until they are promoted against published criteria), plus 18 unscored security checks. The five readiness categories: whether agents can reach and are allowed to read the site (access); whether the content is machine-understandable (machine); whether the site exposes an agent interface (interfaces); whether the trust and commerce surfaces an agent needs are discoverable (trust); and how expensive the site is for an agent to operate (operability).
The newest group is HTTP semantics: does a missing page return a real 404 (a
soft-404 fails; an SPA shell warns), does a 429 carry Retry-After, and is a
challenge page ever served as a 200? Agents act on status codes; a site that
lies in them breaks retry logic silently.
Every check is passive. Core issues ordinary GETs, never authenticates, never submits a form, and never invokes a tool it discovers. It is meant to be run against sites you own or are authorised to test.
Evidence, not vibes
Three rules make the output trustworthy, and they are the reason we wrote our own engine instead of wrapping an existing one.
A document we could not read is an error, never a finding. If robots.txt times out, the report says the evidence is missing and the coverage drops — it does not say the site blocks crawlers.
Absence is only reported when absence is the answer. A 404 on a page we probed opportunistically is "not applicable". A missing robots.txt is a real finding, because its absence is itself the fact.
A document read only in part says so. Every fetch is capped at a
per-document-kind byte limit, and any verdict drawn from a body cut off
by that cap carries "truncated": true in its evidence and drops to at
most medium confidence, because anything past the cap is invisible to
us — our limit, not the site's property.
The score
Each check is PASS, WARN, FAIL, N/A or ERROR. Since 0.18.0 the headline result
is Technical Readiness: the open R2 rating of the readiness rules Core
evaluates from its own evidence, published in
docs/r2.md.
It is shown with its coverage and names the rules Core could not measure;
when too little was measured you get INSUFFICIENT_EVIDENCE rather than a
number. The checks themselves are diagnostics:
docs/crosswalk.md
maps each one to the readiness rules that read the same signal, and names the
rules only Scovant Cloud can evaluate, because they need a real agent. The
older five-domain score was deprecated in 0.18.0 (kept behind --legacy-score
in that release only) and is removed in 0.19.0. The rest of the model is in
the methodology document:
docs/methodology.md.
The current ruleset is 2026.10, shipped in 0.3.1. Scores from ruleset 2026.09
and 2026.10 are not comparable — HTTP semantics became required in 2026.10.
What Core deliberately does not do
Core does not drive a browser agent, does not run a purchase simulation, and does not offer multi-model testing. Those live in Scovant Cloud, our platform, which imports Core's evidence layer as its scanning foundation and builds the simulation and monitoring layers on top of it — not the other way around. Core only answers "can an agent discover, read and understand this site", which is the part you can verify from the outside, deterministically, in seconds.
Install
uvx --from scovant-core scovant scan https://example.com
npx @scovant/core scan https://example.com
pip install scovant-core
The npm package is a thin launcher around the same Python engine: its uvx
and pipx paths pin the exact same version as the PyPI release, so those two
give you identical checks and the same ruleset version; if it falls back to
a plain python3 that already has scovant_core installed, you get whatever
version that interpreter has.
There is also a composite GitHub Action for running Core on every pull request,
and scovant mcp starts a stdio MCP server exposing five read-only tools, so an
agent can run the scanner itself.
Contributing scan results is opt-in
Core sends nothing anywhere by default. There is a flag that contributes a single scan's check statuses and score, together with the scanned site's domain, to a public research index, and it is off unless you pass it. The domain is the only part of the URL that is sent: no path, no query string, no page content, no evidence. The README lists every transmitted field. The published index carries statuses only, and it is kept separate from the corpus we scan ourselves.
Contributed client scores are never authoritative: the published index carries only rows our own server re-scanned and verified.
Licence
Apache-2.0. Every release ships pinned constraints, an SBOM and a signed release manifest. Issues and pull requests are welcome; the contribution policy and the rule-admission criteria are in the repository.