Agent instructions, delivered in the response itself

When an AI agent hits a protected page, how does it know what to do next? Documentation and pre-configured knowledge can help, but that requires setup before the problem occurs. A more direct option is to embed the instructions in the HTTP response itself, right where the agent is looking.

Vercel encountered this exact problem with its preview deployments. These are protected by Vercel Authentication by default, which blocks random users but also stops coding agents like Cursor, Devin, or Claude Code from accessing the software. Vercel already offers bypass mechanisms for automated access and an MCP server with functions like get_access_to_vercel_url and web_fetch_vercel_url to help agents. But that raised a question: how does an agent know these tools exist in the first place?

The resolution was to put the instructions where the agent would inevitably see them—in the HTML of the 401 response itself.

The proposed mechanism

The idea builds on llms.txt, the emerging standard for making web content directly consumable by AIs. The convention is to include LLM-targeted content inside an HTML response using a new script type:

<script type="text/llms.txt">
  Instructions to the LLM go here.
</script>

Using a <script> element with an unknown type is deliberate. Browsers ignore such elements entirely, so the content has no effect on rendering. Because script elements are valid inside <head>, the instructions can sit near the top of the document where LLMs are most likely to encounter them. The elements can also hold nearly any content except </script>, making them suitable containers for markdown or other LLM-oriented formats.

Why align with llms.txt instead of something like AGENTS.md? AGENTS.md targets agent context within a code repository, while llms.txt is oriented toward web publishing. Since this pattern is about content served over HTTP, llms.txt is the more fitting foundation.

In production on Vercel's 401 page

Vercel has already shipped this on its default 401 page for deployments. The embedded instructions look like this:

<script type="text/llms.txt">
  ## Note to agents accessing this page:
  This page requires authentication to access. Automated agents should use a 
  Vercel authentication bypass token to access this page.
  The easiest way to get a token is using the get_access_to_vercel_url or 
  web_fetch_vercel_url functions of the Vercel MCP server at 
  <https://mcp.vercel.com> (Docs at <https://vercel.com/docs/mcp/vercel-mcp>).
  Alternatively, this URL documents how to use the bypass token: 
  <https://vercel.com/docs/deployment-protection/methods-to-bypass-deployment-protection/protection-bypass-automation>
  You need to prompt the user to provide the bypass token to access this 
  page. The URL above also explains how the user can access the bypass token. 
  Then you can calculate a URL of the following form and successfully access it: 
  `https://current-domain/current-pathname?x-vercel-set-bypass-cookie=true&x-vercel-protection-bypass=$bypass_token`.
</script>

You can see it in action by fetching a test URL with curl -i https://access-test.vercel.app/ | less.

The pattern did not prompt that agents understand it. When the first deployment shipped, it worked immediately—no coordination with any LLM provider was necessary. The discovery is inherently ephemeral, located in the response the agent actually receives, which can make it more immediate than the llms.txt baseline.

Wider applicability

The access-control scenario is not unique to Vercel—many platforms will face the same question of how to guide agents past authentication hurdles. But the same mechanism applies elsewhere. MCP servers are proliferating, yet MCP itself has no discovery mechanism. A <script type="text/llms.txt"> tag could point an LLM that is stuck on a site to the MCP server that can help it proceed. Similarly, error pages that link into observability tools could use the tag to direct an agent toward the MCP service that can investigate the problem.

This does not need to become a formal standard. Browsers ignore it, and LLMs have proven flexible enough to interpret it without specific training. Teams can adopt the convention on their own sites today.