Cloudflare now ships a free public tool that scores any site 0–100 on whether AI agents can use it: the Agent Readiness Score, live at isitagentready.com. If you’ve seen the score referenced and want to know what it’s actually measuring — and where it stops — here’s the breakdown.

What Cloudflare’s Agent Readiness Score checks

Cloudflare announced the score on April 17, 2026, and folded it into the Cloudflare dashboard’s URL Scanner as its own tab on May 12, 2026. Enter a URL and it runs roughly sixteen checks across five categories:

  • Discoverability — robots.txt, sitemap.xml, RFC 8288 Link headers
  • Content — whether the page negotiates Markdown content (serving text/markdown on an Accept: text/markdown request) instead of forcing an agent to parse rendered HTML
  • Bot Access Control — AI-specific robots rules, Cloudflare’s own Content Signals, Web Bot Auth signatures
  • Capabilities — an API catalog, OAuth/OIDC discovery, an MCP Server Card, an Agent Skills index, WebMCP tools
  • Commerce (optional) — presence of agentic-checkout discovery files: an x402 payment endpoint, Google’s Universal Commerce Protocol profile at /.well-known/ucp, and OpenAI’s Agentic Commerce Protocol discovery document at /.well-known/acp.json

The Commerce category only counts toward the score if the scanner detects e-commerce signals on the site at all; otherwise it’s shown for information only and excluded, since a SaaS marketing page has no reason to expose a checkout protocol.

The gap: it checks that a file exists, not that checkout works

The Commerce checks are discovery checks. They look for a ucp.json or acp.json file at a well-known path and confirm it’s there and well-formed — the same pattern as the other sixteen checks, which look for a header, a robots directive, or a manifest. None of them drive an actual agent through a purchase: adding an item, authenticating, and completing checkout the way a real shopping agent (ChatGPT’s Instant Checkout, Gemini’s Universal Cart) would. A merchant can publish a syntactically valid ACP discovery document and still fail the moment an agent tries to actually buy — broken cart state, a login wall the agent can’t clear, a payment step that times out. That’s the layer Cloudflare’s scanner doesn’t reach, and it’s the specific gap covered by our two-rails breakdown of ACP and UCP and by AgentReady’s own scan, which tests the transaction, not just its discovery footprint.

The adoption numbers are the real headline

Cloudflare ran the scanner against its Radar dataset of the top 200,000 domains (filtered to businesses, publishers and platforms) and published the results on Cloudflare Radar’s AI Insights page. The results: only about 4% of sites had declared any AI-usage preference at all, only 3.9% supported Markdown content negotiation, and an MCP Server Card — the file describing what tools a site’s MCP server exposes — appeared on fewer than fifteen sites globally. Cloudflare also reported that an agent hitting its own, self-optimized documentation used 31% fewer tokens and answered 66% faster than against a non-optimized baseline, as one concrete illustration of what passing these checks is worth.

Those numbers describe the baseline access layer most sites haven’t touched yet — before commerce even enters the picture. If well under 5% of the web reliably tells an agent what it’s allowed to do, the number that has actually built and tested an agent-completable checkout flow is smaller still.

What this means for merchants

Run your own domain through isitagentready.com — it’s free, and it’s a legitimate first pass at the access and discovery layer: robots.txt, Markdown negotiation, Web Bot Auth, whether you expose an MCP Server Card. Treat a high score there as a floor, not a finish line. It tells you an agent can find and parse your site; it does not tell you an agent can put something in a cart and pay for it. That second question — can an agent actually complete a purchase on your store — is a different test, and it’s the one that determines whether agentic commerce turns into revenue.

Sources

Discovery checks are table stakes; AgentReady audits whether an agent can actually finish the purchase.