Agent discovery

Every machine-readable surface in one place, so an agent runtime, a crawler, or an auditor can find us without a human linking us in. Start at /llms.txt for the narrative guide, or at /.well-known/agents.json for the link graph.

Skill file

The canonical template-authoring skill lives at exactly one URL: /skills/pdf-template-author.md. The conventional short path /skill.md is a 302 redirect to it — never a second copy — so the two can never drift apart.

curl -sI https://makespdf.com/skill.md
# → 302 Location: /skills/pdf-template-author.md

curl -s https://makespdf.com/skills/pdf-template-author.md | head -c 200

Five companions live beside it (/skills/pdf-auth.md, /skills/pdf-api.md, /skills/pdf-recipes.md, /skills/pdf-fonts.md, /skills/pdf-integration.md). Fetch them on demand; the main skill file says when each one applies.

Manifests

/.well-known/agents.json

One JSON link graph: skill (+ pointer), OpenAPI, MCP, x402 paid endpoints, llms.txt, and the trust file. No community standard has won this slot yet, so the shape is small and living — treat the URLs as the contract and extra fields as advisory.

curl -s https://makespdf.com/.well-known/agents.json | jq '{skill, openapi, mcp, x402}'

OpenAPI

OpenAPI 3.1 with x402 payment annotations at /openapi.json, aliased at /api/v1/openapi.json for runtimes that probe the versioned path. The two always-paid endpoints (/api/v1/markdown at $0.01, /api/v1/render at $0.02) carry x-payment-info plus a 402 response; free endpoints carry security: [] so scanners do not probe them as paid.

MCP

Streamable-HTTP MCP server at /api/v1/mcp — schema-validated tools for the authoring loop, plus the skill file as a fetchable resource. Setup per client: /docs/mcp.

x402

Paid-endpoint manifest at /.well-known/x402 (x402scan fan-out shape). In-protocol discovery is the bazaar extension on each 402 challenge; the wire format is documented in /llms.txt under §Pay-per-call.

Trust

/.well-known/security.txt

RFC 9116 contact file: Contact plus a Expires about a year out (currently 2027-09-11). Also served at /security.txt. The contact matches the one in /legal/terms.

curl -s https://makespdf.com/.well-known/security.txt

Ops: the Expires date is a yearly bump — see SECURITY_TXT_EXPIRES in apps/web/src/server/static-text-routes.ts. Roll it forward before it lapses or audits start flagging the file as stale.

robots.txt

Explicit Allow: / stanzas for GPTBot, ClaudeBot, PerplexityBot, Google-Extended, OAI-SearchBot, Applebot-Extended, and CCBot sit above the wildcard — redundant today, deliberate: they survive a future wildcard tightening and audit tools score them. POST-only /api/ and auth-gated surfaces stay Disallowed.

What we deliberately do not ship

/.well-known/ai-plugin.json — dropped. OpenAI's plugin-manifest convention is deprecated; we ship the living conventions (Apps-SDK / A2A agent-card shape) inside /.well-known/agents.json instead and will track whatever replaces them there.

/llms.txt stays the maintained human-readable manifest — these files extend it, they do not replace it.

What's next

/llms.txt — the narrative guide for agents, with auth and the three render paths.
Bring your own AI — skill install, device flow, and the preview API.
API Reference — the REST endpoints each manifest points at.