# AX Check: anc.dev Checked 2026-09-18. Docs, CLI install, and MCP setup all work with zero login needed. 17 of 23 checklist items pass with none flagged for attention; install commands, code examples, and MCP docs are all directly usable. ## Onboarded with real credentials ## Coding sessions All three independent sessions completed and found no pricing page (404), concluding the tool is free and documenting the same usage limits, like per-tool rate caps, with no signup or account required. ### DeepSeek V4 Pro [View public run](https://agents.withgauge.com/p/runs/eebd9b25-4ef4-4974-85a3-2bc17142855b) · [Read transcript](https://www.ax-check.com/anc.dev/sessions/deepseek.json) Final output states the product is free with explicit basis (404 on /pricing, sitemap/llms.txt checked) and names the operative constraint/assumptions: no auth, rate limits per tool (get_scorecard cheap, score_cli metered, audit_website 30/hr/IP). #### End-to-end onboarding - **Onboarded with real credentials**: anc.dev's MCP catalog is explicitly public with no authentication or API key required, so there are no credentials to obtain. The agent still exercised a real operation against the live hosted product: it POSTed JSON-RPC to the production https://anc.dev/mcp endpoint, ran initialize plus tools/call get_scorecard for multiple slugs, and got back real hosted data (score percentages, pass/fail counts) that it then printed from its own script, confirming a genuine hosted API round-trip rather than a mock. Event 26: ```text The catalog is public: no authentication, no API key. ``` Event 72: ```text Scorecard: ripgrep — 82% (tier: registry) https://anc.dev/score/ripgrep Checks: 43 total, 20 pass, 1 fail FAIL [p4-actionable-errors] Error messages include a hint or remediation phrase ``` Event 63: ```text Scorecard: ripgrep — 82% (tier: registry) https://anc.dev/score/ripgrep Via https://anc.dev/mcp — 13 tools available on the public catalog. ``` #### Hallucinated URLs None identified in this transcript. #### Blockers None identified in this transcript. #### Suggested Changes - **Add a /pricing page instead of a 404**: Requesting https://anc.dev/pricing returned a 'Not found' recovery page, forcing the agent to infer free/no-cost status indirectly from llms.txt and /mcp-skill mentions of 'no authentication, no API key' and rate limits instead of a direct answer. Adding a dedicated /pricing page (or linking cost/rate-limit info directly from the homepage) would let developers confirm the cost model in one lookup. Verify by requesting anc.dev/pricing and confirming it returns content instead of the 'Not found' page seen when the agent checked it. Event 17: ```text ===== /pricing ===== # Not found This path is not a page on this site. Recover from the machine index: - [Sitemap](https://anc.dev/sitemap.xml) - [llms.txt](https://anc.dev/llms.txt) ``` ### Kimi K3 [View public run](https://agents.withgauge.com/p/runs/40be763c-4678-4677-88df-b5ff07163b62) · [Read transcript](https://www.ax-check.com/anc.dev/sessions/kimi.json) Final summary states '/pricing returns 404' and free usage with named assumptions (scorecard lookups free/cached, web audits 30/hr per IP, CLI audits metered behind kill switch, no SLA/paid tier). #### End-to-end onboarding - **End-to-end onboarding not demonstrated**: No credentials, API key, or authentication were required or obtained. The docs explicitly state the anc.dev MCP catalog is public with no auth, and the agent successfully called the hosted get_scorecard tool over the public MCP endpoint. This is a real hosted-product operation (querying a live scorecard), but since there is no authentication step at all, it doesn't meet the bar of demonstrating credential acquisition plus an authenticated operation. Event 15: ```text anc.dev exposes the agent-native CLI standard catalog over a Model Context Protocol server at `https://anc.dev/mcp`. Thirteen tools cover five surfaces (registry, principles, spec, scorecards, web audits) plus five resources for direct lookup. The catalog is public: no authentication, no API key. ``` Event 53: ```text Tool: ripgrep Score: 82% (spec 0.5.0, tier: registry) Scorecard: https://anc.dev/score/ripgrep ``` #### Hallucinated URLs None identified in this transcript. #### Blockers - **Default Python urllib User-Agent gets 403'd by anc.dev**: The agent's first working script failed with an HTTP 403 because the anc.dev MCP endpoint rejects requests carrying Python's default urllib user-agent string. This is product behavior (a WAF/bot-filter rule keying off User-Agent), not a credentials or environment issue. The agent diagnosed it via a side-by-side curl test and resolved it in the same session by adding an explicit User-Agent header, after which the call succeeded. Event 39: ```text urllib.error.HTTPError: HTTP Error 403: Forbidden ``` Event 45: ```text === with urllib UA === 403 ``` Event 53: ```text Tool: ripgrep Score: 82% (spec 0.5.0, tier: registry) Scorecard: https://anc.dev/score/ripgrep ``` #### Suggested Changes - **Document the User-Agent requirement in the MCP quickstart**: On the /mcp-skill page (and its markdown twin /mcp-skill.md), the curl examples work because curl sends a non-empty default UA, but a stdlib Python urllib.request call with no explicit User-Agent gets a 403. Add a line to the quickstart noting that requests must carry a normal User-Agent header (or list which UAs are blocked), so developers using non-curl HTTP clients do not hit an unexplained 403. Verify by re-running the same JSON-RPC POST with Python's default urllib UA and confirming it now either succeeds or returns a clear error message stating the UA requirement. Event 39: ```text urllib.error.HTTPError: HTTP Error 403: Forbidden ``` Event 45: ```text === with urllib UA === 403 ``` ### Qwen 3.8 Max [View public run](https://agents.withgauge.com/p/runs/8b86ad55-e6cf-4c87-97a3-4a190eaeabf3) · [Read transcript](https://www.ax-check.com/anc.dev/sessions/qwen.json) README.md and final output state the product is free (no /pricing page, no tiers/account/API key) and spell out the operative cost model with named assumptions: 60 req/60s MCP rate limit, 5/hr score_cli and 30/hr audit_website metered ceilings with no anonymous fallback, and a caveat that docs call these 'pre-data placeholders' subject to change. #### End-to-end onboarding - **Onboarded with real credentials**: No credentials needed: anc.dev's MCP server is explicitly public, no auth or API key. Agent built a stdlib Python MCP client, hit a Cloudflare 403 on default User-Agent, self-fixed by setting a custom header, then successfully called live hosted tools (get_scorecard, search_tools, get_principle, audit_website) against the real server and got back genuine data (ripgrep score 82%, anc.dev web audit score). Self-service recovery plus real authenticated-less product operation qualifies. Event 36: ```text "found": true, "kind": "cli", "tier": "registry", "target": "ripgrep", ``` Event 46: ```text blocked: HTTP 403 from https://anc.dev/mcp: {"type":"https://developers.cloudflare.com/support/troubleshooting/http-status-codes/cloudflare-1xxx-errors/error-1010/","title":"Error 1010: Access denied" ``` Event 60: ```text === web audit: anc.dev score={'relative': 100, 'global': 84} https://anc.dev/score/anc.dev ``` #### Hallucinated URLs None identified in this transcript. #### Blockers - **Cloudflare blocked default Python User-Agent**: The default urllib User-Agent triggered Cloudflare's bot-signature rule (error 1010), returning HTTP 403 on the first live call to the MCP endpoint. This is test-environment/agent-side friction, not a product defect — the agent resolved it in one edit by setting a descriptive User-Agent header, after which all subsequent hosted calls succeeded. Event 46: ```text blocked: HTTP 403 from https://anc.dev/mcp: {"type":"https://developers.cloudflare.com/support/troubleshooting/http-status-codes/cloudflare-1xxx-errors/error-1010/","title":"Error 1010: Access denied","status":403,"detail":"The site owner has blocked access based on your browser's signature." ``` - **No dedicated pricing page**: The agent tried the conventional /pricing path and got a typed 404, requiring it to infer pricing information (rate limits, licensing) from other docs instead. Minor product navigation gap rather than a hard blocker since the info was recoverable elsewhere. Event 11: ```text === pricing === # Not found This path is not a page on this site. Recover from the machine index: - [Sitemap](https://anc.dev/sitemap.xml) - [llms.txt](https://anc.dev/llms.txt) ``` #### Suggested Changes - **Add a User-Agent allowance note to the MCP wire docs**: On https://anc.dev/mcp-skill (wire-level reference / error table), document that Cloudflare's bot-signature rule can 403 default HTTP client User-Agents (error 1010) and recommend sending a descriptive User-Agent. Verify by re-running a stdlib client (curl or Python urllib) with its default UA against https://anc.dev/mcp and confirming it no longer 403s. Event 46: ```text blocked: HTTP 403 from https://anc.dev/mcp: {"type":"https://developers.cloudflare.com/support/troubleshooting/http-status-codes/cloudflare-1xxx-errors/error-1010/","title":"Error 1010: Access denied" ``` - **Reconcile spec_version drift between docs and live registry**: mcp-skill.md examples show spec_version 2026.05 while the live get_scorecard call returned 0.5.0. Update the versioned example in the mcp-skill docs page (or the registry response) so the two match, and confirm by re-running the get_scorecard tool call for a known slug and diffing spec_version against the doc example. Event 36: ```text "spec_version": "0.5.0", ``` Event 21: ```text "spec_version": "2026.05", ``` ### Task given to each agent Help me build a simple example using anc.dev. Tell me how pricing works, and briefly tell me whether this product will be easy for you to manage. Let me know if you get blocked. If this product has no developer workflow you can act on, say so plainly and stop. Stay light: use the hosted product through its SDK or API. Do not start local service stacks or wait for long-running commands; if the quickstart requires either, say so plainly and stop. No product credentials were supplied and no purchases were authorized. ## Score: A · 100/100 (provisional) Grades come from completed site checks. Coding sessions and skipped checks do not affect the score. ### Clarity - **Pass** — Homepage answers Markdown requests ```text Homepage returned text/markdown with 200 when requested with Accept: text/markdown. ``` - **Pass** — llms.txt provides an actionable documentation index ```text llms.txt links principles, pages, skill, MCP server, and scorecards with starting guidance. ``` - **Pass** — llms.txt provides navigation guidance ```text llms.txt organizes content into Programmatic access, Principles, Pages, Skill, and Scorecards sections. ``` - **Pass** — llms.txt mentions offered API, MCP, and skills ```text llms.txt lists MCP server, MCP client skill, and skill bundle links. ``` - **Pass** — A compact guide representation exists ```text Homepage serves text/markdown twin; /index.md and /llms-full.txt also published. ``` - **Pass** — A focused guide is directly retrievable ```text llms.txt and llms-full.txt give a directly retrievable focused guide to the standard. ``` - **Pass** — Equivalent instructions fit a token budget ```text Markdown homepage is 1237 tokens, well under the 8000-token budget. ``` - **Pass** — Product-docs links survive format changes ```text Markdown homepage retains install, audit, skill, MCP and principle links. ``` - **Pass** — The compact guide is independently actionable ```text skill.md gives per-host git clone install commands, update, uninstall and trust model. ``` - **Pass** — Install and next-step links resolve ```text Homepage /install link and llms.txt install.md route both resolve to install guidance. ``` ### Onboarding - **Pass** — Docs lead to a relevant quickstart ```text llms.txt links /install and /audit; install page gives brew/cargo steps and points to /audit usage. ``` - **Pass** — Installation commands are extractable ```text Install page shows extractable commands: brew install brettdavies/tap/agentnative and cargo install agentnative. ``` - **Pass** — Code examples are available without interaction ```text audit.md shows runnable examples: anc audit ., --output json, --principle 3, plus sample output. ``` - **Pass** — Prerequisites and auth boundaries are explicit ```text MCP needs no auth; install prerequisites (cargo-binstall) and auth boundaries stated. ``` ### Pricing - **Skipped** — Pricing is readable without interaction ```text Not applicable: the relevant product is free. No pricing page fetched; anc.dev is a free open-source standard with no paid plans. ``` - **Skipped** — Prices are stated, not gated ```text Not applicable: the relevant product is free. No pricing page fetched; anc.dev is a free open-source standard with no paid plans. ``` - **Skipped** — Pricing units and limits are explicit ```text Not applicable: the relevant product is free. No pricing page fetched; anc.dev is a free open-source standard with no paid plans. ``` - **Skipped** — Agents identify pricing and its assumptions ```text Not applicable: the relevant product is free. No pricing page fetched; anc.dev is a free open-source standard with no paid plans. ``` ### Activation - **Skipped** — An API reference or OpenAPI spec is reachable ```text anc.dev's own audit reports no API surface; no OpenAPI spec fetched for anc.dev. ``` - **Pass** — An MCP server is documented and well-formed ```text MCP server at /mcp documented with dual-stack quickstarts, tools, resources, and error codes. ``` - **Pass** — A CLI install path is documented ```text Install page documents brew, cargo, cargo-binstall, and GitHub release archives for the anc CLI. ``` - **Skipped** — SDK packages resolve on their registries ```text Registry lookups returned cowsay (npm) and black (pypi), unrelated to anc.dev's own packages. ``` - **Pass** — Agent skills are published ```text Skill bundle published at /skill.md with per-host install commands and a canonical /skill.json manifest. ``` [Full report data](https://www.ax-check.com/anc.dev/report.json)