How the Machine Customer Index works

The Machine Customer Index answers two questions about a company, separately, and never combines them into one number.

Access: can machine customers find and use your information? We probe the company's own domain for the files and endpoints that AI agents look for. Fourteen checks in two groups. Readable: llms.txt, llms-full.txt, Markdown content negotiation, robots.txt Agentmap, robots.txt rules naming AI crawlers, Content Signals directives, Web Bot Auth directory. Callable: resource catalog (ARD), MCP server card, agent card or manifest, agent skills index, machine-readable API description, OAuth protected resource metadata, auth.md.

Record: what can an agent learn about you? We look at what the registry holds about the company. On file: dated, attributable records, including whether anything was published in the last twelve months. Sources: which direct source classes the record draws from: the company's own site, newswire copies that reached us, analyst research, government publications. Graph: whether the company is placed in a market segment and connected to topics, five or more for the deepest state.

Every check has exactly three states: found, not found, not measured. Not measured means our probe did not get an answer, and it is never counted against a company. Each row shows found over measured, never found over total.

Access has four states plus one: Not there yet, Readable not reachable, Reachable not readable, Agent ready, and Incomplete when fewer than three quarters of our probe paths answered. Agent ready requires at least three Readable checks and at least two Callable checks, one of which must be an MCP server card or a machine-readable API description. Readable and Callable are never added together.

Record has three states: Nothing on file, On file, Established. They are thresholds, not counts. Two companies that pass the same checks get the same badge regardless of how many records each has. Record counts are shown as facts beside the row and never change the badge.

It does not rank companies against each other. There are no percentiles, no peer comparison and no leaderboard on any company page. It does not measure traffic, audience or reach. It does not claim that any AI crawler has visited a site or that any answer engine has cited a company. It does not accept self-reported results: a company can declare endpoints in its portal, and they count only after we verify them on the domain.

Every Access check is a public request against the company's domain. For example:

curl -sI https://example.com/llms.txt
curl -sI https://example.com/.well-known/mcp/server-card.json
curl -s https://example.com/robots.txt

If our page says found and the request says otherwise, or the reverse, the sweep date on the row tells you when we last looked. Claimed companies can request a re-check.

Listed domains are re-probed on a rolling sweep, twenty domains every ten minutes, and each result carries its date. Record rows update as the registry ingests new items. A company that fixes something will see the check flip on the next sweep, not instantly.

Because they are two different kinds of work. Access is what a company builds on its own site for machines to find and use. Record is what exists about the company in the registry, traced to its sources. A company can be strong on one and empty on the other, and the two together tell an agent whether it can reach you and what it will learn when it does.