Agent Readiness Scores: What Actually Matters

Your Website Is Being Graded for AI Agents — Here’s What That Actually Means

In April 2026, Cloudflare shipped a tool that changed how the SEO industry talks about AI visibility. It’s called isitagentready.com, and it does something deceptively simple: you type in a URL, and it returns a score from 0 to 100 rating how prepared that website is for AI agents.

The scanner checks 16 signals across 5 categories — from whether your robots.txt allows AI bots, to whether your site supports the Model Context Protocol (MCP), to whether it can handle agent-native payments via the x402 protocol.

The twist: the headline score is structurally misleading. And understanding why is the key to actually preparing your site for the agentic web.

What the Agent Readiness Scanner Actually Checks

The scanner evaluates your site across five categories, each testing a different layer of machine readability.

Discoverability checks whether agents can find your content in the first place. It looks for a valid robots.txt file, a sitemap.xml declaration, and Link response headers (RFC 8288) that point to canonical or alternate resources. These are the basics — if agents cannot discover your pages, nothing else matters.

Content Accessibility has one check: whether your site supports Markdown content negotiation. When the scanner sends an Accept: text/markdown header, does your server return Markdown instead of HTML? This is Cloudflare’s own proposal rather than an IETF standard, though the mechanism — HTTP content negotiation via the Accept header — is standard. Most sites score zero here today.

Bot Access Control examines whether your robots.txt includes directives for AI-specific user agents like GPTBot, ClaudeBot, and PerplexityBot. It also checks for Content Signals directives, an emerging spec for per-URL access rules. A third check — Web Bot Auth, which uses HTTP message signatures for cryptographic agent identity — is informational only and not scored, because adoption is nearly zero outside Cloudflare’s own properties.

Protocol Discovery is the heaviest category with six checks. It looks for machine-readable API catalogs (RFC 9727), OAuth discovery endpoints (RFC 8414), MCP Server Cards (SEP-1649), Agent Skills indexes, and even an experimental WebMCP standard that registers agent-callable tools via in-page JavaScript. This is where most content sites score zero — and where the scoring debate gets heated.

Commerce checks whether your site supports emerging agent commerce protocols: x402 (HTTP 402 Payment Required for agents), UCP (Universal Commerce Protocol from Google), ACP (Agentic Commerce Protocol), and MPP (Merchant Privacy Protocol). These checks only apply to commerce-oriented sites.

Why the Composite Score Is Misleading

Here’s the problem. The default scan preset is “All Checks,” which runs all 16 signals regardless of your site type. A content website that passes every check relevant to its business — valid robots.txt, sitemap, AI bot rules, content signals — might still score 33 out of 100 because it fails the API catalog, MCP, and commerce protocol checks that only make sense for SaaS platforms or ecommerce stores.

The same site, scanned with the “Content Site” preset, scores 67. That is a 34-point gap on the same website, from the same scanner, on the same day.

As Slobodan Manic wrote in Search Engine Journal: “The 33 on nohacks.co is wrong for the kind of website nohacks.co is. The 67 from the Content Site preset is the accurate reading.”

The shareable number — the one that travels on social media and that competitors compare — is the All Checks composite. That makes it a marketing layer, not a diagnostic one. For anyone evaluating their agent readiness, the individual category scores matter far more than the headline number.

The Agent Runtime Is the New Browser Layer

The scanner didn’t arrive in isolation. On April 15, 2026 — two days before the scanner launched — both Cloudflare and OpenAI shipped competing Agents SDKs within hours of each other. No Hacks called it “The Agent Runtime Wars.”

Cloudflare’s Project Think provides durable execution, crash recovery, sub-agents running as isolated children, persistent sessions, and sandboxed code execution. OpenAI matched it with its own Agents SDK featuring native sandbox execution and a model-native harness.

The core insight from that week: the agent runtime is becoming the new browser layer. AI models don’t read your website directly. The runtime fetches your page, parses it, and decides what to execute — including whether to run your JavaScript. The runtime is the gatekeeper.

This means your optimization target is shifting. You are not optimizing for ChatGPT or Claude or Gemini as individual models. You are optimizing for the runtimes that mediate between those models and your website.

What Google Says You Actually Need — And What You Don’t

On May 15, 2026, Google published official guidance on optimizing for generative AI in Search, authored by John Mueller. The guide cuts through much of the noise.

Google’s position is clear: “From Google Search’s perspective, optimizing for generative AI search is optimizing for the search experience, and thus still SEO.”

More importantly, Google explicitly listed what you do not need:

• llms.txt files: You don’t need to create new machine-readable files, AI text files, markup, or Markdown to appear in generative AI search
• Chunking content: There’s no requirement to break your content into tiny pieces for AI to better understand it
• Rewriting for AI systems: You don’t need to write in a specific way just for generative AI search
• Inauthentic mentions: Seeking inauthentic mentions across the web isn’t as helpful as it might seem
• Overfocusing on structured data: Structured data isn’t required for generative AI search, and there’s no special schema.org markup you need to add

Google’s guide also describes how browser agents work: they may access your website by analyzing visual renderings like screenshots, inspecting the DOM structure, and interpreting the accessibility tree. The guide references the Universal Commerce Protocol (UCP) as an emerging protocol and describes AI agents as autonomous systems that can perform tasks on behalf of people, such as booking a reservation or comparing product specifications.

The Practical Playbook: What to Fix First

Based on the scanner categories, Google’s guidance, and current adoption rates, here is a prioritized action plan.

Start with Discoverability (Quick Wins)

Ensure your robots.txt is valid and includes a Sitemap directive. Add AI bot rules for major crawlers — GPTBot, ClaudeBot, PerplexityBot, Google-Extended — with clear Allow or Disallow directives. Add Link response headers pointing to your canonical URL and alternate language versions. These three checks are foundational, take minutes to implement, and apply to every site type.

Implement Content Signals in robots.txt

Content Signals is an emerging spec that lets you declare per-URL access rules for AI agents. Adoption is minimal today, but because it’s a scored signal in the Agent Readiness scanner, early implementation gives you a head start. The format uses Content-signal directives following the User-agent line in robots.txt.

Decide If Protocol Discovery Applies to You

If you run a SaaS product, an API, or a platform with programmatic access, explore the Protocol Discovery checks. Setting up an API catalog at /.well-known/api-catalog (RFC 9727) and OAuth discovery endpoints (RFC 8414) makes your service legible to agents that want to interact with it programmatically. For pure content sites, these checks are irrelevant — use the Content Site preset and ignore them.

Evaluate Commerce Protocols Only If You Sell Products

The x402, UCP, ACP, and MPP protocols are designed for agent-native transactions. If you run an ecommerce store, these are worth monitoring. Google’s UCP profile at /.well-known/ucp is the most likely to see mainstream adoption since it’s backed by Google’s own Merchant Center ecosystem. For everyone else, skip this category entirely.

Focus on Non-Commodity Content

Google’s guide emphasizes creating content that is genuinely useful rather than commodity. Their example: “Why We Waived the Inspection and Saved Money: A Look Inside the Sewer Line” versus a generic “7 Tips for First-Time Homebuyers.” Agents that analyze your content through screenshots and DOM inspection will surface original, experiential content over templated listicles — the same signal that helps in AI Overviews applies to the agentic layer.

What to Watch: The Goodhart Risk

Anytime a single number becomes shareable, it becomes a target. The Agent Readiness Score has three clear Goodhart risks.

First, website owners will optimize for the number rather than for real agent behavior — adding MCP endpoints and API catalogs they don’t actually support functionally, just to check boxes.

Second, consultancies will sell “Agent Readiness Score optimization” as a service, the same way they sold schema markup audits and Core Web Vitals fixes.

Third, emerging standards get accelerated past readiness by becoming scored signals. The llms.txt file, for instance, has no governing body and has competing proposals, yet it’s already influencing how people think about agent readiness.

The antidote: focus on the individual checks that matter for your site type, not the composite score. A content site with solid discoverability, clean AI bot rules, and useful content is agent-ready at 33 on the default preset if those 33 points come from the right categories.

The Bigger Picture: From AI Search to AI Agents

The agent readiness conversation represents a shift in the GEO landscape. In 2025, the question was “how do I get cited by ChatGPT?” In 2026, the question is becoming “how do I make my website legible to autonomous AI agents that browse, compare, transact, and act on users’ behalf?”

Google’s Sundar Pichai described this trajectory on a podcast in April 2026: “A lot of what are just information-seeking queries will be agentic in Search. You’ll be completing tasks. You’ll have many threads running.”

The optimization layer is moving from the content level — where SEO and CRO operate — to the transport and protocol level. That doesn’t mean content quality stops mattering. It means a new layer of machine readability is being stacked on top of it, and the sites that get both right will have the strongest agent visibility.

The practical takeaway: audit your site with the Content Site preset (not the default), fix the discoverability and bot access control checks, monitor emerging protocols for your site type, and keep investing in non-commodity content. The agent readiness score is a useful diagnostic — as long as you read past the headline number.

Apply the score to the surface you control

A protocol check matters only when the site and product support that protocol. Start with the generative engine optimization framework for crawlable evidence and, for an owned catalog, use the Shopify product GEO guide to connect agent-readiness findings to real product fields, variants, policies, and storefront pages.

How FirstShelf can help

Agent readiness for a marketplace seller comes down to the same question the scanner asks at protocol level: can a machine parse what you sell without a human squinting at the page? The free FirstShelf GEO audit answers that for the listing layer — it scores structure quality (headings, fields, and named elements an agent can traverse) and platform fit (whether your listing exposes the attributes each marketplace’s own agent surface reads).

While infrastructure checks like MCP and x402 belong to your platform, listing legibility is fully in your control today. FirstShelf’s rewriting turns prose-buried claims into declared, machine-readable attributes, and the dashboard tracks your scores as agent traffic grows. Before the next wave of shopping agents grades your catalog, run a free audit at firstshelf.ai and see what they’ll find.