AEO AI Marketing SEO 25 April 2026 · 14 min read

Cloudflare's Agent Readiness Score: What It Means, and What Happened When We Scored Our Own Site

Jeremy Parker Founder & Growth Marketing Specialist

The Cloudflare Agent Readiness Score is a free tool, launched on 17 April 2026, that scans your website and rates how well it supports AI agents. It checks thirteen emerging standards across four categories (Discoverability, Content, Bot Access Control, and Capabilities) and gives you a score out of 100 plus a level label from "Not Ready" through to "Fully Agent-Ready".

You can run it on your own site at isitagentready.com. The check takes about ten seconds.

We ran it on Tyneside Marketing on 24 April 2026. We scored 33 out of 100. Twenty-four hours later, after fixing two of the most-impactful gaps, we hit 50.

50/100 sounds like a half-finished result but is in fact the de facto perfect score for a content-led business website like ours and probably for yours.

The remaining 50 points sit in a single category, designed for sites that expose APIs, OAuth servers and agent-callable tools. For a marketing agency, a clinic, a tradesperson or a service business, that part of the test does not apply. This article explains what the score actually measures, why 50 is the real ceiling for most sites, and what we did to move ours so you can do the same with yours.

Why this is more than just another web audit tool

Every few years, a new score emerges that genuinely changes how websites are built. Google PageSpeed shifted attention onto Core Web Vitals. Lighthouse made accessibility and best practices into a checklist most developers now run before merging code. The Agent Readiness Score is positioned to do the same job for the AI era.

The shift behind it is real. AI agents (autonomous software that does research, comparison, and increasingly transactions on behalf of human users) are becoming part of how customers find businesses. ChatGPT has agentic browsing modes, Perplexity launched its Comet browser, Anthropic's Claude has a computer-use mode, and Google's Gemini agents are inside a growing number of consumer products. These agents do not just need your content to read. They need your content to be machine-legible, addressable through standard protocols, and able to expose any tools or APIs they might need to use on a customer's behalf.

A website built only for human visitors is increasingly a website that AI agents skip over.

The Agent Readiness Score is the first widely-promoted attempt to put a number on whether your site is participating. Whether or not the specific Cloudflare framework becomes the dominant standard, the trajectory is clear: a measurable signal of how AI-friendly your site is, similar to how PageSpeed became a measurable signal of how mobile-friendly your site is.

What the Agent Readiness Score actually checks

There are four scored categories. Cloudflare also tracks a fifth (Commerce) but does not currently include it in the score.

1. Discoverability

Can AI agents find your content in the first place?

Three checks: a valid robots.txt, a valid sitemap.xml, and HTTP Link response headers (RFC 8288) that point agents to useful resources without making them parse your HTML. Most professional websites already pass the first two. The Link header is newer and most sites miss it.

2. Content

Can AI agents read your content efficiently?

One check, and it is the one that almost everybody fails: Markdown content negotiation. When an AI agent requests a page with the header Accept: text/markdown, your server should respond with a clean markdown version instead of HTML. Cloudflare Radar measured this passing on just 3.9% of the top 200,000 domains on the web.

Markdown matters because HTML is bloated with layout code that an AI agent cannot use. A clean markdown version of the same page can use up to 80% fewer tokens, which means agents can ingest more of your site, faster and cheaper, before they hit their context window.

3. Bot Access Control

Can you tell agents what they're allowed to do with your content?

Three checks: AI bot rules in robots.txt (specific directives for GPTBot, ClaudeBot, Google-Extended, Perplexity, and the rest), Content Signals (a newer standard at contentsignals.org that lets you separately allow or block AI training, AI inference, and search), and Web Bot Auth (a draft IETF standard for cryptographically authenticating friendly bots).

Most professionally-built sites pass at least the first two. Content Signals is the differentiator: Cloudflare Radar found only 4% of the top 200,000 domains have implemented it, but it is the cleanest way to declare your AI policy in plain text.

4. Capabilities

Can agents do anything on your site beyond reading it?

This is where almost every website scores zero. The six checks here cover an Agent Skills index, an API Catalog (RFC 9727), an MCP Server Card, WebMCP, and OAuth discovery (RFC 8414 and RFC 9728). Combined, they let an AI agent discover what tools your website exposes, call those tools through standard protocols, and authenticate when they need to.

For a website that does not currently offer any APIs or agent-callable tools, this category is structurally inaccessible. You can publish empty schemas to score points, but they point at nothing real. Cloudflare include the category in the score because the standards exist, not because every business is supposed to implement them. We come back to what that means for a sensible target score below.

Plus: Commerce (tracked, not scored)

Cloudflare also checks for x402 (a revival of HTTP 402 Payment Required), Universal Commerce Protocol, and Agentic Commerce Protocol. These let AI agents pay for things on behalf of a customer. They do not affect the score yet, but they are coming.

What we found when we ran the score on our own site

We started at 33 out of 100, Level 2 "Bot-Aware".

The breakdown:

Discoverability: 67% (passing robots.txt and sitemap, missing Link headers)
Content: 0% (no markdown content negotiation)
Bot Access Control: 100% (already had robots.txt + Content Signals + AI bot rules)
API/Auth/MCP/Skill Discovery: 0% (nothing in this category)

The honest read: we already do better than most sites on bot rules and content signals because that is part of how we build for AEO. But on the newer agent-specific standards (Link headers and markdown content negotiation) we were behind, and on the API/MCP capabilities side we had nothing.

We made two changes in 24 hours.

Change 1: HTTP Link response headers. We added a Cloudflare rule that injects a Link header on the homepage response, pointing to our sitemap and to our robots.txt. About an hour of work.

Change 2: Markdown content negotiation. We added a worker that detects Accept: text/markdown requests and serves a markdown version of the page instead of the rendered HTML. We used a simple HTML-to-markdown conversion for the first ship. We will refactor it later to render markdown directly from our CMS for a cleaner output, but the first version was enough to pass the check. About three hours of work.

After the changes, our score is 50 out of 100, Level 4 "Agent-Integrated":

Discoverability: 100% (3/3)
Content: 100% (1/1)
Bot Access Control: 100% (2/2)
API/Auth/MCP/Skill Discovery: 0% (still 0/6)

That 50 is, for a content-led business website, effectively a perfect score. We are now passing every check in every category that applies to a marketing agency. The remaining 50 points sit entirely in the Capabilities category, which is built for sites that expose developer-style infrastructure: APIs, OAuth servers, MCP servers, agent-callable tools. Closing those checks for a website that does not actually run any of those things would mean publishing schemas that point at nothing. It scores points but adds zero real-world value to the business or to any agent that visits.

Put differently: we did not stop at 50 because the work got hard. We stopped at 50 because there is nothing left to do that would make the site genuinely more useful to AI agents.

The realistic ceiling for a normal business website

Cloudflare does not say so explicitly, but the score is partly aspirational. The Capabilities category exists because the underlying standards exist (Agent Skills index, API Catalog, OAuth Discovery, OAuth Protected Resource, MCP Server Card, WebMCP), not because every site is supposed to implement them. Five of those six are designed for sites that genuinely expose APIs, agent-callable tools, or developer-style infrastructure.

For a normal small or medium business website (a clinic, a tradesperson, a restaurant, an ecommerce shop without a public API, a marketing agency), the rational ceiling is 50 out of 100. That is what we hit. It means you have closed every gap that genuinely affects whether AI agents can find, read and respect your site. The remaining 50 points exist because Cloudflare graded the test as if every site might one day run an MCP server, and most do not.

There is one Capabilities check that is worth shipping even without a real API: an Agent Skills index at /.well-known/agent-skills/index.json. You can publish skills that let agents discover your booking flow, your pricing page, your contact form. It is genuinely useful, takes an hour to ship, and works as a positioning signal for any business that wants to credibly say "we are AI-forward". Adding it would push us from 50 to roughly 58 and is on our list to do next.

The other five (MCP Server Card, API Catalog, OAuth Discovery, OAuth Protected Resource, WebMCP) only make sense if you actually run the underlying infrastructure. Publishing an MCP Server Card pointing at no MCP server, or an OAuth Discovery endpoint backed by no OAuth server, scores you points but creates a maintenance burden for nothing real.

Hitting 100 is for businesses building genuinely agent-callable products. For everyone else, 50 is the goal, 58 is the optional stretch, and anything higher is not where your effort should go.

How agent readiness fits with AEO

Agent readiness and answer engine optimisation are related but separate disciplines.

Answer engine optimisation (AEO) is what gets your business cited inside AI-generated answers. ChatGPT recommending your business, Perplexity quoting your service page, Google AI Overviews including your post in its summary. AEO is a content and authority discipline. It depends on structured data, entity clarity, content extractability, and authority signals.

Agent readiness is the technical layer underneath. It is about whether AI agents that visit your site directly can navigate it, read it efficiently, and interact with it. Agent readiness is an infrastructure discipline. It depends on protocols and headers, not content quality.

A site can be excellent at AEO and score 33 on agent readiness. We just demonstrated exactly that. A site can be highly agent-ready and never get cited in any AI answer because the content is thin. The two reinforce each other but they do not substitute.

For most UK businesses in 2026, AEO is still the higher-impact discipline. AI Overviews and ChatGPT recommendations drive measurable traffic and enquiries. Agent readiness is forward-leaning: it positions you for the next 18 to 24 months as agentic browsing becomes more common, but it does not have a direct revenue effect today.

The smart move is to do both. Build the AEO foundation now (which we do as standard inside every SEO retainer at TSM) and ship the practical agent-readiness work alongside it. Skip the API and OAuth checks unless your business model calls for them.

How to improve your own score

Five practical steps, in priority order, for a normal business website.

1. Run the scan and read the prompts

Go to isitagentready.com and enter your URL. The tool gives you a detailed pass/fail breakdown plus copy-paste prompts you can hand to a coding agent (Claude, Cursor, Copilot) to implement each fix. The prompts are good. The work is largely automatable for any half-decent developer.

2. Close the easy Discoverability and Bot Access wins

Make sure your robots.txt is valid and references your sitemap. Add Content Signals to robots.txt (a single line). Add explicit AI bot rules for the bots you want to allow or block. Add an HTTP Link response header on at least your homepage. These four changes typically take a couple of hours and pull most sites up by 25 to 35 points.

3. Implement Markdown content negotiation

This is the highest-impact ship for AEO. Even before AI agents start using it heavily, search-engine-style AI tools (ChatGPT, Perplexity, Claude when used for research) already prefer markdown when they can get it, and they cite the cleaner version more reliably. The implementation depends on your stack. On Cloudflare, a Worker rule is the simplest option.

4. Decide on Capabilities scope

For most businesses, skip the API Catalog, OAuth and MCP Server Card checks unless you genuinely have something for them to point at. The one worth shipping is an Agent Skills index, which takes about an hour and acts as a credible "AI-forward" positioning signal. Without genuinely running the underlying infrastructure, the rest of the category is not where your effort should go.

5. Re-scan and document

Run the scan again. Document where you started and where you got to. The trajectory is the story, not the score itself, and it is exactly the kind of credibility signal that supports the rest of your AI marketing.

If your score is lower than you would like and you would rather not implement the fixes yourself, that is the part we can help with. Most marketing and service sites can be moved to the 50 mark (with the optional 58 stretch) in a few hours of focused work. We ship the changes alongside the AEO retainer, or as a one-off implementation: get in touch.

Common questions

Will the Agent Readiness Score affect my Google rankings?

Not directly, today. No major ranking system uses the Cloudflare framework as an input. But the standards it checks (Markdown content negotiation, Content Signals, AI bot rules) overlap with what ChatGPT, Perplexity, and Google AI Overviews use to decide what to cite. Agent readiness improvements tend to lift AI search visibility even when they do not move classic SEO rankings.

What is a good Agent Readiness Score to aim for?

For a content-led business website with no public APIs, 50 out of 100 is the de facto perfect score. It means you are passing every check in every category that applies to your site: Discoverability, Content, and Bot Access Control. The remaining 50 points sit in the Capabilities category, which scores how well your site exposes APIs, OAuth, MCP servers and agent-callable tools. Adding an Agent Skills index can push you to around 58 and is worth doing as a positioning signal. Hitting 100 only makes sense if your business actually runs developer-grade infrastructure agents are meant to call.

Do I need to implement llms.txt?

The score does not currently penalise you for missing llms.txt. It is a separate, optional file that some agents read, but adoption is uneven and no major AI engine treats it as required. If you have a documentation-heavy site, llms.txt is worth shipping. For a normal marketing or service site, it is not yet a priority.

How is agent readiness different from AEO?

AEO is the content and authority discipline that gets you cited in AI-generated answers. Agent readiness is the technical infrastructure that makes your site usable by AI agents that visit it directly. The two reinforce each other but they are separate. We cover AEO in detail in What is Answer Engine Optimisation? A Plain English Guide.

What did Tyneside Marketing actually ship to move from 33 to 50?

Two changes via Cloudflare Workers. First, an HTTP Link response header on the homepage pointing to our sitemap. Second, Markdown content negotiation: when a request includes Accept: text/markdown, we serve markdown instead of HTML. About four hours of development work in total. The full plan, including the checks we deliberately chose not to chase, is the same playbook we run on client sites.

Cloudflare's Agent Readiness Score: What It Means, and What Happened When We Scored Our Own Site

Why this is more than just another web audit tool