Your docs are production now

Docs make or break developer products. This week they also ran code, answered pricing questions, and got a meter. Three rules.

1. Review your docs like code, because agents run them

Alon Hertz read 8,565 llms.txt files from 6,214 company domains. More than 237 had install commands for packages nobody had registered. He claimed a few of the names with a harmless beacon. A machine inside a Fortune 500 company ran one in under four minutes.

Clerk’s docs said npx clerk-next-fix-auth-protection. Someone else had already published that name. It had malware in it.

Who writes these files? Docs and marketing. Who reviews them? Usually nobody. Who runs them? An agent, exactly as written.

Am I affected? If you ship an llms.txt, an AGENTS.md, a rules file or a quickstart with an install command in it, maybe. Which commands? Every npx, npm install, pip install and curl | sh. How long does the check take? This site publishes an llms.txt. We checked it on Thursday. Markdown links only, no commands. Two minutes.

Your move:

• List every install command in your agent-facing files.
• Register every package name they mention. Today.
• Add a CI check that fails when the docs reference a name you don’t own.

Takeaway: you lint your code. Your docs are code now. Lint them.

2. Put the price in the docs

Developers don’t want to talk to sales. They go to the docs and the pricing page. Agents skip the pricing page too.

Profound and Growth Unhinged asked six AI engines 7,600 pricing questions about Cloud 100 companies. The company’s own pricing page came first 12% of the time. Vendr, Reddit and G2 came first more often. Only 57 of 77 public pricing pages were fully readable to a bot. Tabs, client-side rendering, robots.txt. (Profound sells AI visibility monitoring. This is also their pitch. The method and sample are public.)

Plaid is the exception. Their billing docs got cited in 70% of their responses, above their own pricing page at 64%. Those docs publish no prices at all. They define the billing model per product and endpoint, name the costly edge cases, and say plainly which numbers are not public. The docs explain. They don’t sell.

This is the same reader the docs already have. Across every docs site Mintlify hosts, agents are now about 66% of traffic, up from 15% in January (Mintlify’s own counter). And the best answer to “write for the agent or write for the human” this week came from Val Town’s Pete Millspaugh, who measured his bots and then kept writing docs in his own voice anyway. Write how you talk. Both readers prefer it.

Your move:

• Ask the engines your buyers use what your product costs and what the catch is. Read what they cite.
• Write a billing page in the docs. Plain HTML. One question per heading. Every public number in the text, not rendered by JavaScript, and one plain line for each number that isn’t public.
• Let any docs page be fetched as Markdown. Add .md to the URL, or serve it on Accept: text/markdown.

Takeaway: the pricing page sells. The docs explain. Agents cite the one that explains.

3. Count landings, not impressions

Google gave everyone a meter this week. Search Console’s AI performance report went global: impressions from AI Overviews, AI Mode and Discover. No clicks. Same week, Gemini 3.8 Flash landed in AI Mode and citations disappeared for top-of-funnel queries. Google’s Search VP says a fix is coming.

So the meter arrived and the needle broke in seven days. That’s the problem with impressions. They’re a by-product of someone else’s model, and someone else can turn them off.

The number to trust is smaller and yours. Millspaugh’s (opens in a new tab): in July, most new Val Town Pro signups with a known referral source came from AI, mostly Claude. Self-reported, partial, and measured before he optimized anything. He randomized the “how did you hear about us” options after noticing the first one got picked more. That’s anecdata. Anecdata beats a dashboard you don’t control.

Your move:

• Turn the Search Console report on. Read it like weather.
• Add an AI referral segment in analytics.
• Add a free-text “how did you hear about us” and randomize the options.

Takeaway: landings > impressions. Own the number you’ll be asked about.

Quick hits

• Val Town shipped “Login with Val Town” in two lines (opens in a new tab) and put up a live demo connecting to 3,613 services. A demo you can click beats a post about OAuth’s n-squared problem. They published both, in that order.
• Neon ran 100 support tickets through 42 models (opens in a new tab) and published the rubric and the whole cost spread, 1,446x between cheapest and priciest. A vendor benchmark built to sell a gateway, but you can rerun it. That’s the bar.
• Fly.io gave the agent a computer. (opens in a new tab) Sprites now speak MCP, with caps on how many an agent can spin up. The guardrail is part of the pitch, not a footnote.
• Nvidia is buying Hugging Face for $12.93B. (opens in a new tab) The biggest devtools cheque of the week bought the place 18 million developers find models, not a model. Distribution is the asset.
• April Dunford: most AI features don’t need a repositioning. (opens in a new tab) New alternative, changed capability list, shifted value themes. None moved? Skip the rebrand.
• GitHub gave four Copilot models four weeks (opens in a new tab), and every seat goes prepaid October 1 (opens in a new tab). The meter’s honesty test has a date now. Thread.

Watch

1. Does Vercel publish the results of its $1M bounty? In August Vercel put up to $1M on HackerOne (opens in a new tab) for anyone who could break Vercel Sandbox’s isolation. A security exercise shipped as a launch, with a public scoreboard. It closed September 1, triage runs to October 1, and the program page promises a published report of attack techniques. A bounty is only proof if the results come out. Check Vercel’s blog and the HackerOne page by mid-October. Report published: the campaign is complete. Nothing: they marketed the wager, not the result.
2. Does Copilot’s prepaid switch produce a bill-shock story? From October 1, every Copilot Business and Enterprise seat is charged up front (opens in a new tab), as the promotional credits that hid the meter run out. It’s the cleanest live test of whether a metered AI price was explained honestly before it started charging. Watch for one public “our Copilot bill tripled” post by the end of October. One story kills the “priced honestly” reading. A quiet month confirms it.
3. Do AI Mode’s citations come back? Google’s AI Mode stopped showing citations (opens in a new tab) after Gemini 3.8 Flash rolled in. Google’s Search VP says a fix is coming. Every AI-visibility playbook assumes citations exist to be counted. Check AI Mode on a few top-of-funnel queries on September 30. Restored: carry on. Not restored: add one caveat to every monthly AI-presence check, the meter can go dark.