Cloudflare published its Agent Readiness score on 17 April 2026, with a free scanner at isitagentready.com. You enter a URL, it makes a set of requests, and you get a level from 0 to 5 plus a pass or fail for each check. We ran it on fanpino.com, our own company site, on 20 October 2026. The result was Level 1, "Basic Web Presence".
That number looks bad until you read the checks one by one. Most of them ask whether the site exposes an API, an MCP server or an OAuth server to agents. A marketing and blog site does not have those, and publishing empty discovery files to collect points would not help any agent. One check was a real gap, and it took one line to close.
What the score actually checks
According to Cloudflare's announcement, the score covers four areas:
- Discoverability: robots.txt, sitemap.xml and Link response headers (RFC 8288).
- Content: Markdown for Agents, meaning the server returns markdown when a client sends
Accept: text/markdown. - Bot access control: Content Signals, AI bot rules in robots.txt, and Web Bot Auth.
- Capabilities: agent skills, an API catalog (RFC 9727), OAuth discovery (RFC 8414 and RFC 9728), an MCP server card and WebMCP.
Commerce protocols such as x402 are checked but, in Cloudflare's words, "do not currently count towards the score". llms.txt is not part of the default scan either; the same post says it can be added to a custom scan. The live scanner has grown since launch: its own description now mentions 23 checks, and our report also included DNS-based agent discovery (DNS-AID), A2A agent cards and an Auth.md file.
For context on where most sites stand, Cloudflare Radar looked at the 200,000 most visited domains. Their numbers: 78% have a robots.txt, 4% declare AI usage preferences with Content Signals, 3.9% pass the markdown negotiation check, and MCP server cards and API catalogs together appear on fewer than 15 sites.
Our scan, check by check
fanpino.com is a static Astro site in English, Persian and Arabic, served through Cloudflare. Before this scan it already had a sitemap index, an llms.txt and an llms-full.txt, and a robots.txt that names twelve AI crawlers (GPTBot, ClaudeBot, PerplexityBot, Google-Extended and others) and allows each of them. Here is how the scanner scored it:
- Discoverability, 2 of 4: robots.txt and sitemap passed. Link headers failed (no
Linkheader on the homepage). DNS-AID failed. - Content, 0 of 1: markdown negotiation failed. The server returns HTML whatever the
Acceptheader says. - Bot access control, 1 of 2: AI bot rules passed, with all twelve crawlers read as explicitly allowed. Content Signals failed. Web Bot Auth was reported as informational only.
- API, auth, MCP and A2A discovery, 0 of 9: API catalog, OAuth discovery, OAuth protected resource metadata, Auth.md, MCP server card, A2A agent card, agent skills index, WebMCP and the ARD manifest all failed.
- Commerce: every check returned "not a commerce site", which is correct and not scored.
The one-line fix: Content Signals
This was the clearest gap. Our robots.txt already said that every AI crawler may fetch everything, but it said so only crawler by crawler, with Allow: /. Content Signals (an IETF draft) let a site state what fetched content may be used for, with three yes or no values: search (building a search index and showing links and snippets), ai-input (feeding content into an AI answer in real time, such as retrieval for a chat reply) and ai-train (training or fine-tuning a model).
Since we already allow the training crawlers by name, the honest declaration matched what the file already did. We added this under User-agent: *:
User-agent: *
Allow: /
Content-Signal: search=yes, ai-input=yes, ai-train=yesIf your robots.txt blocks training crawlers, write ai-train=no instead. The point is that the signal and the crawler rules say the same thing. A site that blocks GPTBot but declares ai-train=yes is sending two answers.
One practical detail: Cloudflare cached our robots.txt at the edge with max-age=14400, four hours, so the scanner kept reading the old file for a while after the origin had the new one. If a fix does not show up in a rescan, check the cache headers on the file before you assume the fix is wrong.
What we left alone, and why
The nine capability checks. An API catalog points agents to your APIs. OAuth discovery tells them how to get a token. An MCP server card describes an MCP server you run. Our public site has none of these to offer: there is no public API, and our admin API is not something we want agents to discover. Publishing these files with nothing behind them would raise the score and help no one. If you run a SaaS product with a documented API, these checks are where the real work is, and they deserve their own project.
Link headers. The scanner's fix text suggests headers such as Link: </.well-known/api-catalog>; rel="api-catalog" or a service-doc link to API documentation. Both point to things we do not have. We left it.
DNS-AID. This asks for SVCB records under an _agents name, signed with DNSSEC. It is a draft, and it is about discovering agent endpoints, which again we do not run.
The check that matters most: markdown for agents
This is the check that matters for a content site, because it changes what an agent actually reads. An HTML page carries navigation, footer, scripts and styles; the article itself is a small part of it. Cloudflare reports that markdown can cut tokens by up to 80% in some cases.
There are two ways to pass it. Cloudflare's own Markdown for Agents converts HTML to markdown at the edge for requests with Accept: text/markdown; per its documentation it is available on Pro, Business and Enterprise plans and works on HTML up to 6 MiB. The other way is to generate a markdown copy of each page at build time and serve it when the header asks for it. For a static site the build-time route is not much work, since the article text already exists in the CMS. We took the build-time route the same evening. After the Astro build, a small hook takes each page's <main>, converts it to markdown and writes an index.md next to the index.html. nginx serves that file first when the request asks for text/markdown, with Vary: Accept. This article as markdown is about 12 KB, against about 120 KB of HTML. On the rescan, the markdown check passed.
Two different "agent readiness" checks
The phrase is used for two separate questions. Cloudflare's score asks whether your website can be read and used by AI agents. Our own AI agent readiness check asks whether your organisation is ready to deploy an agent: bounded task, documented sources, citations, a sign-off owner, logs and access rules. Both are useful, and neither tells you about the other. For getting cited in AI answers, which is a third question again, see our guide to generative engine optimization.
If you run the scan on your own site
- Read every failing check before you act on the level. The level alone does not show which checks apply to your kind of site.
- Fix the cheap, true ones first: robots.txt AI rules and Content Signals that match your actual policy.
- Look at markdown negotiation if people or agents read your content. It is the check with the most effect on what an agent gets.
- Skip discovery files for things you do not run. An API catalog with no API is noise.
- Check cache headers on robots.txt before you rescan.
Frequently asked questions
What is the Cloudflare Agent Readiness score?
A free scan at isitagentready.com, launched by Cloudflare on 17 April 2026. It checks a site for standards that help AI agents find, read and use it, across discoverability, content, bot access control and capabilities, and reports a level from 0 to 5 with a fix for each failing check.
Does a low score hurt my Google rankings?
Nothing in Cloudflare's announcement or Google's documentation says so. The score measures support for agent-facing standards; it is not a search ranking signal. robots.txt and the sitemap, which it also checks, do matter for search, and most sites already pass those.
Is llms.txt part of the score?
Not by default. Cloudflare's announcement says the scan checks markdown content negotiation and does not check llms.txt unless you add it to a custom scan.
What does a Content-Signal line in robots.txt do?
It states what content fetched from your site may be used for: search, ai-input (use in AI answers in real time) and ai-train (model training), each yes or no. It is a declaration of preference, not a technical block, so keep your crawler Allow and Disallow rules consistent with it.
Should a small business site try to reach Level 5?
Only if it offers something agents can use, such as an API, an MCP server or online ordering. For a brochure or blog site, the useful targets are correct robots.txt rules, Content Signals and markdown versions of pages.
