How the agent-readiness score works: methodology and limits

What does the agent-readiness score measure?

The agent-readiness score measures how well AI agents can reach, read, operate and buy from an ecommerce store, as a number from 0 to 100 with a letter grade. It is ecommerce-first: product data and buyability weigh more than generic SEO signals. That is the main difference from general agent-readiness scores such as Cloudflare’s, which doesn’t score product data or commerce. What each category covers is explained in agent-ready ecommerce.

How does the scanner test a store?

The scanner tests a store using only its URL and plain HTTP requests. Every scored check must be detectable by fetching URLs and parsing HTML. There is no headless browser and no login.

• Pages sampled: the homepage plus up to 3 product pages. Product pages come from the sitemap first, then from links on the homepage and collection pages.
• Other URLs fetched: /robots.txt, sitemaps, /llms.txt, /agents.md, /.well-known/ucp, OAuth metadata and other well-known paths, a search URL, and a made-up product URL to test for soft 404s.
• Limits: 8 seconds per request, 25 seconds per scan, at most 4 concurrent requests and 45 requests per scan. Requests go through an SSRF guard on every redirect hop.
• Identity: the scanner sends its own user agent with an info URL. If that is blocked, pages are re-fetched with a browser user agent so content checks still run.
• Blocked homepage: if the homepage blocks even a browser user agent, the scan stops with an error and no score. AI agents fetching from cloud servers likely hit the same wall.
• Region: scans run from a fixed region, because geo-redirects change results.

How is the score calculated?

The score is calculated in three steps: score each check, combine checks into category scores, then combine categories into the overall score.

1. Check result. pass = 1, partial = 0.5, fail = 0. Some graded checks, such as the UCP profile, can return a value in between. inconclusive, skipped and errored checks are excluded.

2. Category score. Each check has a weight: High = 3, Medium = 2, Low = 1.

category score = Σ(result × weight) / Σ(weight of scored checks) × 100

3. Overall score. Categories are weighted:

Category	Weight
Access	25
Product data	25
Operability	20
Discovery	15
Agentic commerce	15

overall = Σ(category score × category weight) / 100

If a category has no scorable checks at all (for example, no product page was reachable), it is dropped and the remaining weights are renormalized.

What do the grades mean?

Grades map directly from the overall score:

Grade	Score
A	90 and above
B	75–89
C	60–74
D	40–59
F	below 40

What is the difference between inconclusive and fail?

A fail means the scanner saw the problem: robots.txt disallows OAI-SearchBot on product pages, or the add-to-cart control is a <div>. An inconclusive result means the scanner couldn’t get a trustworthy answer, and the check is left out of the score.

The main source of inconclusive results is bot protection. The scanner sends AI user-agent strings from its own IP, and verified-bot systems check IP, reverse DNS or signatures. A spoofed ChatGPT-User may be challenged while the real one is allowed. So a generic bot challenge on a spoofed user agent is reported as inconclusive, not fail. Product checks are also inconclusive when no product page could be loaded.

skipped is used when a check depends on another one. The live agent endpoint check is skipped when there is no valid UCP profile, so a missing profile is penalized once, not twice.

How do bonus checks work?

Five bonus checks reward emerging specs without punishing stores that don’t use them yet: WebMCP, A2A agent card, AI Catalog, API catalog and rel="ucp". Each is Low weight in Agentic commerce and only counts when the signal is found. A missing bonus signal never lowers the score.

How are AI training crawlers treated?

Blocking AI training crawlers such as GPTBot, ClaudeBot and Google-Extended is information only. It’s a legitimate business choice and doesn’t stop AI agents from shopping your store. Blocking AI search bots and user-initiated agents is penalized in both the robots.txt and agent access checks, because it hides products from AI answers and breaks live shopping requests. The full bot list is in AI crawler and agent user agents.

What is not scored, and why?

Some agent-readiness signals can’t be seen from a store URL, so they are shown as advice instead of scored:

• Google Merchant Center feed: uploaded privately to Google (spec).
• OpenAI ACP product feed: pushed to OpenAI, with no public discovery file (OpenAI).
• Web Bot Auth, Visa Trusted Agent Protocol and Mastercard Agent Pay acceptance: these are server-side policies. The scanner scores the visible result, whether agent requests get through.

Other signals need a real browser and are deferred for now:

• Computed accessibility tree, layout shift (CLS) and modals covering controls.
• Guest checkout end to end.
• Checkout autocomplete tokens (WHATWG autofill).
• WebMCP tools registered at runtime.

Where possible, v1 uses static heuristics instead, such as looking for WebMCP registration in the server HTML.

How was the scoring calibrated?

The scoring heuristics were calibrated on live stores in October 2026. The scanner ran against a pool of 42 public stores. 31 returned a score: 20 on one hosted commerce platform, 1 on Medusa, 3 on Next.js and 7 on other or custom platforms. 11 refused the scan, mostly because they blocked even a browser user agent with 403 or 429.

Aggregate results from the 31 scored stores:

• Scores ranged from 32 to 95. Stores on the most common hosted platform had a median of about 75 (B/C); all other stores had a median of about 50 (D).
• Return policy and shipping structured data passed on only 3 of 31 stores, the most common failure.
• Markdown alternatives passed on 2 of 31, which supports their Low weight.
• A2A agent card, AI Catalog and API catalog passed on 0 of 31, which supports keeping them bonus-only.
• UCP, the live agent endpoint, OAuth discovery and WebMCP passed together on 16 of 31, almost all of them on that same hosted platform, which ships these by default, and failed together elsewhere.

Calibration fixed false results, including bot-challenge pages being scored as real product pages and product names that differed slightly between JSON-LD and the <h1>.

Why is agentic commerce weighted at 15%?

Agentic commerce stays at 15% because two pressures cancel out. Today the category mostly tracks whether a store runs on a platform that ships UCP by default, agents still mostly buy through the merchant’s own checkout, and UCP is months old, all reasons not to weight it higher. But it’s the only category that rewards agent-driven cart and checkout, and UCP has shipped with broad industry backing, so it shouldn’t be lower. Platform defaults like UCP and llms.txt score the same as hand-built ones: the score rates the store, not the effort.

What are the limitations of the score?

• Spoofed user agents: the scanner can’t present real AI bot IPs or signatures, so access results can differ from what verified bots see.
• Sampling: three product pages may not represent a large catalog.
• Static HTML only: anything rendered or registered by JavaScript after load is invisible, which is also what non-JS AI bots see.
• Performance: timing depends on the scanner’s region and network. Thresholds are our own, since no AI vendor publishes agent timeouts.
• Weights: the weights are a first version and may change. Changes will be reflected on this page.
• Caching: results are cached for about 10 minutes, so a fix may not show up right away.

Scan your store to see the score, or read agent readiness vs SEO for how this differs from a search audit.