Who can assess a store for AI agent readiness? Your options
Three ways to assess a store for AI agent readiness: Cloudflare's score, Lighthouse's pass ratio, or a checkout-aware audit. What each one measures.
Research
Short, sourced notes on how AI agents find, understand and buy — checkout protocols, crawler rules, and the moves that keep a store agent-ready. We don't audit discovery, we audit the transaction.
Three ways to assess a store for AI agent readiness: Cloudflare's score, Lighthouse's pass ratio, or a checkout-aware audit. What each one measures.
Machine-readable product data is price, currency, availability and identifiers in structured markup; here is what Google requires and recommends.
What an AI agent actually requests from a Shopify store, per Shopify's UCP developer docs: catalog, cart and checkout calls, and who controls each.
Five checks you can run yourself, in about fifteen minutes, to see whether an AI shopping agent can find, understand and reach checkout on your store.
H.R. 9915 would let the FTC fine bots up to $53,000 per violation for hiding their identity, so an honest user-agent could become a legal matter.
Shopify's WebMCP checkout tools let browser agents read, update and submit eligible checkouts after buyer confirmation, with no merchant setup.
A new preprint proposes terms.txt, a robots.txt-style file with per-purpose prices and signed receipts for AI agents. It has no adopters yet.
Pre-registered study on our own corpus: how often agents ask about, read and send humans to a store, by score band, published live from the database.
WebKit's Safari MCP server lets any MCP agent navigate, click, type and screenshot a live Safari window, so agents can now walk a store's checkout.
Shopify's Google AI Mode and Gemini direct checkout is active by default for eligible stores, and Google Analytics cannot record any of it.
Akamai data shows ecommerce sites get 44.8% of all AI-bot POST requests, the request type used for logins, cart adds and checkout submits.
UCP Checker's 0-100 score weighs manifest validity and discovery signals, and by default never tests whether an agent can actually check out.
Amazon blocked Meta's Muse AI agent by contract on Sept. 20; Shopify wired Muse into Shop Pay checkout for every store via UCP the same week.
Adobe Analytics data shows AI-referral traffic growth to US retail sites slowed from +138% to +62% year over year while conversion rates kept rising.
Anthropic's Claude Commerce Agent now has a WooCommerce port that talks to the store's own Store API instead of UCP, per a fetched GitHub repo.
Google's own JavaScript SEO documentation confirms not all crawlers run JavaScript, which is why product pages need server-rendered HTML.
A W3C/GS1 workshop in Zurich found AI shopping agents can complete checkout yet still buy the wrong physical product without a GTIN.
AEO targets AI-answer citations, GEO is the 2023 research paper that coined a visibility-optimization framework, and AOO audits whether an agent can buy.
The IETF's Web Bot Auth working group formally adopted its core signing spec on September 1, 2026, but it is still pre-RFC.
Visa's published Trusted Agent Protocol spec defines three cryptographic signatures merchants check before trusting an AI shopping agent.
The full Ninth Circuit declined to rehear the AI shopping agent CFAA ruling. What is now settled, what still isn't, and why September 15 makes it urgent.
Meta's Muse agent buys through a cloud browser with a single-use Link card, no user agent to identify it, and no JavaScript execution on pages.
Visa announced Agent Score in June 2026 to grade merchant sites for agentic commerce readiness, with no public tool, pricing, or method yet.
Meta's Muse checks out with Stripe's Link and a one-time virtual card, browsing to your site directly when no merchant integration exists.
ACP and UCP checkout schemas both define explicit error and warning codes for stale price and stock data, making real-time accuracy a protocol requirement.
Anthropic reference code for a Claude shopping agent expects a full-text policy search method, not a fixed return-and-warranty snapshot like UCP ships.
The eight product-data fields AgentReady's audit checks, and why a shopping agent fails to buy when any one of them is missing.
Pre-registered study: every Cloudflare-fronted store in our corpus is rescanned after the September 15 AI-traffic defaults, access-pillar deltas published live.
Agentic commerce lets AI agents like ChatGPT and Gemini discover, cart and pay on a merchant's behalf, using protocols including MCP, ACP, UCP and AP2.
UCP's August 2026 update adds a policies snapshot to Cart, Checkout, Catalog and Order, but its schema names only return and warranty terms, not shipping.
Shopify staff confirmed on its developer forum that legacy Storefront MCP cart tools are being removed at the August 31, 2026 deadline.
Vercel and Ora's free Is Agentic scanner scores payments as 10 of 100 points on the underlying Ora ranker, and only as a bonus tier on its own site.
A dataset of 1,033 traced AI agent runs shows llms.txt doesn't change whether a page can be fetched, but it does change what agents do next.
AWS Bedrock AgentCore Payments reached general availability on August 18, 2026, letting AI agents autonomously pay merchants via x402 and MPP.
Amazon petitioned the full Ninth Circuit to rehear the ruling favoring Perplexity. On September 10, 2026 the court declined, and the panel ruling stands.
Cloudflare's Web Bot Auth verifier still rejects the dictionary-form Signature-Agent header the newest draft requires. What to send so a signed crawler gets in.
OpenAI's Agentic Commerce Protocol, now co-maintained with Stripe and Meta, defines four surfaces a merchant implements to sell inside ChatGPT.
An AI agent that reaches your product page still fails to buy at one of several concrete, checkable points in a store's checkout path.
Shopify sunsets its Storefront MCP cart tools on August 31, 2026. What moves to UCP, what has no successor yet, and what to check before agents lose your cart.
EU AI Act Article 50 has required AI chatbots and shopping assistants to disclose they are AI since August 2, 2026, unaffected by the Omnibus deferral.
The agent brief packages a store's whole agent-readiness fix job — plan, code, verification — as one markdown file you can hand to Claude Code or Cursor.
Stripe now issues single-use virtual cards for AI agents that self-cancel after one purchase, and most checkouts are not built to accept them cleanly.
Cloudflare's September 15 AI defaults, corrected September 16 from its own notice: Agent blocked on ad pages, Block AI Bots migrated, no Googlebot trap.
We audited the first 10,000 ERC-8004 agents: 72 carry real metadata, and the reputation layer meant to tell a buyer whom to trust is mostly one liveness bot.
PayPal's Agent Ready lets Braintree merchants accept ChatGPT and Google AI Mode purchases via ACP and UCP, PayPal's own docs confirm.
The llms.txt spec shipped a v2 revision on August 10, 2026 adding link relations for discovery; here is what an online store's file should contain.
The Agent2Agent protocol requires servers to publish a JSON Agent Card at /.well-known/agent-card.json describing their identity, skills and endpoints.
Google Assistant is being discontinued on Android starting September 4, 2026, with Gemini as the sole, non-reversible replacement.
A user-directed AI shopping agent does not violate the CFAA, the Ninth Circuit ruled. What merchants can still block, what they no longer can, what to change.
Cloudflare's Agents docs added native support for MPP, an HTTP 402 payment protocol from Stripe and Tempo that also works over MCP.
France's competition authority projects AI agents will carry 20-25% of e-commerce traffic by 2030 and names missing standardised data as the barrier.
Cloudflare's AEO Visibility Dashboard says whether assistants cite your brand, not whether an agent can buy from you. What each number means for a store.
The Product and Offer fields an AI shopping agent needs to identify an item, resolve a variant and complete a purchase, per schema.org 30.0.
A 6.77M-session study finds ChatGPT drives 92.4% of standalone-LLM referral traffic, and ecommerce referral traffic rose roughly 37x.
The exact GPTBot user-agent string, how it differs from OAI-SearchBot and ChatGPT-User, and why real verification means OpenAI's published IP ranges.
The mechanics — ChatGPT cites what Bing ranks, name confusion hijacks answers, and "visible" isn't "buyable". A merchant's checklist, from our own data.
Merchant Center's new AI Performance Insights report shows share of voice and attribute gaps in AI Mode, AI Overviews and Gemini.
We audited 27 DTC supplement stores for agent-buyability. Median 56/100, a sharply bimodal split — and the biggest brands scored worst. The full data.
Most agent-readiness tools score whether an AI can READ your site — not whether an agent can BUY from it. Where the two audits diverge on real stores.
Akamai finds MCP's new stateless spec can let predictable session IDs expose one shopper's cart or order data to another agent.
Akamai found AI bots made up 47.9% of commerce traffic in December 2025, with 90% of that activity merely monitored, not blocked.
Anthropic's Claude Code desktop browser can browse, click, and fill carts on any site, but by design won't purchase, sign up, or bypass CAPTCHAs.
Google told a merchant that Cloudflare Content-Signal robots.txt tags have no effect on any AI crawler, unlike enforced bot-blocking rules.
The x402 Foundation went operational on July 14, 2026, with Visa, Stripe, Shopify and dozens of others standardizing AI agent payments.
OpenAI, Anthropic, Perplexity, Google, Meta and Apple each publish distinct AI-crawler user-agent tokens for robots.txt, listed here with sources.
The EU's July 2026 DMA ruling requires Google to let rival AI assistants order and act inside Android apps starting mid-2027.
Amazon v. Perplexity asked whether merchants can block AI shopping agents by policy alone. The Ninth Circuit said no on the CFAA, and refused to rehear it.
Lighthouse 13.3 shipped a default-on Agentic Browsing score checking llms.txt, WebMCP and accessibility, scored as a pass ratio, not 0-100.
A canonical tag that points at a URL which itself redirects sends a broken signal to Google, and AI Overviews inherit the same blind spot.
Search Console's new Search generative AI control lets sites exclude their pages from AI Overviews and AI Mode, but not from the Gemini app.
Compression APIs like agentready.cloud shrink prompts 40-60% for agent builders. That saves the agent money — it does nothing to make your store buyable.
Two scanners scored one Shopify store 96/100 and 41/100 on the same day. Neither is wrong — they measure different layers. How to read both scores.
ChatGPT search runs on Bing's index, so a store that Bing hasn't indexed stays invisible to ChatGPT even if it ranks well on Google.
A buyer asked ChatGPT about agentready.market and got an unrelated product's price. What failed in the entity layer, and the fixes we shipped.
Microsoft Clarity's free Violations card shows what share of AI bot traffic to a site is requesting URLs its robots.txt disallows.
Cloudflare's free Agent Readiness Score checks for a commerce discovery file, but never attempts an actual agent-driven purchase.
Google's new Google-Agent fetcher is documented to ignore robots.txt by design, so merchants need IP blocking or auth instead.
Microsoft Clarity Citations, live since May 2026, is a free dashboard showing which pages get cited by Copilot and Bing AI answers.
Chrome 149's WebMCP origin trial lets sites like Shopify and Etsy register a checkout tool agents can call instead of scraping the page.
Google, Microsoft and nine others shipped Agentic Resource Discovery: one public ai-catalog.json tells agents what you sell. Almost no store has one yet.
Web Bot Auth lets an AI agent cryptographically sign its requests — and Visa, Mastercard and Amex are building agentic-checkout authentication on top of it.
The Model Context Protocol ships its largest-ever spec revision on July 28, 2026, and Shopify merchants already run an MCP server whether they know it or not.
ChatGPT and Google now complete purchases inside the assistant. They run on two different, non-interoperable protocols — ACP and UCP.
If you're checking Google Analytics for ChatGPT or Perplexity traffic, you won't find it — GA is structurally blind to AI agents.
What changed in the protocols — and what it means for your store. Connect it to your agent and it pulls the latest itself; no inbox required.
Add it to your agent (Claude Code, Claude Desktop, Cursor — anything that speaks MCP):
{
"mcpServers": {
"agentready-brief": {
"type": "http",
"url": "https://www.agentready.market/mcp/docs"
}
}
}
Then ask it for the AgentReady brief —
it calls get_agentready_brief and reads any entry in full. Prefer a feed
reader? Subscribe by RSS.
Email delivery isn't live yet — nothing will land in your inbox until it is. Leave your address and you'll be on the first issue when it ships.