auth.md exists for agent registration

low

agent_protocol_auth_md

Checks if an auth.md file exists for agent registration instructions.

What does this rule check?

auth.md provides human- and machine-readable instructions for agents to register and authenticate with your service. It complements OAuth discovery by providing context about supported identity types and registration flows.

Why is this important?

Without auth.md, AI agents have no standardized way to learn how to register for API access. This creates a manual onboarding bottleneck that limits agent adoption.

How to fix

Serve /auth.md at the site root with agent registration instructions including supported identity types, credential types, and registration URIs.

Examples

Incorrect 
GET /auth.md

HTTP/1.1 404 Not Found
Correct 
GET /auth.md

HTTP/1.1 200 OK
Content-Type: text/markdown

# Authentication

## Agent Registration
Register at https://example.com/register

## Supported Auth Methods
- OAuth 2.0 Client Credentials
- API Keys

Agent fix snippet

Copy this snippet and paste it into your AI coding agent to fix this issue automatically.

Create /auth.md at your site root:

# Authentication

## Agent Registration
Register at https://yourdomain.com/register

## Supported Auth Methods
- OAuth 2.0 Client Credentials
- API Keys