Agent readiness · Authentication as a service
logto.io
10 of 13 measurable points under formula 9.2, measured on 2026-08-12. 15 checks exist; each is one HTTP request with a published rule, so every sentence below can be rerun and argued with. 2 of them could not be measured from where we ask, and those are left out of the denominator rather than counted as failures.
A · Discovery
- PASSAnswers an agent user-agentAnswered 200 to LetAgentsIn/1.0 (+https://letagentsin.com/methodology) across three tries (200, 200, 429)
- PASSllms.txt publishedllms.txt present at https://logto.io/llms.txt and https://docs.logto.io/llms.txt, and the 12 links we sampled across the file all answer
- PASSDocs readable without JavaScript3,507 characters of text without JS
- PASSOn-demand agents not blockedNo on-demand agent is blocked
- N/APaths robots.txt points at answerrobots.txt names no concrete path, only patterns or nothing, so there is no claim to check
- PASSNo punishing crawl delayNo Crawl-delay applies to the agents we check
B · Agent entry
- UNMEASUREDAgent entry pointUnmeasurable: 3 of the 9 known agent entry paths answered with a refusal rather than a file or a 404, so what you publish there is not something we measuredLet ordinary HTTP reach these paths and this becomes measurable.
- FAILOAuth dynamic client registrationOAuth metadata published, but no registration_endpoint in it
- PASSMCP surfaceLive MCP endpoint at https://mcp.logto.io/mcp, answered 401 with an auth challenge
C · Registration
- UNMEASUREDNo CAPTCHA in the signup HTMLUnmeasurable: the signup form at https://cloud.logto.io/signup is not in the server HTML, so its gates are not eitherServer-render the form, or tell us the endpoint it posts to, and the gates become visible to us and to an agent.
- FAILSignup reachable without a browserhttps://cloud.logto.io/signup is reachable, but its form needs JavaScript
D · Provisioning
- PASSProgrammatic key provisioning2 of 7 provisioning phrases across the 3 documents we read: "management api", "account api"
- PASSFree tier or no-card trial stated in textFree tier or no-card signals at https://logto.io/pricing: "no credit card", "Free plan", "Get started free"
E · Integration
- PASSTyped SDK on the registry@logto/client@3.1.8 ships types, matched from the registry by who publishes it rather than by a link on your site
- FAILMachine-readable API descriptionNo OpenAPI spec at the 5 usual paths, none declared by https://docs.logto.io/introduction, and no markdown negotiationPoint at your spec from your docs page with rel="service-desc" and an agent finds it without guessing.
Tell me when this changes
The failures here are the kind nobody notices. An edge rule that starts refusing agents changes nothing a person sees in a browser, so the first sign is usually an integration that quietly stopped working. We rescan weekly and write only when a verdict moves.
This page is the newest scan we hold for logto.io and changes when we rescan. It is not a judgement of the product: we measure whether an unattended run can get through, not whether the thing is any good. The whole corpus is published as JSON and CSV.