Version 1.4 · applies to the Agent Web Index and the Checkout Benchmark · data licensed CC BY 4.0
The research corpus is seeded from the Tranco list of popular domains and classified into site types (commerce, SaaS, media, documentation, education, and others) by an LLM classifier; unclassifiable sites are kept as "other" rather than dropped, so the corpus stays representative rather than curated. Domains matching the operator blocklist and domains that fail DNS resolution are filtered before scanning.
Inclusion: a site enters an index snapshot when it has at least one completed or partially-completed scan; each site contributes its most recent scan only. Exclusion: sites that requested takedown are removed from scanning and from all research aggregates. Corpus sites did not opt in and are not endorsed by or affiliated with Scovant; removal requests are honored at any time.
Scans run from Scovant's own infrastructure in a single US-West AWS region. The crawler fetches pages over plain HTTPS (httpx) and escalates to a real headless-Chromium render only when a page is detected as a client-rendered shell, adopting the rendered content only when it is materially richer than the static fetch. Each site is sampled: the homepage plus same-site pages discovered from links and sitemaps, up to a per-scan page budget — research metrics are therefore per-site samples, not exhaustive crawls.
The agent-identity fetch uses an honest, stable user agent (ScovantBot/1.0 with a published bot page and contact address), honors robots.txt for its own token, and applies a conservative per-domain rate limit (10 requests/minute by default). Scovant never impersonates other companies' crawlers: per-bot robots verdicts are computed from the robots.txt file itself, and this honest identity is one of four homepage fetches taken per scan — anonymous browser, honest ScovantBot, signed (Web Bot Auth), and self-spoofed — all following redirects to the same final page.
Declared policy: robots.txt is evaluated with a real robots parser for all 14 AI user-agent tokens in Scovant's registry (search, agent, training and commercial-validation intents — OAI-SearchBot, ChatGPT-User, GPTBot, ClaudeBot, Claude-SearchBot, Claude-User, PerplexityBot, Perplexity-User, DuckAssistBot, Applebot, Applebot-Extended, Google-Extended, CCBot, OAI-AdsBot). Observed behavior: four homepage fetches — anonymous browser, honest ScovantBot, signed (Web Bot Auth) and self-spoofed — classified by WAF/bot-protection response signatures (block pages, challenge interstitials, HTTP status patterns); redirects are followed to the same final page on every leg. A declared "allow" with an observed block is reported as exactly that — the two layers are never merged.
Interfaces: MCP discovery (/.well-known/mcp.json) with a real initialize handshake and read-only tool enumeration (never a tool call). A site counts as declaring MCP only when that file is a valid discovery document listing at least one endpoint; any other answer at that path (an HTML page, JSON with no servers) is counted separately and never enters the working-interface rate; UCP profile validation against the official UCP v2026-08-25 profile (from the December 2026 snapshot, six series under protocols.ucp; a scan made before that reading is not measured); llms.txt presence; WebMCP presence and declared tool annotations via a headless-browser probe (never invoking a tool). Metrics that depend on newer probes publish their own measured-site coverage — "not measured" is reported as absence of data, never as "no".
Simulation verdicts (Checkout Benchmark) carry a failure taxonomy: failures attributed to Scovant's own platform (infrastructure errors, our janitors sweeping a stuck run) are excluded from both numerator and denominator; site-caused and bot-protection failures count. Simulations never enter payment details or create accounts.
One site, one vote: every rate is computed per site over its latest scan, never per scan or per page. The headline index is the corpus median overall score — a deliberately boring statistic, not a novel composite. Percentiles (p25/p75), share below 60, and per-category distributions are published alongside it. Every snapshot records the exact ruleset and app versions that produced it, and the scoring model itself is versioned — a score change is always attributable to either a site change or a model change. From November 2026, every published rate carries its numerator beside it (for example present_n next to measured_present_pct), and its denominator is the coverage, measured or declared count named in the dataset.
Snapshots through October 2026 were computed under the frozen R1 model (series readiness-r1); from the November 2026 snapshot on they use the R2 readiness methodology (series readiness-r2), the primary model since 2026-10-02. Each row of the dataset carries methodology_series, series_break (true on the first row of a new series) and comparison_valid (false between rows of different series) — a month-over-month delta across the break is not meaningful and is not shown. Every corpus row carries evidence_state = estimated: the corpus runs no agent simulations, so its numbers rest on passive evidence only. Corpus site profiles come from the domain-name classifier (domain-name-v1, recorded as metrics.profile_classifier;profile_policy_id names the applicability policy the numbers were computed under), not from the homepage classifier that customer scans use. Sites whose automated access was refused outright are excluded from medians and percentages and counted separately (metrics.access_refused, share over all sites in the snapshot). The headline sample size counts every site in the snapshot, refused ones included. Fields methodology_series, evidence_state, profile_policy_id, metrics.profile_classifier and metrics.access_refused are guaranteed from readiness-r2 onward; legacy readiness-r1 rows may carry null — they predate the fields, and history is never rewritten.
definition_versions names the definition version of every metric group and definitions_version the snapshot's; a change of definitions is a series break inside readiness-r2. Latest-scan metrics include only sites rated under the live scoring model and its current ruleset (excluded_old_model_n counts the rest; the access-stability histories are not filtered by model). The single UCP rate is split into six series (detected_any, parseable_legacy, valid_supported_version, valid_current_version, checkout_current_namespace, permalink_declared); ucp_profile_pct ends with the November 2026 snapshot.mcp_file_invalid_n) and the working-interface rate is "not measured" when nothing could be tested.methodology_series, series_break, comparison_valid), corpus evidence state and profile policy recorded.Scovant is an AI agent readiness testing platform that scans, simulates, and continuously monitors websites to determine how reliably AI agents can discover, understand, and interact with them.