AI agent readiness check
See how ready a site is for AI agents and assistants: what its robots.txt tells AI crawlers, whether it answers in Markdown, and whether agents can find its APIs, MCP server and skills. Scored with the levels of Cloudflare’s Agent Readiness scan.
By using these tools you accept the Terms and the Privacy page.
How the AI agent readiness check works
AI agents and assistants now read websites for people: they look up prices, compare products, follow documentation and call APIs. This check asks a site the same questions those agents ask, and grades the answers with the levels Cloudflare published for its Agent Readiness scan, from level 0 (not ready) to level 5 (agent-native).
What the four groups mean
- Discoverability: can an agent find its way around? robots.txt and a sitemap are the classic map; a Link header on the home page (RFC 8288) can point straight to an API catalog or documentation; DNS for AI Discovery publishes agent endpoints as SVCB records.
- Content for agents: when an agent asks for Accept: text/markdown, a ready site answers with Markdown instead of HTML, which takes far fewer tokens to read.
- Bot access control: robots.txt groups for AI crawlers such as GPTBot, ClaudeBot or Google-Extended say who may read what; a Content-Signal line says whether content may be used for search, AI answers and AI training; Web Bot Auth publishes the keys a site’s own bots sign with.
- Protocol discovery: well-known files that tell agents what a site offers and how to use it: an API catalog (RFC 9727), OAuth metadata (RFC 8414 and RFC 9728), auth.md, an MCP Server Card, an A2A Agent Card, an Agent Skills index, WebMCP tools in the page, and an AI Catalog.
How each check decides
The check first loads the home page over HTTPS, following redirects, and asks every other path of the site it ends on. If the home page returns an error or a bot check, nothing else runs, as in Cloudflare’s scan, and the result says so. Files must load with status 200 and have the right shape: robots.txt needs a User-agent line, a sitemap a urlset or sitemapindex root, an API catalog a linkset array, an MCP Server Card a server name and version or an endpoint, an AI Catalog a specVersion and valid entries. A web page served in place of a file never counts.
WebMCP is found in the page’s own HTML (forms with toolname and tooldescription) and in up to 12 of its own scripts, two import levels deep, by looking for registerTool() next to modelContext. The code isn’t run, so a tool that only appears after it runs can be missed.
What isn’t scored
llms.txt, a plain-text reading list for language models, is shown because many sites publish one, but Cloudflare’s scan no longer scores it. The agent-payment protocols (x402, the Machine Payment Protocol, the Universal Commerce Protocol, the Agentic Commerce Protocol and AP2) are listed for shops and paid APIs; a site that doesn’t sell anything shows them as not found, which is normal.
Limits
Every request comes from Cloudflare’s network with our checker’s user agent, at most five at a time and never more than 66 in all, within 20 seconds. A site that blocks unknown bots may block this check too; real AI agents meeting the same rules would be stopped the same way. Results are kept for 10 minutes, and a domain’s saved report page refreshes this check with its other free checks every two weeks.
Updated · Maintained by Liviu Tanase
Questions
What does this check?
Seventeen scored checks in four groups, the same set as the Agent Readiness tab of Cloudflare’s Radar URL Scanner. Discoverability: robots.txt, a sitemap, Link headers that point agents to an API catalog or docs, and DNS for AI Discovery records. Content: whether the home page answers in Markdown when an agent asks for it. Bot access: rules for AI crawlers in robots.txt, Content Signals, and a Web Bot Auth key directory. Protocols: an API catalog, OAuth discovery, OAuth protected-resource metadata, auth.md, an MCP Server Card, an A2A Agent Card, an Agent Skills index, WebMCP tools and an AI Catalog. llms.txt and five agent-payment protocols are shown but not scored.
How are the level and the score worked out?
The score is the share of counted checks that pass, from 0 to 100; a Web Bot Auth directory that isn’t published is neutral and isn’t counted. The level is cumulative: level 1 needs two of robots.txt, a sitemap and agent Link headers; level 2 adds AI crawler rules and Content Signals; level 3 adds Markdown for agents; level 4 adds any one of an MCP Server Card, A2A Agent Card, Agent Skills index or API catalog; level 5 needs two of a Web Bot Auth directory (or none needed), all four of those, and OAuth discovery or auth.md. These are the rules of Cloudflare’s Agent Readiness scan.
Why is my level different from isitagentready.com?
Cloudflare’s own tool skips the A2A Agent Card unless you ask for it, while its Radar URL Scanner counts it, as this check does; a site without an A2A agent can therefore reach level 5 there and level 4 here. WebMCP is also read differently: Cloudflare loads the page in a browser, and this check reads the page’s source and its scripts without running them, so tools that only appear after code runs aren’t seen.
Do I need every check to pass?
No. Several checks only matter for some sites: OAuth metadata and auth.md for APIs that need sign-in, an A2A Agent Card for sites that run an A2A agent, a Web Bot Auth directory for sites that send their own bot requests. For most sites, robots.txt with AI crawler rules and Content Signals, a sitemap and Markdown for agents are the useful part.
What does “couldn’t check” mean?
The site, or the DNS resolvers, didn’t answer one of the requests within the 20-second limit. That check counts as not passed for the level, the result says how many couldn’t run, and the answer isn’t kept, so Check again asks afresh.
What does this check send to the site?
Usually 20 to 45 ordinary GET requests from Cloudflare’s network, never more than 66: the home page and its redirects, robots.txt, the sitemap, files under /.well-known/, auth.md, llms.txt, a few payment paths and up to 12 of the page’s own scripts, identified with our checker’s user agent. A few can go to hosts the site itself names, such as a sitemap or AI Catalog kept elsewhere. Nothing is submitted and no form is sent. DNS questions go to Cloudflare’s and Google’s public resolvers. Results are kept for 10 minutes.