sitemap.xml for search engines — except this makes your site usable by AI platforms.
Place this single line before the closing </body> tag in your site's main HTML template. This automatically injects the AccessMe floating AI chatbox widget in the bottom-right corner:
<script src="https://cdn.accessme.xyz/v1/agent.js"></script>
Create /.well-known/mcp.json in your website's public root (MCP Community Convention — SEP-1649):
{
"schema_version": "1.0",
"capabilities": ["mcp"],
"manifest_url": "/site-manifest.json"
}
Define All Routes, UI Elements & Workflows (Crucial): Create a file named /site-manifest.json in your public root. This file acts as the semantic map of your store's frontend interface. You must declare all page routes, interactive UI elements, and multi-step action workflows that you want the AI assistant to see, browse, and execute on behalf of the user:
{
"schema_version": "1.0",
"site_id": "your-store-id",
"site_name": "Your Store Name",
"auth_mode": "api_key",
"homepage_url": "https://yourwebsite.com",
"routes": [
{ "route_id": "home", "path": "/", "label": "Homepage" },
{ "route_id": "search", "path": "/search", "label": "Search Results" },
{ "route_id": "cart", "path": "/cart", "label": "Shopping Cart" }
],
"elements": [
{ "element_id": "search_field", "role": "input", "label": "Product search input field" },
{ "element_id": "add_to_cart", "role": "action", "label": "Add to cart button" },
{ "element_id": "checkout_btn", "role": "link", "label": "Proceed to checkout button" }
],
"workflows": [
{
"workflow_id": "find_and_add_item",
"name": "Search for an item and add it to the cart",
"routes": ["home", "search"],
"steps": [
{
"step_id": "search_step",
"description": "Type product query in the search bar and submit",
"actions": [
{ "action_id": "search_type", "kind": "type", "element_id": "search_field", "value": "{{query}}" }
]
}
]
}
]
}
Every workflow step maps to a deterministic series of frontend clicks, scrolls, typing actions, or navigations. This structure keeps executions safe, auditable, and restricted to UI-level interactions.
Crucial Nuance: The frontend widget does not magically know how to execute actions on your site. You must handle the POST /api/agent/intent endpoint on your website's backend to map natural language intents to real site behaviors (such as returning redirect URLs, navigation paths, or a structured execution plan):
// POST /api/agent/intent
// Receives: { "intent": "view cart", "siteId": "your-site" }
// Returns: { "mode": "execute", "result": { "plan": { ... } } }
Choose the capabilities that match your website's functionality in the capabilities array:
"search" → Product/content search "navigation" → Browse pages and categories "checkout" → Complete purchases (e-commerce) "forms" → Fill and submit forms "booking" → Make reservations or appointments "account" → View order history, profile management
Once the widget script is loaded, the client-side interaction follows this exact flow:
1. Floating Button (FAB) → Anchors in bottom-right; toggles the chat panel drawer on click. 2. User Submits Intent → Visitor enters a command or clicks suggestion chips (e.g. "wishlist"). 3. Backend Call (REST) → Widget fires POST request to your website's "/api/agent/intent". 4. Progress Timeline → Widget parses the returned execution plan and draws a live progress timeline. 5. Human-in-the-Loop → If a step requires approval, widget halts and displays "Approve" and "Deny" buttons.
How AI assistants discover and securely interact with your website through the AccessMe platform:
You do not need to manually register or upload your routes, buttons, or manifest configuration to our servers. When an AI assistant (such as Claude or ChatGPT) wants to interact with your store, it queries the AccessMe MCP Gateway. Our server automatically crawls your /.well-known/mcp.json and reads your /site-manifest.json dynamically on-demand.
AI agents cannot blindly access your backend databases or administrative UI interfaces. The AI is strictly sandboxed to the routes, elements, and workflows you explicitly declare in your site-manifest.json. If a button or route is not exposed in the manifest, the AI assistant cannot see or interact with it.
All action plans sent to your website's backend are signed with HMAC-SHA256 using your private key. This guarantees that only requests originating from the secure AccessMe gateway are executed, preventing any unauthorized bot interactions.
After deploying, confirm these URLs return valid responses:
https://yourwebsite.com/.well-known/mcp.json → Should return discovery JSON https://yourwebsite.com/site-manifest.json → Should return your manifest view-source:yourwebsite.com → Script tag should be visible before </body>