Cloudflare is now grading your website for AI agents. We ran the test.

The short answer

Cloudflare has started scoring websites on how well AI agents can read, navigate and use them. There is a public scanner, a rubric covering discoverability, content delivery, bot access and machine-readable APIs, and a set of measurement tools for how often AI assistants cite you. The company’s justification is blunt: by its own traffic data, “fewer than half of all HTML page requests now come from a human”.

If this feels familiar, it should. Google’s Lighthouse began grading agentic browsing in June. Cloudflare sits in front of roughly a fifth of the web, so when it publishes a definition of “agent-ready”, that definition tends to become the standard. We ran our own site through the scanner, scored 21, fixed what could honestly be fixed, and re-scanned at 50 the same day. This piece explains the rubric, what moved our score, and which parts of it most sites should refuse to chase.

What Cloudflare launched

The announcement, on Cloudflare’s blog, bundles two things.

The first is measurement. Cloudflare’s AEO (answer engine optimisation) tooling asks AI models realistic buyer questions in a category and records who gets cited: citation rate, how prominently a site appears in answers, brand mentions against actual citations, and share of voice against competitors. It is the analytics layer for a world where the “search results page” is a generated answer. If the term AEO is new to you, our explainer covers it; it is close kin to GEO.

The second is diagnostics. The public scanner at isitagentready.com audits any site against emerging agent-web standards and scores it into levels, and the same report now appears inside Cloudflare’s URL Scanner. This is the part you can act on directly, because every failed check comes with the exact request the scanner made and what it expected to find.

What the scanner checks

Five categories, in plain English:

• Discoverability. Does robots.txt exist and parse; is there a valid sitemap; does the site send Link response headers pointing agents at useful resources; are there DNS records for agent discovery. The first two are table stakes, the last two are new.
• Content. If a client asks for Accept: text/markdown, does the site return Markdown instead of HTML. Markdown is dramatically cheaper for a model to read than a rendered page, and this check tests whether you will hand it over.
• Bot access control. Are named AI crawlers (GPTBot, ClaudeBot, PerplexityBot and the rest) given explicit rules, and does robots.txt carry a Content Signals declaration: whether content may be used for search, for AI answers, and for training.
• API, auth and tool discovery. Is there a machine-readable catalogue of the site’s APIs, OAuth metadata for authenticating against them, an MCP server card, an agent skills index, tools exposed in the browser. This category assumes the site has agent-facing capability to declare.
• Commerce. Agentic payment and checkout protocols, only scored where a site shows e-commerce signals.

A worked example: our own site, 21 to 50

Our first scan returned 21: solid robots.txt and sitemap, everything else unchecked. That is worth dwelling on, because this site already did most of the things the AI-visibility playbook prescribes: pre-rendered pages served from Cloudflare’s edge, structured data throughout, Markdown summaries published for language models. The scanner was testing a newer, stricter question: not “is the content legible?” but “does the site actively cooperate with an agent?”

Four changes moved the score, all shipped the same day:

1. A Content-Signal line in robots.txt. Ours declares search=yes, ai-input=yes, ai-train=yes, a deliberate decision that our content may be indexed, quoted in AI answers and used for training. Yours may reasonably differ, especially on training; the point is that it is now a declaration you are expected to make, not a default you inherit.
2. A Link header on every response pointing at an API catalogue, so an agent landing anywhere on the site is one request away from a map of everything machine-readable.
3. The API catalogue itself, a small standards-format file listing the machine-readable endpoints that already existed: an organisation card, a services feed, the Markdown summaries.
4. Markdown content negotiation. A request to the homepage with Accept: text/markdown now receives a clean Markdown brief of the firm rather than HTML. Browsers are unaffected; agents that ask get the cheap, legible version.

Re-scan: 50, which the rubric labels “Agent-Integrated”. Content and bot access control both sit at 100, discoverability at 75. None of it was a redesign; it was configuration, headers and one small piece of server logic. The common thread is that every change pointed agents at something that already existed.

The half we refused to chase

Why not push past 50? Because the remaining checks — OAuth discovery, MCP server cards, agent skills indexes, in-browser tools — describe capabilities, not content. Each one is a machine-readable promise that an agent can authenticate, invoke tools or take actions against your site. Publish those documents without the capability behind them and you have built a directory of doors that open onto nothing. An agent will notice, or worse, will act on the promise and fail.

For a content site without protected APIs, a score around 50 is the honest ceiling today. The unchecked half of the rubric is a roadmap for when real agent-facing services exist, not a to-do list for this quarter. Score-chasing with hollow scaffolding is the new keyword-stuffing, and it will age just as badly.

How Morris McLane executes this

Agent readiness is the technical half of AI search visibility work: the same discipline that gets a brand cited by ChatGPT, Perplexity and Google’s AI results also determines whether an autonomous agent can read, verify and recommend it. Our execution runs in that order — baseline the site with the scanners and our own citation probes, fix the honest half (crawler rules, content signals, discovery headers, machine-readable endpoints, Markdown delivery), and then measure whether AI systems actually start citing the site, because readiness is the means and citation is the result. These standards now ship on every managed AI-ready website we build: the machine-readable catalogue, the content-usage signals and Markdown delivery are standard on each client site, with the training signal set by the client, not defaulted.

If you want to know where your site stands, run it through isitagentready.com this week, or start with our audit and we will interpret the result against your category and competitors.