Deep Dive6 min readApr 21, 2026

Understanding VibeSignal: how the AI Readiness Grade works

How VibeLeak scores whether AI crawlers, answer engines, and autonomous agents can find, read, and use your site — and how to read the five capped V2 category rows in the scan spotlight.

Product signal

Trust is for humans. VibeSignal is for machines that decide on your behalf

Search engines and browsers were the old distribution layer. Assistants, agents, and answer engines are the new one — and they only work when your public site exposes clear, consistent signals.

What it is not

VibeSignal is not a measure of model safety or prompt injection risk inside your app. It is strictly about passive, public signals: what an automated client can see without logging in.

Breakdown

Five raw buckets, weighted into one grade

Each category still caps at twenty raw points for compatibility, but V2 weights them 35 / 35 / 20 / 7 / 3 before the AI Readiness Grade is assigned.

Discoverability

35 weight

Raw ledger 6+6+4+4 for robots, named retrieval policy, sitemap, and canonical.

Content access

35 weight

Raw ledger 14+4+2 for llms.txt, structured data, and semantic public content.

Bot access

20 weight

Broad-allow raw ledger 12+4+4 for retrieval access, X-Robots-Tag, and meta robots.

Protocols

7 weight

MCP, agent.json, API discovery, and security/auth discovery stay low-weight but real.

Commerce

3 weight

Pricing and conversion cues matter, but they do not overpower the core discovery/readability lanes.

How to read the numbers

The grade comes first. The 0–100 number is the weighted outcome of those raw buckets, and B/D caps can still stop a superficially high score from reading as healthy when critical readiness prerequisites are missing.

Reading the label

Strong, partial, or weak describes the whole picture

The label is derived from the final grade, not from a separate threshold system. Use the raw buckets and cap reasons to understand where the grade is being held back.

Strong Signal: grades S or A. The public surface is consistently legible to automated discovery and interpretation.
Partial Signal: grades B or C. Some buckets are healthy while others still hold the readiness grade back.
Weak Signal: grades D or F. Critical discovery, access, or policy prerequisites are missing or contradictory.

Workflow

Use the AI Signals tab in findings review when you want a focused pass

The full queue still mixes transport, headers, and exposure. The AI Signals filter keeps only VibeSignal-tagged items so you can copy remediation text and track roadmap themes without context switching.

Run a scan

Complete a public scan so VibeSignal can evaluate the live response path and HTML surface.

Open findings review

Switch to the AI Signals view to see only the VibeSignal category rows with evidence and fixes.

Copy fix and recheck

Use Copy fix on remediation text, ship changes, then rerun the scan to confirm the score moved.

Next action

Run the scanner against your own site

The article lands hardest when it turns into a fix list. Scan, close the gaps, and recheck.

Start scan

More field notes

Back to blog Top

Workflow

Can Hermes Agent Audit a Live Website? Testing VibeLeak MCP End to End

Connect Hermes Agent to VibeLeak MCP, audit a live website, inspect the security boundary, and export agent-ready remediation evidence.

Open article

Security

GPT-5.6 Sol + Codex Security: Scan Outside, Fix Inside

Turn a VibeLeak public-surface scan into a structured security handoff for Codex Security and GPT-5.6 Sol to validate and patch.

Open article

Workflow

AI agents are checking your website now. Here is the VibeSignal readiness checklist

Search is becoming conversational, agentic, and more selective about what it can understand. This is the practical checklist for making your public website easier for AI agents to find, read, use, and verify.

Open article