AI2Web Validator

A tiny, dependency-free Cloudflare Worker that validates a website's AI2Web readiness. It fetches a site's manifest server-side (so it works even when the target has no CORS) and returns an AI Readiness Score out of 100 and a compliance tier. Two surfaces:

• REST - GET /validate?url=https://example.com returns a JSON result.
• MCP - POST /mcp exposes a validate_site tool, so any AI assistant can validate a site.

Live at https://validator.ai2web.dev. MIT licensed, so fork it and run your own.

Use it

# REST
curl "https://validator.ai2web.dev/validate?url=https://ai2web.dev"

{ "url": "https://ai2web.dev", "source": "https://ai2web.dev/.well-known/ai2w",
  "found": true, "valid": true, "score": 74, "tier": "Standard", "checks": [ ... ] }

A site with no manifest returns { "found": false, "message": "..." } (a valid answer, HTTP 200). An invalid or non-public URL returns HTTP 400.

Add the MCP tool to Claude / ChatGPT as a custom connector: https://validator.ai2web.dev/mcp.

Security

This worker fetches user-supplied URLs, so it is hardened for that:

• SSRF guard (safety.ts): refuses loopback, private (10/172.16-31/192.168), link-local, CGNAT, and cloud-metadata (169.254.169.254) targets, and non-http(s) schemes. The final URL is re-checked after redirects, so a redirect to an internal host is refused too.
• Timeout (8s) and response size cap (512 KB) on every fetch.
• No credentials or cookies are forwarded; responses are read as JSON only.
• Rate limiting: apply a Cloudflare rate-limiting rule at the edge (free, and the right layer for it). The worker itself does one bounded outbound fetch per request.

Develop / deploy

npm install          # only needed for local typecheck (the worker has zero runtime deps)
npx wrangler dev
npx wrangler deploy

Scoring lives in validate.ts and mirrors the AI2Web specification (sections 9 and 11). Part of AI2Web.