The Agent-Ready Web · a 0→1 field guide · 2026-09-03

Your site has two readers now. One of them writes code.

In 2026 Vercel, Cloudflare, and Oraall shipped a 0–100 score for how ready your site is for AI agents. They measure different things and disagree on what matters. This is the map — every grader's categories in one table — and the 0→1 playbook to take a site from human-only to agent-native.

for CTOs & AI builders5 graders compared6 unified categoriesL0→L5 maturity ladder

Building with an agent? Point it here.

This page is itself agent-native — request it with Accept: text/markdown and it serves a clean, executable checklist. In Claude Code, Codex, Hermes, or Antigravity, paste:

Read https://autopilotindex.com/guides/agent-ready-web and make my
site agent-ready — apply the 0→1 playbook, tier by tier, and open a PR.

Or automate the whole loop with loop2agentic.

The shift

The web was built for eyes. Agents read differently.

A human forgives a slow, JavaScript-heavy, click-to-reveal site. An agent arrives with a task, reads your raw HTTP response as data, and decides in one pass whether it can use you — or move to a competitor it can. The gap between those two readers is now measurable, and most of the web fails it.

Reader 1 · Human

Eyes, patience, a browser

Tolerates JS-only content
Reads visual hierarchy
Navigates by exploring
Forgives missing structure

Reader 2 · Agent

A task, a token budget, code

Needs server-rendered content
Parses schema, not layout
Navigates by sitemap & llms.txt
Wants to call, not just read

The landscape

Who measures what

Five public graders, three philosophies: behavioral (watch a real agent try a task), protocol (do you speak the emerging standards), and GEO (are you optimized for AI search). They overlap — and disagree.

Grader	Method	Checks	Categories measured	Signature signals	Best for
Vercel is-agentic Ora engine	Static + behavioral agent journey	118	Discovery · Access · Usability · Payments shown Essential / Recommended / Bonus	task-completion journeyprompt-to-fixagent CLI	Next.js / Vercel builders who want behavioral proof
Ora ax Era Labs	Static + behavioral	118	Discovery 20 · Access 30 · Usability 40 · Payments 10 graded A+ to F	reverse-engineered from real agent runs	The raw engine — the hardest, most outcome-driven grader
Cloudflare Agent Readiness	Static / protocol	16	Discoverability · Content · Bot Access Control · Capabilities · Commerce	Web Bot AuthContent SignalsMCP Server CardAPI CatalogAgent SkillsWebMCPx402 · ACP · UCP	Protocol / standards adoption + agentic commerce; enterprise
Glippy glippy.dev	Static + LLM	240+	16 GEO categories · 31 languages	WebMCPAI-search / GEOaccessibility	GEO / AI-search visibility; the most granular checklist
agentchecker.ai L. Wharmby	Behavioral no tokens	—	Where the agent gets stuck · what it costs	agency white-label	Agencies producing client-facing readiness reports
aeojs open source	Static	—	AEO / GEO for AI search engines	open rulesChatGPT · Perplexity · AI Overviews	Open-source teams who want to read the rules directly

Behavioral graders (Ora / Vercel, agentchecker) test outcomes. Cloudflare tests protocol adoption. GEO tools (Glippy, aeojs) test AI-search visibility. A 100 on any one ≠ a 100 on the others.

The map

One taxonomy under all of them

Strip away the branding and every grader tests the same six questions — plus one only a real agent can answer. Fix in this order; each layer assumes the one above.

Access

Can an agent get in and read the raw response?

Crawler reachability, AI-bot rules, no JS-only wall, no login wall, clean redirects, Web Bot Auth.

Discovery

Can it find the map of your site?

robots.txt (+ Content Signals), sitemap.xml, RFC 8288 Link headers, llms.txt with a 'when to use' section.

Identity

Can it tell who you are and trust you?

JSON-LD (Organization + WebSite), real About / Contact / Pricing pages, complete metadata, brand discoverability.

Usability

Can it read you efficiently?

Server-rendered content, markdown content negotiation, agent-friendly 404s, page token budget, accessible structure.

Capabilities

Can it DO something — call you?

Public API + OpenAPI / API Catalog, MCP server + MCP Server Card, Agent Skills, WebMCP, function-calling schemas.

Commerce

Can it transact with you?

Agentic-checkout discovery: x402 payments, OpenAI's ACP, Google's UCP. Only if you sell.

★

Behavioral overlay

Can a real agent actually complete a task on your site?

The outcome test no checklist captures — and the one that matters. A perfect static score with a failed task is still a failure. Validate with a real agent run.

The ladder

From invisible to transactable

Six levels of agent-readiness. Most of the web sits at L0–L1. Being early to L4–L5 is cheap and rare.

Invisible agents can't read you

JS-only shell, blocked crawlers, no sitemap. Your content doesn't exist to an agent.

Readable agents can enter & read

Server-rendered HTML, robots + sitemap, real 404s. The door is open.

Legible agents know who you are

llms.txt, JSON-LD identity, trust pages. An agent can represent and trust you.

Efficient agents read you cheaply

Markdown content negotiation, clean structure, sane token budget. Low friction, low cost.

Callable agents can use you

Public API + OpenAPI + MCP server. You go from a page an agent scrapes to a tool it invokes.

Transactable agents can buy from you

Agentic commerce (x402 / ACP / UCP). An agent completes a purchase without a human in the loop.

The playbook

0→1, in five tiers

Ordered by impact-per-hour. Tiers 1–3 are an afternoon each and get you to “strong.” Tier 4 is the moat. Tier 5 is the frontier — only if you sell.

Access & Discovery

~ an afternoon · highest impact/hour

Serve real content without JavaScript

Server-render (or SSG) the meaningful content so it's in the raw HTML. The single biggest cause of L0.

satisfies Access · all graders

robots.txt + AI-bot rules + Content Signals

Explicitly welcome AI crawlers (ChatGPT-User, ClaudeBot, Google-Extended). Declare usage preferences with Content Signals.

satisfies Access · Discovery — Cloudflare, is-agentic

sitemap.xml + RFC 8288 Link headers

A complete sitemap with lastmod. Add Link headers pointing to canonical and alternates.

satisfies Discovery — Cloudflare, is-agentic, aeojs

llms.txt with a 'when to use this' section

The underrated one. Tell agents your best-fit use cases and key URLs in plain markdown at /llms.txt.

satisfies Discovery — is-agentic, Cloudflare, Glippy

Real HTTP 404s with recovery links

Never return 200 with your app shell for missing paths — it tells agents every URL exists. Add a short body linking to the sitemap.

satisfies Usability — is-agentic (Essential)

Identity & Trust

~ an afternoon

JSON-LD: Organization + WebSite

Machine-readable identity on the homepage — name, url, description, contactPoint, isAccessibleForFree. Agents parse this, not your hero copy.

satisfies Identity — is-agentic, Cloudflare, Glippy, aeojs

Real About / Contact / Pricing pages

Agents check these to decide you're legitimate before recommending you. 500+ chars each; a real pricing answer (even 'free').

satisfies Identity — is-agentic (trust anchors)

Complete metadata

canonical, lang, og:image, og:type. Used for entity resolution and attribution.

satisfies Identity — is-agentic, Glippy

Usability

~ half a day · cheap to be early

Markdown content negotiation

Serve text/markdown when an agent sends Accept: text/markdown, with Vary: Accept. Only ~4% of the top web does this — cheap differentiation.

satisfies Usability — Cloudflare (Content), is-agentic, Glippy

Keep pages within an agent token budget

Split oversized pages so extracted text fits a context window (~25K tokens). Agents read the text, not the raw HTML.

satisfies Usability — is-agentic

Accessible, semantic structure

One H1, sequential headings, landmarks, accessible names on controls, no div-soup. Good a11y is good agent-readiness.

satisfies Usability — is-agentic, Glippy

Capabilities — the moat

~ 1–2 days · where you win

A public, read-only API + OpenAPI spec

If your product is data (a catalog, index, docs), expose it as JSON with an OpenAPI 3.1 spec at /openapi.json — operationIds enable function-calling. Generates the API Catalog.

satisfies Capabilities — Cloudflare, is-agentic (dev tier)

An MCP server + MCP Server Card

Expose read-only tools over Model Context Protocol so agents call you natively. Publish an MCP Server Card for discovery. Fewer than 15 sites globally have one.

satisfies Capabilities — Cloudflare, is-agentic

Agent Skills / WebMCP (optional)

Publish a Skills index or WebMCP tools for in-page agent actions. Emerging, but early.

satisfies Capabilities — Cloudflare, Glippy

Commerce — the frontier

a project · only if you sell

Agentic-checkout discovery

Publish discovery files for agent payments: an x402 endpoint, OpenAI's Agentic Commerce Protocol (ACP), Google's Universal Commerce Protocol (UCP). Lets an agent buy without a human.

satisfies Commerce — Cloudflare, Ora (Payments)

The aha

Most of the web is stuck at L0–L1. The bar is on the floor, so the returns on getting to L2–L3 are enormous and the work is a couple of afternoons.
Readability is table stakes; being callable is the moat. Anyone can add a sitemap. An API + MCP server changes your relationship with an agent from “scraped” to “invoked” — and almost no one has done it.
A 100 on any single grader is not success. Scores fragment and each vendor is biased toward its own standards. Normalize across graders, then validate a real agent can complete a real task.
Being early is cheap and compounding. Agents are becoming real traffic. The site an agent can use gets chosen over the ten that merely scored 100 on readability.

~4%

of the top 200k domains support markdown content negotiation

<15

sites globally publish an MCP Server Card

infra giants (Vercel + Cloudflare) now score this — it's not a fad

Reference

The standards, decoded

llms.txt

A markdown file at /llms.txt telling agents what your site is and when to use it.

Content Signals

Directives in robots.txt declaring how AI may use your content (search / train / etc.).

Web Bot Auth

Cryptographic signatures that let good agents prove identity so you can allow them.

RFC 8288 Link headers

HTTP Link headers exposing canonical/alternate relationships to non-HTML clients.

JSON-LD

Schema.org structured data an agent parses for your identity and offers.

MCP + Server Card

Model Context Protocol server exposing tools agents call natively; the Card advertises it.

OpenAPI / API Catalog

A machine-readable API spec (operationIds) enabling agent function-calling.

Agent Skills

A published index of discrete actions an agent can perform on your site.

WebMCP

In-page MCP tools letting an agent act within the browser context.

x402

An HTTP-native payment endpoint standard for machine-to-machine payments.

ACP (OpenAI)

Agentic Commerce Protocol — discovery + checkout for agent purchases.

UCP (Google)

Universal Commerce Protocol — Google's agentic-commerce profile.

Automate this whole loop: loop2agentic scans every grader and applies the fixers. The Autopilot Index tracks companies run by AI — and the stack behind them.

Read Autopilot Pulse →