Cloudflare's Agent Readiness Score: How We Went From 21 to 64 (Level 5) in One Session

Cloudflare's Agent Readiness Score is a free public scan at isitagentready.com that grades any website 0–100 on whether AI agents can read, discover, and use it. We ran LumenGEO through it, scored a 21, implemented the failing checks in one working session, and re-scanned at 64 — Level 5 of 5, "Agent-Native." This is the complete punch list: what each check wants, what each fix actually took, and which checks you should deliberately skip.

The score launched in April 2026. Cloudflare links to it from its dashboard, making it the de facto first-party benchmark for the standards it checks, and a growing number of site owners are discovering it the same way we did: scan your domain, see a low red number, wonder what it means.

Here is what it means, and what to do about it.

Published: June 10, 2026

First, what this score is — and is not

The Agent Readiness Score checks ~16 emerging web standards across five categories: discoverability, content accessibility, bot access control, API/MCP discovery, and agentic commerce. It does not measure whether ChatGPT or Perplexity cites you.

That distinction matters because the scan lives adjacent to GEO but is not GEO. AI search citations are driven by retrieval rankings, content quality, and brand authority — a site can score 15 here and get cited constantly. What this score measures is readiness for the agentic layer: AI assistants that browse, extract, compare, and act on a user's behalf. That layer is already deployed at scale — ChatGPT Agent, Perplexity's Comet, agentic Chrome — and it reads websites very differently than a human does.

The honest case for caring: the standards being checked (markdown negotiation, MCP discovery, Content Signals) are exactly the plumbing that agent traffic will use as it grows, almost nobody has implemented them yet, and the implementation cost is low. Early hygiene, cheap insurance, real differentiation — as long as you don't confuse it with citation optimization.

Our baseline: 21/100, Level 1 — "Basic Web Presence"

LumenGEO scored 21 on the first scan: 3 of 15 applicable checks passing. For a GEO company with an article literally titled "Is Your Site Agent-Ready?", this was an uncomfortable and motivating result.

What we were passing: a valid robots.txt, a valid sitemap, and AI-bot rules in robots.txt (ten named crawlers). In other words — the 2024 stuff.

What we were failing:

• Link headers (Discoverability) — no RFC 8288 Link response headers pointing agents at machine-readable resources
• DNS-AID (Discoverability) — no DNS-based agent discovery records
• Markdown negotiation (Content) — Accept: text/markdown returned HTML
• Content Signals (Bot Access) — no Content-Signal directives in robots.txt
• All seven API/MCP/discovery checks — no MCP server card, no Agent Skills index, no API catalog, no OAuth discovery metadata, no auth.md, no A2A agent card, no WebMCP

Five categories, and in two of them we held a zero.

The punch list: what each fix actually took

Six fixes, one working session. In rough order of effort-to-impact:

1. Content Signals — one line in robots.txt (5 minutes)

Content Signals is a robots.txt extension for declaring how AI may use your content, with three switches: search, ai-input (quoting in AI answers), and ai-train. We added:

Content-Signal: search=yes, ai-input=yes, ai-train=yes

All three yes is a deliberate GEO position, not a default: we want retrieval, quoting, and model absorption — being baked into model weights is how a brand becomes the answer rather than a footnote. A publisher monetizing original reporting would reasonably choose ai-train=no. The point of the standard is that the choice is now yours to declare.

2. Link headers — a config block (10 minutes)

RFC 8288 Link response headers on the homepage tell agents where the machine-readable surface lives before they parse a byte of HTML:

Link: </.well-known/api-catalog>; rel="api-catalog",
      </llms.txt>; rel="describedby",
      </.well-known/mcp/server-card.json>; rel="describedby"

In Next.js this is a headers() entry in next.config; on any CDN it's a header rule.

3. llms-full.txt — if you have llms.txt, you're one route away (30 minutes)

We already served an llms.txt overview. llms-full.txt is its expanded sibling per llmstxt.org: the full content corpus as one plain-markdown document. Ours is generated at build time from the same source files as the blog — ~950KB of markdown an agent can ingest in one fetch instead of crawling 70 pages.

4. Markdown content negotiation — the highest-value fix (2–3 hours)

This is the one with real engineering in it, and the one we'd argue matters most beyond the score. When a request arrives with Accept: text/markdown, our middleware now rewrites it to a handler that returns the page as clean markdown — Content-Type: text/markdown, with an advisory x-markdown-tokens header — while browsers keep getting HTML. Our content already lives as MDX, so the markdown representation is the source format, not a conversion.

Why it matters: every HTML page an agent reads gets converted to text anyway, by the agent, lossily, at its own token cost. Serving markdown directly makes you the cheapest site in the consideration set to read. (Cloudflare zones can enable this without code via Markdown for Agents; we implemented it in the application because we wanted control over the output.)

Try it: curl -H "Accept: text/markdown" https://lumengeo.co/blog/what-is-geo

5. MCP server card + a hosted MCP endpoint (half a day, because we'd already built the server)

The scanner wants /.well-known/mcp/server-card.json — a small JSON document advertising your Model Context Protocol server. We had an MCP server exposing our first-party citation datasets as a local stdio package; this was the push to host it properly as a streamable-HTTP endpoint at lumengeo.co/mcp, then point the card at it. Any MCP-capable agent — Claude, Cursor, Copilot — can now query our retrieval-landscape and search-stability data live, no install.

A server card pointing at nothing would pass the check and defeat the purpose. If you don't have an MCP server, skip the card — see below.

6. Agent Skills index (1 hour)

/.well-known/agent-skills/index.json lists skill documents — markdown instructions an agent can fetch to learn how to use your site well. We published three, each a real capability: querying our citation data over MCP, generating a GEO action plan via parameterized URL, and running a GEO audit (with an explicit note that the audit is human-gated). Each entry carries a SHA-256 digest of its document.

What we deliberately did not implement

Four of our six remaining failures are checks we chose to skip — because passing them would mean publishing metadata for capabilities we don't have.

• OAuth discovery, OAuth Protected Resource, auth.md — these describe how agents authenticate against your protected APIs. We don't offer agent-facing authenticated APIs. Publishing discovery metadata for an auth flow that doesn't exist would score points and confuse every agent that trusts it.
• A2A Agent Card — advertises an agent-to-agent endpoint. We don't run one.

This is the same principle as schema markup: structured claims about your site must be true, or they eventually cost you more than they earn. Chase the checks that describe something real.

The two we'll revisit: DNS-AID (agent-discovery DNS records — low value today, trivial once tooling matures) and WebMCP (registering your site's interactive tools with browser agents via navigator.modelContext — genuinely interesting for our free tools, and on the roadmap).

The result: 64/100, Level 5 — "Agent-Native"

After one session: Discoverability 75, Content 100, Bot Access Control 100, API/MCP & Skill Discovery 43. Overall 64 — Level 5, the scanner's top tier.

The remaining 36 points live almost entirely in checks that don't apply to us (OAuth × 3, A2A) or aren't worth it yet (DNS-AID, WebMCP). A content or SaaS site implementing the six fixes above should expect a similar landing zone: 60s and the top level, from a starting point in the teens or twenties.

The before/after is itself the proof of how early this is: the median site is at Level 1 not because the fixes are hard, but because the standards are months old and nobody has looked.

Does any of this improve AI citations?

Mostly no — and anyone selling agent-readiness as a citation hack is overclaiming. But two of the fixes plausibly help the retrieval layer, and the rest are cheap positioning for what comes next.

Honest assessment, fix by fix: Content Signals and bot rules are about permission, not ranking. The MCP server, skills index, and API catalog are about the agentic layer, not search. Markdown negotiation and llms-full.txt are the two with a plausible retrieval story — they reduce the cost and error rate of every AI fetch of your content, and retrieval agents (ChatGPT browsing, Perplexity, Claude's web search) are exactly the bots fetching your pages at citation time.

What actually moves citations remains what our audit data keeps showing: answer-first content, original data worth quoting, third-party presence, and Bing indexation for the ChatGPT ecosystem. Agent-readiness is the infrastructure under that work, not a substitute for it. Get your score up in an afternoon — then spend the quarter on the things that earn citations.

Run your own before/after

1. Scan your domain at isitagentready.com and screenshot the baseline.
2. Implement the four fast fixes: Content Signals, Link headers, llms.txt + llms-full.txt, AI-bot rules if you're missing them.
3. Add markdown negotiation (application-level, or one toggle if you're on Cloudflare).
4. Only then decide on the MCP/skills layer — publish cards for capabilities you actually have.
5. Re-scan, keep the receipt, and put the delta in front of your team.

If you want the citation side of the picture — whether AI engines actually recommend you, and what to fix first — that's what our free GEO audit measures, and the GEO Action Plan builder turns into a sequenced checklist.

Frequently asked questions

What is Cloudflare's Agent Readiness Score?

A free public scanner at isitagentready.com, launched by Cloudflare in April 2026, that grades any website 0–100 (Levels 1–5) on roughly 16 emerging agent-web standards: robots.txt and sitemaps, RFC 8288 Link headers, markdown content negotiation, AI-bot rules and Content Signals, MCP server cards, Agent Skills indexes, API catalogs, OAuth discovery, and agentic-commerce protocols.

Is the Agent Readiness Score the same as a GEO score?

No. The Agent Readiness Score measures whether AI agents can technically read and use your site (agent-legibility). A GEO score measures whether AI search engines actually cite and recommend your brand. A site can score low on one and high on the other; they share some plumbing (robots.txt, llms.txt, markdown access) but measure different outcomes.

Why do most websites score so low on it?

Because most of the standards it checks were published in 2025–2026. The median site passes only the legacy basics — robots.txt and a sitemap — and lands at Level 1. Low scores reflect how new the standards are, not how broken the web is.

What is markdown content negotiation?

Serving a markdown version of a page when a client requests it with the Accept: text/markdown HTTP header, while browsers continue to receive HTML. It lets AI agents read your content without parsing HTML — cheaper, faster, and less error-prone. Cloudflare zones can enable it without code changes ("Markdown for Agents").

Should I publish an MCP server card to pass the check?

Only if it points at a real, working MCP endpoint. A server card advertising a server that doesn't exist scores a point on the scan and misleads every agent that reads it. If you don't have structured data worth exposing over MCP, skip this check — the scanner's own levels don't require it for a strong score.

How long does it take to improve an Agent Readiness Score?

For a typical content or SaaS site: Content Signals, Link headers, and llms.txt-family files take under an hour combined; markdown content negotiation takes an afternoon at the application level (or one setting on Cloudflare); MCP and Agent Skills depend entirely on whether you have real capabilities to expose. We went from 21 to 64 — Level 1 to Level 5 — in one working session.