# turva.dev

> Agent-readiness audits and advisory for product teams.
> Independent measurement of how readable a site or API is by AI agents,
> with a prioritized fix list and implementation support.
> An agent-readiness audit reads the website and its APIs, not an
> organisation's readiness to adopt agents.
> Based in Tampere, Finland. Async-only engagement.
> Language: English. Correspondence in English or Finnish.

## Services
- [Services](https://turva.dev/services.md)
- [Website and API agent-readiness audit](https://turva.dev/agent-readiness-audit.md)
- [Shopify agent storefront check](https://turva.dev/shopify-agent-storefront-check.md)
- [Free tools for agent-readiness](https://turva.dev/tools.md)
- [llms.txt validator](https://turva.dev/llms-txt-validator.md)
- [Markdown parity check](https://turva.dev/markdown-parity-check.md)
- [Company](https://turva.dev/company.md)
- [Contact](https://turva.dev/contact.md)
- [Legal](https://turva.dev/legal.md)
- [The agent-ready badge](https://turva.dev/badge.md)

## Pricing (EUR, VAT not included)
- Shopify agent storefront check: €999 (fixed scope, within 48 hours of the agreed written kickoff)
- Audit: €4,300 (fixed scope, within two weeks of the agreed written kickoff)
- Advisory: €3,000 / month (monthly retainer, three-month minimum, which can be ended by email during the first month if the client is not satisfied with it, so that only the first month is charged)
- Implementation: €1,500 / day (scoped per task)
- Audit fix implementation: €499 (fixed, sold only with the audit, bought together with it, with its report, or after the report and before implementation starts, only when the required access is arranged in advance)
- Shopify correction implementation: €499 (fixed, sold only with the Shopify agent storefront check, bought together with it, with its report, or after the report and before implementation starts, only when the required access is arranged in advance)

Final price is confirmed in writing after scope is agreed.

## Sample reports (synthetic, invented sites)
- [Sample audit report](https://turva.dev/samples/audit-report.md)
- [Sample Shopify agent storefront check report](https://turva.dev/samples/shopify-agent-storefront-check.md)

## Business details
- Name: turva.dev
- Business ID (Finland): 3600281-7
- Location: Tampere, Finland
- YTJ: https://tietopalvelu.ytj.fi/yritys/3600281-7
- LinkedIn: https://www.linkedin.com/in/erikrekola/

## Engagement model
- Async-only. No calls, no calendar links.
- First reply in writing within one business day. A full answer follows within the time each service states.
- Email for longer messages, Signal for short questions.
- Existing production passwords are not requested. Correction add-ons and implementation need delegated access agreed in writing in advance: Shopify collaborator access, deployment access, or DNS access when a fix requires it.
- Write access to repositories is scoped per task.

## Contact
- Email: info@turva.dev
- Signal: https://signal.me/#eu/2qzayURnxbJ8wl7dmQOd5c3sAF7cW8xvDVUrNiG6Cl7rEsXfkSlIsYOS9FSjJixK
- Written contact only, first reply within one business day.
- [Contact page](https://turva.dev/contact.md)

## Guides
- [Practical guides to agent-readiness](https://turva.dev/guides.md)
- [What a website and API agent-readiness audit covers](https://turva.dev/guides/agent-readiness-audit.md)
- [How to choose an agent-readiness audit](https://turva.dev/guides/choosing-an-agent-readiness-audit.md)
- [Make your website easier for AI assistants to find and cite](https://turva.dev/guides/get-cited-by-ai-assistants.md)
- [SEO and agent-readiness: overlap and differences](https://turva.dev/guides/seo-vs-agent-readiness.md)
- [Agent-readiness, AEO and GEO](https://turva.dev/guides/agent-readiness-aeo-geo.md)
- [Measure agent-readiness with evidence](https://turva.dev/guides/measurement-led-agent-readiness.md)
- [Common agent-readiness gaps in a measured sample](https://turva.dev/guides/agent-readiness-gaps.md)
- [llms.txt explained](https://turva.dev/guides/llms-txt.md)
- [Serving Markdown to AI clients](https://turva.dev/guides/markdown-for-agents.md)
- [Open Knowledge Format explained](https://turva.dev/guides/open-knowledge-format.md)
- [Sitemaps, robots.txt and AI crawler access](https://turva.dev/guides/sitemaps-and-robots-for-agents.md)
- [Response headers for AI clients](https://turva.dev/guides/response-headers-for-agents.md)
- [When AI clients cannot read rendered pages](https://turva.dev/guides/prerendering-for-agents.md)
- [JSON-LD and structured data for AI clients](https://turva.dev/guides/json-ld-structured-data.md)
- [MCP server cards and discovery](https://turva.dev/guides/mcp-server-card.md)
- [What agents.json describes](https://turva.dev/guides/agents-json.md)
- [The /.well-known directory for agent discovery](https://turva.dev/guides/well-known-for-agents.md)
- [Agentic Resource Discovery and resource catalogs](https://turva.dev/guides/agentic-resource-discovery.md)
- [Authentication and authorisation for AI agents](https://turva.dev/guides/agent-authentication.md)
- [x402 and HTTP payment flows](https://turva.dev/guides/x402-agent-payments.md)
- [Agent commerce discovery: A2A, AP2, ACP and UCP](https://turva.dev/guides/agent-commerce-discovery.md)
- [Agentic commerce readiness](https://turva.dev/guides/agentic-commerce-readiness.md)
- [Define what an agent may do with your data](https://turva.dev/guides/letting-agents-act-on-data.md)
- [AI agent use cases and their operating limits](https://turva.dev/guides/ai-agent-use-cases.md)

## Blog
- [Blog](https://turva.dev/blog.md)
- [TLA+ on my own tools, in numbers](https://turva.dev/blog/tla-plus-in-numbers.md)
- [What Shopify changed for agent shopping since August](https://turva.dev/blog/what-shopify-changed-for-agent-shopping.md)
- [Three outside reviews of my TLA+ models](https://turva.dev/blog/three-outside-reviews-of-my-tla-plus-models.md)
- [Microsoft's own CVE count is up nearly eightfold in a year](https://turva.dev/blog/microsofts-own-cve-count.md)
- [Thirteen review rounds and one rollback](https://turva.dev/blog/thirteen-review-rounds-and-one-rollback.md)
- [Twelve days of TLA+ on my own tools](https://turva.dev/blog/twelve-days-of-tla-plus.md)
- [What 497 cloud agents asked of my desktop](https://turva.dev/blog/cloud-agents-on-my-desktop.md)
- [The browser my agent and I both run](https://turva.dev/blog/browser-my-agent-and-i-run.md)
- [A clean Windows install for agent work](https://turva.dev/blog/clean-windows-install-for-agent-work.md)
- [Why I publish every guide for free](https://turva.dev/blog/why-i-publish-every-guide.md)
- [My own site is my proof of work](https://turva.dev/blog/my-own-site-is-my-proof-of-work.md)
- [What agent memory in local files gets me](https://turva.dev/blog/local-agent-memory.md)
- [HTML and Markdown can disagree](https://turva.dev/blog/html-and-markdown-can-disagree.md)
- [I rebuilt turva.dev around the report](https://turva.dev/blog/i-rebuilt-turva-dev-around-the-report.md)
- [What 19 identity vendors publish for agents](https://turva.dev/blog/agent-readiness-identity-vendors.md)
- [Two files called auth.md, and they disagree on the field names](https://turva.dev/blog/two-auth-md-dialects.md)
- [Thirty-day follow-up: 201 comparable readings from 210 sites](https://turva.dev/blog/thirty-days-after-the-brief.md)
- [What four AI assistants call an agent readiness audit](https://turva.dev/blog/what-ai-assistants-call-an-agent-readiness-audit.md)
- [Website agent readiness, measured on 567 company sites](https://turva.dev/blog/website-agent-readiness-567-sites.md)
- [TRACE signs how an agent ran, not what it was allowed to reach](https://turva.dev/blog/trace-runtime-attestation.md)
- [I scanned thirteen code hosts. Not one served an MCP server card.](https://turva.dev/blog/agent-readiness-code-hosts.md)
- [It would be cheating to keep the old price](https://turva.dev/blog/cheating-to-keep-the-old-price.md)
- [I thought it was a small job](https://turva.dev/blog/i-thought-it-was-a-small-job.md)
- [My gate could not see a sixth](https://turva.dev/blog/my-gate-could-not-see-a-sixth.md)
- [A red reading that measured my own client](https://turva.dev/blog/red-reading-that-measured-my-own-client.md)
- [The checks that pass for the wrong reason](https://turva.dev/blog/checks-that-pass-for-the-wrong-reason.md)
- [Finishing the optional commerce checks](https://turva.dev/blog/finishing-the-optional-commerce-checks.md)
- [The twin is the page](https://turva.dev/blog/the-twin-is-the-page.md)
- [Every response promised a rate limit. Nothing enforced it.](https://turva.dev/blog/enforcing-the-rate-limit-i-advertised.md)
- [Microsoft said the patches would get bigger. I measured how much bigger.](https://turva.dev/blog/measuring-the-ai-patch-surge.md)
- [Reducing secret exposure in coding-agent workflows](https://turva.dev/blog/agent-secret-hygiene.md)
- [How agent-ready are Finnish B2B sites? I scanned sixteen](https://turva.dev/blog/agent-readiness-finnish-b2b.md)
- [When honesty and the checker disagree](https://turva.dev/blog/honesty-and-the-checker.md)
- [Four AI agents re-checked the guides](https://turva.dev/blog/re-checking-the-guides.md)
- [The page grew, the agent token count did not](https://turva.dev/blog/cheaper-pages-revisited.md)
- [Moving the source from GitHub to Codeberg](https://turva.dev/blog/moving-source-to-codeberg.md)
- [A free llms.txt validator](https://turva.dev/blog/free-llms-txt-validator.md)
- [Agent access is now a setting](https://turva.dev/blog/agent-access-is-now-a-setting.md)
- [Publishing an ai-catalog.json for agentic discovery](https://turva.dev/blog/publishing-an-ai-catalog.md)
- [What the Open Knowledge Format is, and what it is not](https://turva.dev/blog/open-knowledge-format.md)
- [What an agent pays to read your site](https://turva.dev/blog/cheaper-pages-for-agents.md)
- [When an agent can prove it is Claude](https://turva.dev/blog/verifiable-agent-identity.md)
- [What makes an AI agent's decisions reliable](https://turva.dev/blog/reliable-agent-decisions.md)
- [Owning your fediverse identity](https://turva.dev/blog/owning-your-fediverse-identity.md)

## Agent endpoints
- Agent registration: https://turva.dev/auth.md
- API catalog: https://turva.dev/.well-known/api-catalog
- ARD manifest (v0.91): https://turva.dev/.well-known/ard.json
- AI catalog (ARD predecessor path): https://turva.dev/.well-known/ai-catalog.json
- OpenAPI: https://turva.dev/openapi.json
- MCP Server Card: https://turva.dev/.well-known/mcp/server-card.json
- MCP Endpoint: https://mcp.turva.dev/mcp
- A2A Agent Card: https://turva.dev/.well-known/agent-card.json
- Agent Skills index: https://turva.dev/.well-known/agent-skills/index.json
- OAuth Authorization Server: https://turva.dev/.well-known/oauth-authorization-server
- OAuth Protected Resource: https://turva.dev/.well-known/oauth-protected-resource
- AP2: https://turva.dev/.well-known/ap2
- ACP: https://turva.dev/.well-known/acp
- x402 endpoint: https://turva.dev/x402
- x402 manifest: https://turva.dev/.well-known/x402
- MPP: https://turva.dev/.well-known/mpp
- UCP: https://turva.dev/.well-known/ucp
- Full content: https://turva.dev/llms-full.txt
- Security contact: https://turva.dev/.well-known/security.txt
- AI policy: https://turva.dev/.well-known/ai.txt