What happened

On 17 April 2026, during Agents Week, Cloudflare launched the Agent Readiness score and put up a free checker anyone can use: isitagentready.com (read the domain carefully — two similarly named third-party tools exist and have nothing to do with Cloudflare). Enter a domain and it sends real requests to the site to see which agent-related standards it supports, then scores it across the four dimensions listed in the official announcement:

  • Discoverability: robots.txt, sitemap.xml, Link headers (RFC 8288)
  • Content: whether content negotiation can hand an agent a Markdown version of the page
  • Bot Access Control: Content Signals, AI bot rules in robots.txt, Web Bot Auth
  • Capabilities: Agent Skills, API Catalog (RFC 9727), OAuth server discovery, MCP Server Card, WebMCP

A fifth group covers commerce protocols (x402, UCP, ACP); Cloudflare marks it as excluded from the score, so non-commerce sites can skip it.

The dashboard changed the same day: the old robots.txt tab was renamed Directives and now links to the score, and Content Format Insights went live so you can see which content formats AI systems actually request versus what your server hands back. Cloudflare Radar started tracking adoption of these standards across the web.

Read that checklist once and one thing stands out: not a single item looks at what you wrote. Every check asks whether your server exposes some endpoint, header, or declaration file.

Why it matters to you

Start with how much damage a bad score does today: very little. There is no evidence that any AI engine uses it as a citation or ranking input — it is an infrastructure provider’s self-assessment checklist, not a search engine’s grade. A low score will not make you disappear from answers tomorrow.

The weight sits elsewhere: the party doing the grading has changed. Deciding whether you were “ready” used to belong to search engines, judging content and links. Now the layer sitting between you and every one of your visitors is grading too, and it judges protocols. Adoption rates are going up on Radar in public, and numbers like that turn into something an industry compares itself on; your clients, your partners, and any competitor who wants a stick to hit you with can type your domain and read your score.

It also puts a problem into plain words for us. When a brand is missing from AI answers, we have mostly traced it to content — not citable enough, facts inconsistent, authority signals thin. This checklist points at a second kind of absence: the writing is genuinely good, but the agent cannot get a machine-readable version, cannot find a list of what you can do, cannot tell whether your identity is trustworthy — so it routes around you and uses someone else. (Cloudflare’s February move to convert pages to Markdown for AI on the fly sits on the same line; we covered that one.)

Three of the four dimensions ask whether your content can be retrieved. Only Capabilities asks the question one step further out: beyond reading your material, does an agent know which functions on your site it can call directly — check stock, quote a price, submit a booking? What it checks is the declaration: whether you publish a machine-readable list of what you can do (MCP Server Card, Agent Skills, an API catalogue) so the agent does not have to guess. Without that list, an agent’s understanding of you stops at “a document worth quoting” and never reaches “a service worth using”.

Whether your content can be understood and whether machines can connect to it are two separate layers of site health.

Should you act now

Yes — but not by chasing points on this checklist.

What to skip first: do not wrap your company site into an MCP server, or bolt on WebMCP or x402, to satisfy the Capabilities dimension. That is an engineering project, and a better question sits in front of it: does your service have anything worth calling automatically? Wire up a single static brochure page and you have only helped agents discover faster that there is nothing to fetch. The reverse case is just as real: if pricing needs a human and projects need a conversation first, leave the capability list empty — that is a commercial decision, not a lost point. For plenty of businesses, scoring zero here is the correct answer.

The first two dimensions are worth fixing: correct robots.txt and sitemap, Link headers, content that can be served as Markdown. These pay off without waiting for the agentic web to arrive, because today’s AI search crawlers already use them (for where to draw the robots.txt line, configuring the 8 major AI crawlers separately goes into detail). The last two can wait until you genuinely have something callable.

What we are doing about it: geoweb.tw will add a separate Agent Friendliness score alongside the existing 12-dimension GEO health score, measuring reachability at this protocol layer — and deliberately keeping it out of the health total. The reason, plainly: most brands have no business implementing all of these endpoints today, and folding them into the total would hand every client a permanent deduction they can never earn back, which makes the score stop describing real site health. Two numbers reported side by side let you see whether your problem is the content or the plumbing. The first version will be checked against Cloudflare’s list — every endpoint their tool can see, ours has to see too, and the half they do not check (whether your content is citable, whether your facts agree with each other on and off site) was always our own ground.

(Added 30 July 2026: this section originally read “fix the first two, let the last two wait until you have something callable.” Three months later MCP shipped its largest specification revision since launch, writing forms and charts rendered directly inside the conversation into the official documents, with a row of platform giants sharing platinum seats at one foundation — the clock on those last two dimensions started running. The revised call is in MCP’s biggest rewrite yet: this one is no longer “good to know about,” it is act now.)

To see where you stand on both layers, book a demo. We will run a backtest first and show you how the mainstream AI engines describe you right now, and what crawlers actually retrieve from your site. This protocol layer gains another specification every few months; you are welcome to watch it yourself, though it comes with no alarm — when something drops, you usually find out much later.

Further reading: Cloudflare Now Converts Your Pages to Markdown for AI, On the Fly, The Content-Signal Protocol: Separately Configuring search / ai-input / ai-train Permissions in robots.txt