As an SEO & GEO expert I offer the agent readiness audit. Can autonomous agents book appointments, configure products, place orders or pay on your website? I check 16 signals in five categories: discoverability, content, bot access control, API/auth/MCP discovery and commerce, covering MCP, WebMCP, x402, ACP, UCP, Web Bot Auth and llms.txt. Delivery: 3 to 4 weeks.
“SEO brings the user. GEO earns the AI citation. Agent readiness lets agents act.”
Agent readiness is the degree to which a website lets autonomous AI agents act on it, not just read it. Classic SEO makes content indexable for search engines, and generative engine optimization (GEO) makes it citable for large language models. Agent readiness adds the action layer: can an agent book an appointment, place an order, authenticate or pay on a user's behalf? In April 2026 Cloudflare launched its public Agent Readiness score, which tests websites for signals such as robots.txt rules, Markdown for agents, Web Bot Auth, MCP Server Cards, OAuth discovery and agentic commerce standards. The underlying protocols include the Model Context Protocol (MCP), WebMCP, x402, the Agentic Commerce Protocol (ACP) and llms.txt. A site that exposes these signals gives agents structured endpoints, signed identity and callable functions instead of forcing them to parse screenshots and simulate clicks.
Agent-driven purchases, B2B research and service automation all depend on these signals. Early adopters can secure a first-wave advantage, much like the SEO pioneers of the 2000s.
robots.txt, sitemap.xml, HTTP Link headers. Can agents find where your functions are exposed at all?
Markdown negotiation, JSON-LD, structured data. Cloudflare measured up to 80 percent fewer tokens than raw HTML in some cases.
Web Bot Auth, Content Signals, AI bot rules (RFC 9309). Access per agent.
MCP, WebMCP, OAuth discovery, x402, ACP. Structured functions instead of click simulation.
The audit follows Cloudflare's scoring logic and adds Schema.org coverage, agenticweb.md, .well-known/mcp.json, A2A discovery and LLMFeed. Each signal gets a score (0-3), an effort rating and a prioritized action.
The base layer. Without it, agents find no structured way in.
Markdown is far cheaper for agents to read than HTML. A typical quick win.
Trusted agents get in, unverified ones are throttled.
Here your site becomes transactional: agents call typed functions instead of scraping.
Stablecoin micropayments and agent checkouts. Optional, but strategic.
Not yet in the Cloudflare score, but in my assessment likely to gain adoption in 2026/2027.
I check not only whether a standard is present, but also implementation quality, version status and fit for your industry. The central standards of 2026:
Open JSON-RPC protocol for tool discovery and tool calls, the de facto standard for agent-tool integration. Adobe Commerce, Shopify and major SaaS platforms offer MCP servers.
Browser-native variant via navigator.modelContext (Chrome 146+). Early figures attributed to Google cite around 89 percent fewer tokens than screenshot-based automation.
HTTP-native stablecoin payments via status 402. Stripe supports x402 for USDC on Base since February 2026. Micropayments for pay-per-read and API calls.
Delegated payments: signed purchase authorizations instead of shared card data. Checkout inside ChatGPT and similar surfaces.
Cryptographic bot verification through signed HTTP requests, a public key directory and an IETF draft. Access rights per agent.
Agent-to-agent protocol for multi-agent workflows, plus the Agent Payments Protocol as an alternative to ACP. Relevant for procurement flows.
Natural-language queries on top of Schema.org data. A bridge between structured data and conversational agents.
A Markdown file listing your most important URLs. Adoption is still low. A quick win, not a cure-all.
Static JSON discovery with Ed25519 signatures. Trust verification without running an active MCP server.
A documented sequence over three to four weeks, ending in a prioritized backlog.
Asset review, Cloudflare score run, competitor snapshot, stakeholder mapping, API inventory, schema coverage.
All 16 signals plus extended standards. MCP/WebMCP feasibility per function, Web Bot Auth prerequisites, OAuth discovery and commerce protocol fit per product area.
Score report, benchmark, investment estimate per action and a 90/180/365-day roadmap with named owners.
Two formats: a technical deep dive for engineering and product, and an executive briefing for CMO and CTO with investment case and competitive risks.
Score, roadmap and investment estimate. Backlog items, not theory.
SEO makes content indexable, GEO makes it citable for language models, and agent readiness makes your functions executable for autonomous agents. It complements SEO and GEO rather than replacing them. A clear line between the three prevents double investment and wrong priorities.
Six clusters with the most immediate impact, each with matching protocols, implementation depth and a business KPI.
Product search, configuration and checkout via ChatGPT, Gemini, Perplexity, Copilot. ACP, x402, UCP, Product schema.
Availability, slot reservation and confirmations in healthcare, travel, beauty and consulting. MCP for the booking API.
Demo requests, pricing configurators, vendor discovery for procurement agents. MCP, OAuth discovery, Schema.org.
Knowledge base access, status queries, self-service without human routing. MCP for support functions.
Micropayments for data APIs, premium content and compute via x402.
Markdown negotiation, llms.txt, AI bot rules, optionally x402 for premium content. Protection against uncontrolled scraping.
Not every industry benefits equally. These six sectors have the greatest potential in 2026, each with its own standards mix.
ACP, UCP, Product schema, stock availability, x402 checkout. Agent shopping in ChatGPT, Gemini and Perplexity as new channels.
MCP for search, availability and booking, ACP for checkout, LodgingBusiness schema, OAuth for loyalty. Booking through conversation.
MCP for trial sign-ups, demo booking and docs access. OAuth discovery, API Catalog, pricing schema.
Booking endpoints with YMYL compliance, MedicalEntity schema, Web Bot Auth, OAuth for patient authentication.
OAuth discovery, delegated authentication, comparison APIs, Web Bot Auth. Regulatory disclaimers inside MCP tools.
Markdown negotiation, llms.txt, x402 for paywall access, AI bot rules. Paid access instead of uncontrolled scraping.
It depends on site complexity (URL volume, functional areas, markets), implementation depth and industry. Terms are set in the scope call; every model includes the 16-point score report.
One brand, one market. 16-signal score plus action plan, ideal as a first reality check.
Up to five brands or markets, plus benchmark and MCP feasibility.
Quarterly re-score, monitoring of standard updates (MCP, x402, IETF drafts) and implementation support.
Common questions about agent readiness, the standards and the audit process.
Agent readiness measures whether autonomous AI agents can act on your website, not just index or cite it. Since April 2026 Cloudflare's public Agent Readiness score checks discoverability, content, bot access control, API/auth/MCP discovery and, optionally, commerce. Early adopters can gain a first-wave advantage in agent-driven purchase flows.
16 signals in five categories: discoverability (robots.txt, sitemap.xml, HTTP Link headers), content (Markdown content negotiation), bot access control (AI bot rules under RFC 9309, Content Signals, Web Bot Auth), API/auth/MCP/skills (API Catalog RFC 9727, OAuth/OIDC discovery, MCP Server Card SEP-1649, Agent Skills index, WebMCP) and commerce (x402, UCP profile, ACP discovery). Plus extended signals: llms.txt, .well-known/mcp.json, A2A and NLWeb.
MCP is an open protocol from Anthropic (2024) that gives agents standardized, JSON-RPC-based access to tools and data. Instead of scraping HTML, an agent calls typed functions such as searchProducts() or bookAppointment(). Adobe released an MCP server for Adobe Commerce in 2026; Shopify and major SaaS platforms offer MCP access too.
WebMCP is a browser-native variant of MCP (Chrome 146+) built on the navigator.modelContext API. Pages expose tools directly, and agents call typed functions instead of analyzing screenshots. Early figures attributed to Google cite around 89 percent fewer tokens than visual automation. It is still experimental, so the audit assesses feasibility.
x402 is Coinbase's open protocol for stablecoin payments over HTTP. The server answers with HTTP 402 and payment instructions; the client signs the payment in a request header. Stripe added x402 support for USDC on Base in February 2026. For agent micropayments (pay-per-read, API calls) it is the emerging standard.
ACP, developed by OpenAI and Stripe, handles secure instant checkouts in AI assistants. Its delegated payment model keeps the card with the merchant; the agent only passes on a signed purchase authorization. For brands it is the lever for being purchasable inside ChatGPT and similar surfaces.
Web Bot Auth is Cloudflare's 2025 mechanism for cryptographic bot identification, now in IETF drafts. A crawler publishes its public key and signs its HTTP requests; the server verifies the identity. Trusted agents get in, unverified ones are throttled.
SEO makes content indexable, GEO makes it citable for LLMs, and agent readiness makes functions executable for agents. SEO and GEO are about visibility, agent readiness is about action. SEO brings the user, GEO earns the AI citation, agent readiness lets agents transact.
Four clusters: agent commerce (search, configuration, checkout via ChatGPT, Gemini or Perplexity), service bookings (healthcare, travel, beauty, consulting), B2B pipeline automation (demo requests, pricing configurators, procurement discovery) and customer service deflection (knowledge base, status queries, self-service).
3 to 4 weeks. Phase 1: inventory and Cloudflare baseline. Phase 2: in-depth check of the 16 signals plus extended standards. Phase 3: roadmap, investment estimate, executive briefing. You get a 16-point score report, technical specifications, a briefing deck and a 90/180/365-day backlog.
Highest leverage: e-commerce (ACP, UCP, x402), travel (MCP booking, ACP), B2B SaaS (MCP for trials and demos), healthcare (booking with YMYL compliance) and financial services (OAuth discovery, delegated authentication). Medium: publishers (llms.txt, Markdown) and local service providers (availability APIs).
It depends on site complexity, implementation depth and industry. Three models: pilot (one brand, one market), standard (multi-brand or multi-market with MCP feasibility study) and a continuous retainer (quarterly re-score plus implementation support). Terms are set in the scope call.
A 30-minute scope call: audit model, signals checked, industry specifics and a realistic time and budget frame.