plugin.json

{
  "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
  "name": "site-check",
  "version": "1.5.0",
  "description": "Site SEO and AI Crawler Audit checks public web pages and reports what they publish right now: SEO tags, redirects, AI crawler rules, AI citation signals, landing page conversion and, for a site you own, what leaks publicly. People also call it Site Check.",
  "keywords": [
    "SEO audit",
    "Open Graph",
    "robots.txt",
    "301 redirect",
    "broken link",
    "JSON-LD",
    "meta tag",
    "canonical",
    "attack surface"
  ],
  "author": {
    "name": "Agent Tools",
    "email": "support@openkrill.app",
    "url": "https://tools.openkrill.app/"
  },
  "homepage": "https://tools.openkrill.app/",
  "extensions": {
    "com.openai": {
      "interface": {
        "displayName": "Site SEO & AI Crawler Audit",
        "shortDescription": "SEO, AI citation, CRO, leaks",
        "longDescription": "Site SEO and AI Crawler Audit checks public web pages and reports what they publish right now: SEO tags, redirects, AI crawler rules, AI citation signals, landing page conversion and, for a site you own, what leaks publicly. People also call it Site Check.\n\nThe exposure check works only on a domain you prove you own: the first call gives a DNS TXT record or a file to publish, and the check runs once it is live. It never looks up a person, a user name or an email address.\n\nPage and crawler checks: which of 14 AI crawlers robots.txt allows on a page and the rule that decided it; the title, description, canonical, Open Graph and Twitter tags and which are missing; and the 301 redirect chain with status codes and headers.\n\nStore and AI checks: one product page's SEO and Product structured data (price, GTIN, availability); a domain's llms.txt, agents.md, UCP file, sitemap and AI crawler rules; five AI citation signals of one page, each with evidence and a fix; and a sample of up to 40 sitemap addresses for broken pages and redirects.\n\nLanding page check: twelve conversion items such as the h1, the call to action and whether its links work, form fields, trust signals, a price section, viewport and a contact path, each with evidence and a fix. It is a checklist, not a forecast.\n\nExposure check: exposed or clean with the top 3 risks and fixes, from dangling subdomains, leaked files such as .env, admin paths and masked API keys in the page's scripts, plus six legal signals with official sources. No port scan, and not legal advice.\n\nWhat it does not do: no speed test, no rankings or traffic, no JavaScript, no sign-in, no page text returned, and no private, local or internal addresses. It does not request a page that robots.txt disallows for Agent Tools. robots.txt is a request, not access control, and a firewall can treat real crawlers differently.\n\nIt stores nothing about you or the site. Answers are cached for five minutes, and the only lasting record is a daily count of calls per tool.",
        "developerName": "Agent Tools",
        "category": "Developer Tools",
        "capabilities": [
          "Shows whether robots.txt allows or blocks 14 published AI crawlers",
          "Shows the rule that decided each crawler, the sitemaps and any noindex or noai directives",
          "Reads a page's title, description, canonical link, language and icons",
          "Reads Open Graph and Twitter share tags and lists the common ones that are missing",
          "Follows the redirect chain with each status code and shows the final address and headers",
          "Checks one product page's title, description, h1, canonical link and Product structured data (price, GTIN, availability)",
          "Checks a domain for llms.txt, agents.md, the Shopify UCP file, a sitemap and AI crawler rules in robots.txt",
          "Checks a page for five AI citation signals: summary, author credentials, Q&A format, headings, structured data",
          "Checks up to 40 sitemap addresses for broken pages and redirect chains, skipping pages robots.txt disallows",
          "Checks a landing page's h1, call to action, form fields, trust signals, pricing, viewport and contact path",
          "Tests up to five call-to-action links of a page and gives each finding with evidence and a fix",
          "Checks the exposed surface of a domain its owner proves: leaked files, dangling subdomains, default pages",
          "Finds API keys in the JavaScript an owned app ships, public source maps and open admin paths, keys masked",
          "Flags 6 legal signals on an owned app (COPPA, fonts, session replay, CAN-SPAM, renewals, DMCA) with sources",
          "Refuses private, local and internal addresses and redirects into them"
        ],
        "websiteURL": "https://tools.openkrill.app/",
        "privacyPolicyURL": "https://tools.openkrill.app/privacy",
        "termsOfServiceURL": "https://tools.openkrill.app/terms",
        "supportURL": "https://tools.openkrill.app/support",
        "defaultPrompt": [
          "Will AI assistants cite https://example.com/blog/guide?",
          "Is https://example.com/products/blue-mug set up for search?",
          "I own example.com: is anything exposed?"
        ],
        "brandColor": "#0369A1",
        "brandColorDark": "#63A4E8",
        "composerIcon": "./assets/icon.svg",
        "logo": "./assets/icon.svg"
      },
      "review": {
        "demo_recording_url": "https://tools.openkrill.app/demos/site-check.mp4",
        "test_cases": {
          "positive": [
            {
              "description": "Title and description lengths, h1 count, canonical link, the Product structured data (name, brand, SKU, GTIN, price, currency, availability, variants) and an issues list such as a missing GTIN or a canonical that points elsewhere. Check against: https://www.allbirds.com/products/mens-tree-runners and https://www.allbirds.com/robots.txt",
              "prompt": "Is https://www.allbirds.com/products/mens-tree-runners set up for search? Check the title, description and product data.",
              "tools_triggered": "product_page_seo",
              "expected_behavior": "Calls product_page_seo with url \"https://www.allbirds.com/products/mens-tree-runners\"."
            },
            {
              "description": "Twelve checks with pass, warn, fail or info, each with evidence and a fix when it is not a pass: the h1, the supporting sentence, the primary call to action and its repeats, link targets, form fields, trust signals, pricing or next step, viewport, HTML size, render-blocking hints and contact path, with a note that JavaScript-added content is not seen. Check against: https://example.com/ and https://example.com/robots.txt, plus up to five call-to-action links",
              "prompt": "Review my landing page https://example.com/ for conversion. What should I fix first?",
              "tools_triggered": "landing_page_check",
              "expected_behavior": "Calls landing_page_check with url \"https://example.com/\"."
            },
            {
              "description": "Evaluates five citation signals (summary clarity, author credentials, Q&A format, heading structure, structured data) with pass, warn or fail, evidence and a concrete fix, plus domain files and AI crawler rules. Check against: https://www.allbirds.com/pages/our-materials-tree with /robots.txt, /llms.txt, /agents.md, /.well-known/ucp and /sitemap.xml",
              "prompt": "Will AI assistants cite this page, and what should I fix? Check https://www.allbirds.com/pages/our-materials-tree",
              "tools_triggered": "ai_readiness_check",
              "expected_behavior": "Calls ai_readiness_check with url \"https://www.allbirds.com/pages/our-materials-tree\"."
            },
            {
              "description": "A sample of up to 40 sitemap addresses with counts by status, and an issues list of each broken, unreachable or redirected address with its status and final address, noting that it is a sample. Check against: https://www.allbirds.com/sitemap.xml and the addresses it lists",
              "prompt": "Are any pages of allbirds.com broken? Check the sitemap.",
              "tools_triggered": "link_sample_check",
              "expected_behavior": "Calls link_sample_check with domain \"allbirds.com\"."
            },
            {
              "description": "Either ownership_not_proven with the exact DNS TXT record and file to publish, or exposed or clean with up to three risks, a fix for each, and the evidence with its source. Check against: https://cloudflare-dns.com/dns-query?name=_agent-tools-exposure.openkrill.app&type=TXT and https://crt.sh/?q=%25.openkrill.app&output=json",
              "prompt": "I own openkrill.app. Is anything on it exposed to the internet?",
              "tools_triggered": "exposure_check",
              "expected_behavior": "Calls exposure_check with target \"openkrill.app\"."
            }
          ],
          "negative": [
            {
              "description": "The plugin checks one page or one domain per call and keeps nothing between calls. Expected: Does not call a tool; says Site Check does not collect catalogs or prices and does not monitor sites over time.",
              "prompt": "List every product and its price from https://competitor.example.com and track the prices every day."
            },
            {
              "description": "Private and local addresses are refused, and the plugin has no access to store admin data or personal data. Expected: Does not call a tool; says only public pages of public websites are checked and that it cannot sign in or read orders or customers.",
              "prompt": "Log in to my store admin at http://localhost:9292/admin and tell me which orders and customers need attention."
            },
            {
              "description": "The exposure check reads certificate, DNS and host records of a proven-owned target only; there is no person or account search. Expected: Does not call a tool; says Site Check never looks up people, user names or email addresses, and the exposure check only covers a domain or IP the user owns.",
              "prompt": "Find every account that uses the username jdoe88 and the email jdoe@example.com across social sites."
            }
          ]
        }
      },
      "publication": {
        "release_notes": "Checks AI crawler access (robots.txt for 14 AI crawlers, the X-Robots-Tag header and the robots meta tag), reads page and share tags, and traces redirects with response headers. Wording now includes SEO audit, Open Graph, 301 redirect and broken link, the words site owners use. Adds store checks: product page SEO with Product structured data, AI readiness of a domain (llms.txt, agents.md, UCP, sitemap, AI crawler rules) and a link sample of up to 40 sitemap addresses. Adds five AI citation signals to the AI readiness check: summary clarity near the top, author credentials, Q&A format, heading structure, and structured data, each with pass, warn or fail, evidence and a concrete fix. Adds a landing page check: headline, call to action, form fields, trust signals, pricing or next step, viewport, load hints and contact path, each with evidence and a fix. The store, page and landing checks skip pages robots.txt disallows for Agent Tools. Adds an exposure check for a domain or host the caller proves they own by a DNS TXT record or a well-known file: dangling subdomains from certificate transparency, leaked files, development servers, default pages and the https redirect, answer first with the top three risks and a fix for each. The exposure check now also looks for .env.local, .env.production, the git config, .npmrc, AWS credentials, a WordPress config backup and a database dump, reads up to three of the page's own scripts for API keys (masked) and source maps, and reads four admin paths by status only. Every answer carries an ownership note, and a host gets one full check per minute. A page at the Site Check address runs the same check for people. The exposure check now adds six legal signals, each with its law and an official source and a plain not legal advice note: sign-up age question (COPPA), Google Fonts from Google's servers (GDPR, Munich 3 O 17493/20), session replay scripts (California Penal Code 631 and 637.2), renewal terms next to a subscribe button (California Business and Professions Code 17602), DMCA agent link and Copyright Office registration, and an unsubscribe link and postal address in a pasted marketing email (CAN-SPAM). What cannot be seen from outside is reported as not checked with the reason. Findings are now labeled confirmed, needs verification or rejected, and the answer shows how each label was reached in four phases (map, hunt, verify, report), adapted from the Cloudflare security-audit skill (MIT); only confirmed findings carry a severity. Only public http and https sites are fetched, and redirects are re-checked on every hop. Answers are cached for five minutes; read-only, no sign-in."
      },
      "apps": "./.app.json"
    }
  }
}