HOW WE SCORE · AGENT FRIENDLINESS
Agent Friendliness
Agent Friendliness is a website standard defined by GeoWeb. It measures how many machine-readable entry points and files a site provides for AI agents, on a 0–100 scale calculated separately from the 12-dimension GEO health score.
This page is the full specification: the 18 checks, what it takes to pass each one, how the score is calculated, and what changed in each revision.
It measures whether AI agents can find a machine-readable way in
AI agents are not search crawlers. A crawler comes to read your content and take it back; an agent comes to get something done for a person, such as looking something up, comparing prices or finding an open appointment slot. The first thing it looks for on your site is a description it can read: an llms.txt that says what the site contains, a robots.txt that states which AI bots may come in, a Markdown version of the page it can fetch directly, and a published list of the services the site offers.
Agent Friendliness measures how much of that is in place. Every check looks at files and settings your site publishes. How well your articles are written is a separate question, and the GEO health score covers it.
Why it is kept out of the GEO total
GEO health measures whether AI can understand your content and is willing to cite it; Agent Friendliness measures whether machines can connect to your site at all. Reported side by side, the two scores tell you whether a problem lies in the content or in the entry points. Even great content can get passed over when an agent can't get a machine-readable version of it.
There is a second reason. Several items on this checklist are things most brands have no reason to build today. Turning a website into an MCP server is an engineering project, and it only makes sense if you offer a service worth having AI call automatically; for a business that quotes case by case after a conversation, leaving that slot empty is a reasonable choice. Agent Friendliness still shows the gap, because what it measures is how many entry points are in place. Counting it in the GEO total, though, would saddle every site that made that choice with a penalty it could never recover, and the total would stop reflecting how healthy a site really is. That is why Agent Friendliness has been reported on its own, outside the GEO total, since the first version.
The 13 scored checks and their weights
Every check reads a public URL or DNS record of your site and tests the response. The 13 weights add up to 100.
| Check | What it takes to pass | Weight |
|---|---|---|
/llms.txt | Returns plain text, not an HTML page, with at least 200 characters after trimming leading and trailing whitespace. Fewer than 200 characters earns 40%. | 13 |
| AI bot rules in robots.txt | robots.txt names at least 3 of GPTBot, ClaudeBot, PerplexityBot and Google-Extended in a User-agent line, whether it allows or blocks them. Names that appear only in comments don't count. Naming 1 or 2 earns 50%. | 11 |
| JSON-LD Action | The JSON-LD on the checked page contains an Action type (such as SearchAction) or an EntryPoint. | 11 |
| MCP Server Card | /.well-known/mcp/server-card.json or /.well-known/mcp.json returns valid JSON. | 10 |
/llms-full.txt | Same conditions as /llms.txt. | 9 |
| API Catalog | /.well-known/api-catalog returns valid JSON (RFC 9727). A file that exists but isn't valid JSON earns 20%; an HTML page counts as no file. | 8 |
| security.txt | /.well-known/security.txt contains both a Contact and an Expires field (RFC 9116). Only one of the two earns 40%; neither, or an HTML page, earns 0. | 8 |
| HTTP Link header | The checked page's response has a Link header with at least one of these rel values (one rel can list several): sitemap, describedby, llms-txt, llms-full-txt, mcp-server, agent-skills or http://www.w3.org/ns/json-ld#context (RFC 8288). A Link header without any of them earns 30%. | 7 |
| Markdown content negotiation | Requesting the homepage with Accept: text/markdown returns a Markdown Content-Type and content that differs from the HTML version. The right Content-Type with the same content as the HTML version earns 40%. | 7 |
| Content-Signal | robots.txt contains a Content-Signal directive (IETF draft draft-canel-robots-content-signal). | 5 |
| DNS-AID | The domain has AI agent discovery records under its _agents subdomain (IETF individual draft draft-mozleywilliams-dnsop-dnsaid). | 5 |
| Agent Skills | /.well-known/agent-skills/index.json is a JSON object whose skills field is a non-empty array. A file that isn't valid JSON earns 20%, valid JSON without a skills array earns 30%, and an HTML page counts as no file. | 4 |
| OAuth discovery | /.well-known/oauth-authorization-server (RFC 8414) or /.well-known/oauth-protected-resource (RFC 9728) returns valid JSON. | 2 |
When JSON-LD Action or DNS-AID is missing, the report marks it as a warning rather than a failure. A page that declares no actions isn't wrong, it just offers one entry point fewer; and the draft behind DNS-AID has not been adopted by an IETF working group, so a missing record means the site hasn't done it yet, not that something is broken.
The 5 advisory checks
These 5 checks run and appear in the report like the others, but they carry a weight of 0 and do not affect the score.
| Check | What it looks at |
|---|---|
| Web Bot Auth key directory | /.well-known/http-message-signatures-directory is a JSON object whose keys field is a non-empty array. An HTML page counts as no file. |
/auth.md | The site root has registration instructions for agents that mention registration, OAuth or credentials. An HTML page doesn't count. |
| A2A Agent Card | /.well-known/agent-card.json (or the older /.well-known/agent.json) has a name and a non-empty skills array. |
| A real 404 for missing pages | A URL that doesn't exist returns 404 or 410. Answering with a success code such as 200 tells machines the page exists (a soft 404) and fails the check, and so does a redirect that ends on the homepage with a 200. |
| Basic trust pages | Counts how many of four page types (about, contact, privacy and terms) the site has: a link from the homepage counts, and so does /about, /contact, /privacy or /terms serving at least 200 characters of content. If the site returns nearly identical content for URLs that don't exist, those four fixed URLs don't count. |
All 5 were added after July 2026. New checks start out advisory: we decide whether to score them, and with what weight, only once enough sites have been checked to show that a check separates good from bad. Almost no site has adopted the first three yet (see where Taiwanese business websites stand, below), so scoring them would only mark every site down. The last two look at how a site actually responds and are the newest, so their weights wait until we have confirmed they separate good from bad. Some, like /auth.md, also involve a business choice about letting agents register accounts on their own, and a site that declines shouldn't lose points for it.
How the score is calculated
Each check first gets an item score from 0 to 100: 100 for a pass, the percentage shown above for a partial match, and 0 otherwise. Each item score counts in proportion to its weight: for a check weighted 13, 13% of its item score goes into the total. The sum, rounded to one decimal place, is the score. A site scores 100 only when all 13 scored checks pass.
The pass, warning and fail labels in the report don't map one-to-one onto points: a file that exists but isn't valid JSON is labeled a fail yet earns 20%, while a missing JSON-LD Action or DNS-AID record is labeled a warning yet earns 0. The percentages in the table above are what count.
The report shows the score rounded to a whole number and labels it from that number: 80 or above is Complete, 50 to 79 is Partial, and 49 or below is Insufficient.
How we check, and what we never do
- We only send ordinary GET requests: a little over 20 to your site per check, plus 7 DNS lookups through Cloudflare's public DNS-over-HTTPS resolver.
- Requests for published files and paths wait up to 8 seconds, follow at most 3 redirects and are not retried; the checked page itself gets up to 30 seconds and 5 redirects.
- We never call your APIs, MCP tools or any other service. When a file declares an endpoint, we check the file's format and do not connect to the endpoint.
- We don't log in or submit forms. Published files are read as the raw response; only the checked page itself is rendered in a browser, and only when it looks like a JavaScript-framework page with little text in its raw HTML, or a plain request gets a 401 or 403.
- If the same site is checked again within 5 minutes, site-wide files such as llms.txt and robots.txt are reused from the previous check. After you change a file, wait 5 minutes before testing again.
- If your site is unreachable during a check, the affected items are treated as missing, which looks the same as a file that isn't there. If a result surprises you, run the check again a little later.
How it relates to Cloudflare's Agent Readiness
On 17 April 2026, Cloudflare launched its Agent Readiness score along with a checker at isitagentready.com. Agent Readiness and Agent Friendliness both measure the entry points a site provides for AI agents. Going by what the checker actually tested in November 2026, robots.txt, the Link header, Markdown content negotiation, Content-Signal, Web Bot Auth, Agent Skills, API Catalog, OAuth discovery, MCP Server Card, A2A Agent Card, /auth.md and DNS-AID are checked on both sides; the last three were not in Cloudflare's original announcement.
Six of our 18 checks are not among Cloudflare's published checks. Four we added ourselves: llms.txt, llms-full.txt, security.txt and JSON-LD Action. The other two look at how a site actually responds, a real 404 for missing pages and basic trust pages, and draw on is-agentic.com, which Vercel built on Ora's scoring engine. In the other direction, three kinds of check are not part of ours for now: WebMCP (finding out which tools it offers means actually running the site's code in a browser), the payment and commerce protocols (their specifications are still moving), and items Cloudflare added later such as the ARD manifest and the Personal Agent Protocol. sitemap.xml is checked under AI Crawler Accessibility & Indexing in the 12 dimensions.
The two scores don't convert into each other. We add up weighted checks, and newly added checks start out advisory, so the same site will score differently on each.
Where Taiwanese business websites stand (November 2026)
On 11 November 2026 we re-checked the homepages of 1,107 Taiwanese websites (.tw domains) that geoweb.tw had checked before, using version 2026-11-11 of this standard. They span more than 50 industries, led by interior design, law firms, cram schools, aesthetic clinics, and building materials and construction. This is not a random sample, so the figures describe this group of business websites, not Taiwan's web as a whole. The list leaves out geoweb.tw's own sites and the client sites we know of. The figures below count only the 1,010 sites whose homepage loaded and which didn't block the check; another 80 sites blocked ordinary check requests, and 17 homepages wouldn't load.
This is how the 1,010 sites scored:
| Score | Sites | Share |
|---|---|---|
| Under 20 | 908 | 89.9% |
| 20 to under 40 | 88 | 8.7% |
| 40 to under 60 | 12 | 1.2% |
| 60 to under 80 | 1 | 0.1% |
| 80 and above | 1 | 0.1% |
The mean is 5.8 and the median is 0; 656 sites (65.0%) score 0. This is how many sites passed each check:
| Check | Sites passing | Share |
|---|---|---|
/llms.txt | 118 | 11.7% |
| AI bot rules in robots.txt | 78 | 7.7% |
| JSON-LD Action | 198 | 19.6% |
| MCP Server Card | 4 | 0.4% |
/llms-full.txt | 22 | 2.2% |
| API Catalog | 5 | 0.5% |
| security.txt | 8 | 0.8% |
| HTTP Link header | 6 | 0.6% |
| Markdown content negotiation | 12 | 1.2% |
| Content-Signal | 47 | 4.7% |
| DNS-AID | 10 | 1.0% |
| Agent Skills | 4 | 0.4% |
| OAuth discovery | 37 | 3.7% |
| Web Bot Auth key directory (advisory) | 0 | 0.0% |
/auth.md (advisory) | 1 | 0.1% |
| A2A Agent Card (advisory) | 0 | 0.0% |
| A real 404 for missing pages (advisory) | 734 | 72.7% |
| Basic trust pages (advisory) | 101 | 10.0% |
65% of the sites score 0, so most of them have not prepared a single entry point for AI agents, and about nine in ten score under 20. The scored check passed most often is JSON-LD Action (19.6%), which a common site-search declaration (SearchAction) satisfies. Only 11.7% of the sites publish an llms.txt, and only 7.7% name AI bots in robots.txt. Checks that only make sense once you have a service to connect to, such as MCP Server Card and API Catalog, are each under 1%.
Citing this standard
If you cite this standard in an article, report or presentation, include the version date, since the checks are revised as the underlying specifications evolve:
GeoWeb (2026). Agent Friendliness, version 2026-11-11. https://geoweb.tw/en/scoring/agent-friendliness
Revision history
- 2026-11-11Standard published, with several checks tightened to match it: an HTML page served as llms.txt, llms-full.txt, security.txt, API Catalog, Agent Skills or the Web Bot Auth key directory counts as no file; a security.txt with neither field earns 0; robots.txt only counts AI bots named in a
User-agentline; Link header rel values are matched one by one, and the JSON-LD context is corrected tohttp://www.w3.org/ns/json-ld#context; on a site that returns the same content for URLs that don't exist, the fixed URLs no longer count as trust pages. The MCP Server Card failure message now correctly refers to two paths. - 2026-08-25Two behavioral checks added, both advisory: a real 404 for missing pages, and basic trust pages.
- 2026-07-30Web Bot Auth key directory,
/auth.mdand A2A Agent Card added, all advisory. MCP Server Card no longer checks/.well-known/agent.json, which is A2A's older path. - 2026-06-10DNS-AID added, bringing the scored checks to 13; weights set to the current values.
- 2026-05-28HTTP Link header, Markdown content negotiation, Content-Signal, Agent Skills and OAuth discovery added, bringing the scored checks to 12.
- 2026-05
/.well-known/ai-plugin.jsonno longer scored (ChatGPT plugins have been retired); its weight moved to/llms.txt,/llms-full.txtand JSON-LD Action. - 2026-04-27First version released: 8 checks, reported on their own and kept out of the GEO total.
How does your site score?
The free audit runs the 12-dimension GEO health check and Agent Friendliness together, with results in about three minutes.