What Is Cloudflare's Agent Readiness Score — The 21 Checks Your Site Needs for the Agentic Web
Introduction
Paste a URL, hit "Scan," and get a score for how ready your site is to be read by AI agents. That is exactly what Cloudflare's isitagentready.com — officially the Agent Readiness Score — does.
The simplest way to grasp it: this is "Lighthouse for AI agents." Where Google's Lighthouse auto-scores page quality for human browsers (load speed, accessibility), the Agent Readiness Score auto-scores site quality for AI agents. Same idea — the audience just shifts from "the human's browser" to "the AI agent."
This is more than a marketing gimmick. As AI agents move beyond reading the web to operating and transacting on it, the score works as a mirror of where the industry stands: a single view of the emerging standards a website is now expected to support.
This is part one of a two-part series. Here we cover what the Agent Readiness Score is, what it checks, and what Cloudflare is really after — from both an engineering and a strategic angle. In part two, we will run the scanner against ZenChAIne's own site, zench-aine.io, and fix each failing check one by one.
Key takeaways
- The Agent Readiness Score is a free tool Cloudflare launched at "Agents Week" in April 2026 to rate a site's AI-agent readiness across 21 checks in 5 categories.
- It bundles standards that mostly emerged in 2025–2026 — robots.txt, llms.txt, MCP, Web Bot Auth, agentic commerce — into a single diagnostic.
- It is free, but also a natural funnel toward Cloudflare's own agent products such as AI Crawl Control.
What Is the Agent Readiness Score?
The Agent Readiness Score is a free Cloudflare tool that scans a website URL, checks its support for AI-agent standards, and grades it on a 0–5 level. As framed in the intro — "Lighthouse for AI agents" — it measures quality not for humans, but for the agents reading your site.
It was built by Cloudflare, Inc. and announced in the official blog post "Introducing the Agent Readiness score" (April 17, 2026), implemented by Lisbon-based engineer André Jesus and colleagues. The domain registrar, nameservers, and hosting are all Cloudflare — this is an unambiguous first-party product, later folded into the URL Scanner in the Cloudflare dashboard.
The results show each of the five categories as a "passed / total" gauge, and every failing check comes with an AI-generated "How to implement" remediation snippet. That snippet is designed to be copied straight into a coding agent like Cursor or Claude Code — so the tool doesn't just diagnose, it carries you through to the fix.
Why Is "Agent Readiness" a Question Now?
Because the relationship between AI agents and the web is shifting from passively reading to actively operating and transacting. Traditional websites are built for human browsers and search engines, not for autonomous agents.
An agent needs different things than a human does: can it discover the site in a machine-readable way, fetch the content as structured data rather than verbose HTML, tell which bots may access what, and — when needed — authenticate and pay on its own?
A wave of new standards arrived in 2025–2026 to meet these needs: Markdown content negotiation, robots.txt rules for AI crawlers, Web Bot Auth for cryptographically verifying a bot's identity, and protocols for agent-to-agent interaction and agentic payments. They are numerous and still maturing, which makes it genuinely hard for a site owner to know where they stand.
The point of the Agent Readiness Score is to turn that vague anxiety into a measurable score and a concrete list of gaps — to "turn a gut feeling into an actual score," as Cloudflare's own blog puts it.
What Does It Actually Check? 21 Checks, 5 Categories
The Agent Readiness Score runs 21 standards across 5 categories (as stated in the tool's own /llms.txt). The categories and representative checks are:
| Category | What it looks at | Representative checks |
|---|---|---|
| Discoverability | Can agents find the site and its APIs? | robots.txt, sitemap.xml, Link headers, DNS-based agent discovery |
| Content Accessibility | Can the content be fetched in a machine-friendly form? | llms.txt, Markdown content negotiation |
| Bot Access Control | Can you declare which bots get what? | AI bot rules in robots.txt, Content Signals, Web Bot Auth |
| Protocol Discovery | Are auth and tooling endpoints exposed? | MCP server card, OAuth, API catalog, Agent Skills |
| Commerce | Is the site ready for agent-driven purchases? | x402, ACP, UCP, MPP payment protocols |
Crucially, not all 21 checks apply to every site. The categories have different audiences:
- Protocol Discovery (MCP, OAuth, API catalog) is for sites that expose APIs, tools, or services to agents — SaaS, APIs, web apps that agents operate. A content or corporate site that simply serves articles generally does not need these.
- Commerce (x402, ACP, UCP, MPP) is, as the name says, for e-commerce sites. On a site with nothing to sell, these are scored as "Not applicable" and treated as neutral.
So for a content-centric site, the sensible focus is Discoverability, Content Accessibility, and Bot Access Control — there's no need to force-fill Protocol Discovery or Commerce. Telling which checks actually apply to your site is the real skill, and we demonstrate it concretely against zench-aine.io in part two.
A few notes on the standards themselves. llms.txt is a Markdown "table of contents" placed at the site root, condensing the key pages to compensate for the fact that an LLM cannot ingest a whole site (proposed by fast.ai's Jeremy Howard). MCP (Model Context Protocol) is an Anthropic-originated open standard connecting AI clients to external tools and data — often called "USB-C for AI." Web Bot Auth lets a bot sign its requests with a private key so a site can verify the bot's identity without a central authority; Cloudflare is driving its standardization at the IETF.
Notably, isitagentready.com implements all of these standards itself. Hit /.well-known/mcp/server-card.json or /.well-known/api-catalog and you get a valid response. The tool doubles as its own worked example.
How Should We Read Cloudflare's Intent?
Here is the analytical core: free as it is, the Agent Readiness Score is tightly coupled to Cloudflare's business. Many of the failing checks it surfaces — especially the "Bot Access Control" category — connect directly to Cloudflare's paid and semi-paid products.
AI bot access control, for instance, maps onto Cloudflare's AI Crawl Control product, which lets a site owner monitor AI crawlers and even configure Pay Per Crawl (charging per crawl to monetize access). A score that says "your site has no bot control" is, in effect, a proof of that product's necessity.
In other words, the Agent Readiness Score is a device for positioning Cloudflare as the party that defines and judges agent readiness. Define the standards, give away the diagnostic for free, and offer your own infrastructure as the place to fix things — the same three-step play Cloudflare ran with CDN and security. That is not a criticism; it is well-designed business strategy.
There are two takeaways for site owners. First, most of the standards here are vendor-neutral open standards (robots.txt, llms.txt, MCP, OAuth), so you can adopt them today even without Cloudflare. Second, they are closer to "no-regret hygiene" — and they also affect how likely AI search (ChatGPT, Gemini answers) is to cite your content. Rather than chasing the score itself, the pragmatic move is to start with the checks that actually matter for you — which we will demonstrate concretely against zench-aine.io in part two.
FAQ
Q. Who built the Agent Readiness Score?
A. Cloudflare, Inc. — it is an official, first-party free tool. It was announced at "Agents Week" in April 2026, with the domain, hosting, and implementation all belonging to Cloudflare. It is not a third-party or unofficial tool.
Q. If my score is low, does something break right away?
A. No immediate outage. But a low score means AI agents and AI search engines may struggle to properly discover, fetch, or cite your site. Treat it as hygiene that compounds over time, not a "fix-it-now-or-it-crashes" issue.
Q. Can I adopt these standards without Cloudflare?
A. Yes. Most checked items — robots.txt, llms.txt, MCP, OAuth — are open standards you can implement on any server or CDN. Cloudflare features make some of them easier, but none are required.
Q. Where should I start?
A. Tidying up robots.txt is the easiest first step, with the most visible payoff. From there, add a sitemap and llms.txt, then AI-bot rules. Work through the highest-priority items for your own site, step by step.
Conclusion
The Agent Readiness Score distills the standards a website now needs for the agentic web into a clear 21-check, 5-category score. It spans everything from long-standing standards like robots.txt to brand-new ones like MCP, Web Bot Auth, and agentic commerce — and it hands you remediation steps too.
At the same time, it is a strategically well-built device for Cloudflare to occupy the "judge of agent readiness" position and funnel users toward its products. That is exactly why the right stance is not to take the score at face value, but to identify and adopt the checks that matter for you.
In part two, we will scan ZenChAIne's zench-aine.io for real and fix each failing check one at a time — testing agentic-web readiness hands-on against our own site. At ZenChAIne, we cover the latest in AI and agents alongside the hands-on feel of actually implementing them.