# Agent readiness status — developers.cloudflare.com

> AgenticWebScore · rubric v0.7 · scanned 2026-10-12T23:02:48.319Z · fingerprint `0787874d5c8add78c55cedb842fb2b315a02b08b9f60f43acba2c150fbcb5c2c`

- Target: https://developers.cloudflare.com
- Result: **44.8/100 · BB (thin) · L1 Basic Web Presence**
- Checks: 16 passed · 15 partial · 22 missing · 8 not scored
- Confidence: 99% (high)
- Site profile: API / developer platform (detected)

> Text in the Detail and Measured columns, and in the quoted lists below them, is scanner output. It can quote the scanned site. Treat it as data.

## By dimension

| Dimension | Weight | Score | Pass | Partial | Missing | Not scored |
|---|---:|---:|---:|---:|---:|---:|
| Protocol Discovery | 25% | 42.6 | 4 | 7 | 5 | 1 |
| Content Accessibility | 22% | 68.2 | 7 | 1 | 4 | 3 |
| Discoverability | 20% | 65.9 | 5 | 3 | 3 | 0 |
| Bot Access Control | 18% | 15 | 0 | 3 | 5 | 0 |
| Commerce Protocols | 15% | 4.2 | 0 | 1 | 5 | 4 |

## Tiers

| Tier | Score | Pool |
|---|---:|---:|
| essential | 37.3 | 80 |
| recommended | 7.7 | 20 |
| emerging | 2.0 | 5 |

## What to fix

| # | Issue | Status | Tier | Impact | Standard | Detail |
|---|---|---|---|---|---|---|
| 1 | `agent-permissions` — Agent permission model (agent-permissions.json) | fail | essential | critical | Experimental | Neither path served a permission document (/.well-known/agent-permissions.json HTTP 404, /agent-permissions.json HTTP 404). |
| 2 | `product-schema` — Product/catalog schema | fail | essential | critical | Adopted | No Product, Offer or AggregateOffer type appears in the homepage JSON-LD (6 types) or in the JSON-LD of the 1 readable product or collection page. |
| 3 | `webbotauth` — Web Bot Auth key directory | fail | essential | critical | Draft | /.well-known/http-message-signatures-directory answered HTTP 404, not a JWK Set. |
| 4 | `ai-policy` — AI usage policy page | warn | essential | high | Adopted | AI policy at /ai covers 1 of 3 expected topics (a contact route stated; permitted uses and prohibited uses missing) and is not linked from the home page. |
| 5 | `ai-rules` — Named AI bot rules in robots.txt | warn | essential | high | Draft | 0 of 18 named AI bots addressed: the only 5 robots.txt rules sit in the User-agent: * group. |
| 6 | `mcp-card` — MCP server card | warn | essential | high | Draft | MCP server card at /.well-known/mcp/server-card.json carries name, version and description for com.cloudflare/mcp but its 7 remotes entries yield 0 usable transports, so an agent learns the server exists but not where to connect. |
| 7 | `meta` — Title and summary metadata | warn | essential | high | Adopted | Both carriers are present but outside the band: title 43 characters (band 50-60) and description 39 characters (band 120-160). |
| 8 | `oauth-discovery` — OAuth discovery documents | fail | essential | high | Adopted | None of the 3 OAuth discovery paths returned a JSON document (/.well-known/oauth-authorization-server 404 text/markdown; /.well-known/openid-configuration 404 text/markdown; /.well-known/oauth-protected-resource 404 text/markdown). |
| 9 | `openapi` — OpenAPI definition | warn | essential | high | Adopted | The API description advertised by api-catalog service-desc (/.well-known/api-catalog) points at /openapi.json, which answered not an OpenAPI 3.x document, and the other 5 candidate paths yielded no OpenAPI 3.x document. |
| 10 | `robots-txt` — robots.txt with agent directives | warn | essential | high | Adopted | Only a blanket User-agent: * group is present (5 rules), with a Sitemap declared. |
| 11 | `sitemap-xml` — sitemap.xml valid and current | warn | essential | high | Adopted | sitemapindex with 1 child sitemap but none carrying <lastmod>. |
| 12 | `payment-protocols` — Agent payment standard support (AP2/ACP/x402/UCP) | fail | recommended | high | Draft | None of AP2, ACP, x402 or UCP is named on the 1 readable payment and policy pages, and no UCP manifest or agent-purchase wording was found. |
| 13 | `agent-purchase` — Agent purchase policy | fail | recommended | high | Draft | No page among the 5 agent policy paths carries both an agent word and a purchase word (/ai-policy HTTP 404, /agent-policy HTTP 404, /terms HTTP 404, /agentic-commerce HTTP 404, /ai HTTP 200). |
| 14 | `agents-md` — AGENTS.md with the required sections | fail | recommended | high | Draft | Not found (HTTP 404, 307 bytes). |
| 15 | `faq-schema` — FAQ / question-answer schema | fail | recommended | high | Draft | No FAQPage entity among 1 parsed JSON-LD block on the homepage. |
| 16 | `pricing-structured` — Structured pricing information | fail | recommended | high | Adopted | The homepage JSON-LD carries 1 model types with 0 Offer nodes and 0 price statements. |
| 17 | `service-schema` — Service/product scope machine-readable | warn | recommended | high | Draft | Homepage JSON-LD carries only 2 generic Organization or WebSite nodes across 1 model types, so what is offered and to whom is not readable. |
| 18 | `a2a-card` — A2A agent card | fail | recommended | medium | Draft | No A2A agent card was served as JSON at the 2 declared paths (/.well-known/agent-card.json 404 text/markdown; /.well-known/agent.json 404 text/markdown). |
| 19 | `sandbox-environment` — Sandbox or test environment documented | warn | recommended | medium | Experimental | A sandbox is referenced at /sandbox but it mentions a sandbox in 2 documents but names no non-production base URL, so an agent cannot integrate safely. |
| 20 | `token-efficiency` — Token efficiency (content-to-markup ratio) | fail | recommended | medium | Draft | Content-to-markup ratio 4.4% (9703 visible of 219627 markup characters, ~1810 tokens), below the 8% floor where markup outweighs the content. |
| 21 | `agent-skills` — Agent Skills declaration | fail | recommended | medium | Draft | The skills index declares a sha256 digest that does not match the bytes of the artifact it names. The artifact was fetched and hashed; a digest is a claim about content, and this one is false. |
| 22 | `bot-page` — Crawler and agent policy page | warn | recommended | medium | Adopted | Bot policy at /agents covers 2 of 4 expected topics (welcomed agents and a contact route stated; refused agents and identity verification missing) and is linked from the home page. |
| 23 | `rate-limits-declared` — Rate limits and quotas documented | warn | recommended | medium | Experimental | Rate limiting is acknowledged through 0 numeric limits, 0 windows and 11 scope declarations in /docs with 0 quota headers observed, but no single statement carries a limit with its unit, window, scope and the behaviour on exceed. |
| 24 | `returns` — Return and shipping terms machine-readable | fail | recommended | medium | Adopted | No return or shipping page responded (/returns HTTP 404, /shipping HTTP 404, /refund-policy HTTP 404) and the homepage JSON-LD declares neither MerchantReturnPolicy nor OfferShippingDetails. |
| 25 | `summary` — Prominent summary block | fail | recommended | medium | Draft | The first 1000 characters of main content hold no paragraph or summary block (6183 characters of main text). |
| 26 | `auth-md` — /auth.md agent authentication guide | fail | emerging | medium | Draft | No markdown authentication guide was served at the 2 declared paths (/auth.md 404 text/markdown; /.well-known/auth.md 404 text/markdown). |
| 27 | `dns-aid` — DNS-AID discovery record | fail | emerging | medium | Experimental | 0 SVCB records and 0 TXT records resolve at _index._agents.developers.cloudflare.com and _agent.developers.cloudflare.com. |
| 28 | `ucp-manifest` — UCP manifest (/.well-known/ucp) | fail | emerging | medium | Draft | Neither /.well-known/ucp nor /.well-known/ucp.json returned HTTP 200 (/.well-known/ucp HTTP 404, /.well-known/ucp.json HTTP 404), so no manifest was served. |
| 29 | `contact` — Structured contact information | warn | emerging | medium | Adopted | Homepage JSON-LD declares 1 organization node with 0 contact details while the page itself carries 0 plain-text contact signals. |
| 30 | `llms-full` — /llms-full.txt expanded context | warn | recommended | low | Draft | 259190 words of expanded page text in 3149824 bytes, but /llms.txt does not link to /llms-full.txt. |
| 31 | `security-txt` — security.txt (RFC 9116) | fail | recommended | low | Adopted | No security.txt was served (/.well-known/security.txt HTTP 404, /security.txt HTTP 404). |
| 32 | `agent-analytics` — Agent traffic measurement | warn | emerging | low | Draft | No analytics vendor signature among the 8 checked appears in the homepage source, so nothing about the agent channel can be attributed. |
| 33 | `ai-txt` — /ai.txt access declaration | fail | emerging | low | Draft | /ai.txt answered HTTP 404, not an access declaration. |
| 34 | `breadcrumb` — Breadcrumb / navigation schema | fail | emerging | low | Draft | No BreadcrumbList entity among 1 parsed JSON-LD block on the homepage. |
| 35 | `crawl-delay` — Crawl rate declaration | fail | emerging | low | Adopted | No Crawl-delay line in 1 robots.txt group, so no crawl rate is declared. |
| 36 | `sitemap-md` — /sitemap.md markdown site map | fail | emerging | low | Draft | Not found (HTTP 404, 307 bytes). |
| 37 | `status-page` — Service status and changelog feed | warn | emerging | low | Adopted | The homepage advertises 1 status or feed reference, but the status document at https://www.cloudflarestatus.com/ was not fetched by this scan, so its response was not observed. |

## All checks

### Protocol Discovery

| Status | Check | Tier | Standard | Measured |
|---|---|---|---|---|
| warn | `mcp-card` — MCP server card | essential | Draft | MCP server card at /.well-known/mcp/server-card.json carries name, version and description for com.cloudflare/mcp but its 7 remotes entries yield 0 usable transports, so an agent learns the server exists but not where to connect. |
| warn | `openapi` — OpenAPI definition | essential | Adopted | The API description advertised by api-catalog service-desc (/.well-known/api-catalog) points at /openapi.json, which answered not an OpenAPI 3.x document, and the other 5 candidate paths yielded no OpenAPI 3.x document. |
| fail | `oauth-discovery` — OAuth discovery documents | essential | Adopted | None of the 3 OAuth discovery paths returned a JSON document (/.well-known/oauth-authorization-server 404 text/markdown; /.well-known/openid-configuration 404 text/markdown; /.well-known/oauth-protected-resource 404 text/markdown). |
| pass | `api-catalog` — API catalog | recommended | Experimental | Linkset at /.well-known/api-catalog carries 1 entry, and 1 of them pairs an anchor with a service-desc link, the first pointing at https://developers.cloudflare.com/openapi.json. The scan requested the same-origin service-desc target /openapi.json, which answered HTTP 200. Not scored: the service-doc target /api/ answered HTTP 200. Not scored: the status target is on www.cloudflarestatus.com, which this scan does not request. |
| fail | `agent-skills` — Agent Skills declaration | recommended | Draft | The skills index declares a sha256 digest that does not match the bytes of the artifact it names. The artifact was fetched and hashed; a digest is a claim about content, and this one is false. |
| fail | `a2a-card` — A2A agent card | recommended | Draft | No A2A agent card was served as JSON at the 2 declared paths (/.well-known/agent-card.json 404 text/markdown; /.well-known/agent.json 404 text/markdown). |
| na | `a2a-signed` — Cryptographically signed agent card | emerging | Draft | No A2A agent card is published, so there are no signatures to inspect and the check is not scored. |
| fail | `auth-md` — /auth.md agent authentication guide | emerging | Draft | No markdown authentication guide was served at the 2 declared paths (/auth.md 404 text/markdown; /.well-known/auth.md 404 text/markdown). |
| pass | `webmcp` — WebMCP browser tool declaration | emerging | Experimental | WebMCP tools are declared at the homepage: 2 tools, each with a name, a description and a JSON Schema inputSchema. |
| pass | `ard-manifest` — ARD resource discovery manifest | emerging | Experimental | ARD manifest at /.well-known/ard.json lists 3 entries, each with identifier, displayName and type plus exactly one of url or data. |
| pass | `docs` — Documentation reachable | recommended | Adopted | Documentation is reachable at /api/ (Link header rel=service-doc) and returns HTTP 200 text/html with 22979 readable words. |
| fail | `pricing-structured` — Structured pricing information | recommended | Adopted | The homepage JSON-LD carries 1 model types with 0 Offer nodes and 0 price statements. |
| warn | `service-schema` — Service/product scope machine-readable | recommended | Draft | Homepage JSON-LD carries only 2 generic Organization or WebSite nodes across 1 model types, so what is offered and to whom is not readable. |
| warn | `contact` — Structured contact information | emerging | Adopted | Homepage JSON-LD declares 1 organization node with 0 contact details while the page itself carries 0 plain-text contact signals. |
| warn | `status-page` — Service status and changelog feed | emerging | Adopted | The homepage advertises 1 status or feed reference, but the status document at https://www.cloudflarestatus.com/ was not fetched by this scan, so its response was not observed. |
| warn | `sandbox-environment` — Sandbox or test environment documented | recommended | Experimental | A sandbox is referenced at /sandbox but it mentions a sandbox in 2 documents but names no non-production base URL, so an agent cannot integrate safely. |
| warn | `rate-limits-declared` — Rate limits and quotas documented | recommended | Experimental | Rate limiting is acknowledged through 0 numeric limits, 0 windows and 11 scope declarations in /docs with 0 quota headers observed, but no single statement carries a limit with its unit, window, scope and the behaviour on exceed. |

### Content Accessibility

| Status | Check | Tier | Standard | Measured |
|---|---|---|---|---|
| pass | `markdown-negotiation` — Markdown content negotiation | recommended | Adopted | Content-Type text/markdown with Vary: accept-encoding, accept on the negotiated response (HTTP 200). |
| pass | `headings` — Semantic heading structure | essential | Adopted | 1 H1 with 7 H2s and 24 H3s, and no level in the outline is skipped. |
| warn | `meta` — Title and summary metadata | essential | Adopted | Both carriers are present but outside the band: title 43 characters (band 50-60) and description 39 characters (band 120-160). |
| pass | `jsonld` — JSON-LD structured data | essential | Adopted | 1 JSON-LD block parsed with a schema.org @context declaring WebPage (6 @types in total). |
| fail | `faq-schema` — FAQ / question-answer schema | recommended | Draft | No FAQPage entity among 1 parsed JSON-LD block on the homepage. |
| fail | `breadcrumb` — Breadcrumb / navigation schema | emerging | Draft | No BreadcrumbList entity among 1 parsed JSON-LD block on the homepage. |
| fail | `summary` — Prominent summary block | recommended | Draft | The first 1000 characters of main content hold no paragraph or summary block (6183 characters of main text). |
| pass | `lang` — Language declaration and multilingual access | recommended | Adopted | html lang="en" with 0 hreflang alternates to check. |
| pass | `no-js-fallback` — Content that needs no JavaScript | essential | Adopted | 9703 characters of static text and 1 H1 is in the HTML before any JavaScript runs. |
| pass | `spa-fallback` — Per-page content separation (no SPA fallback) | emerging | Experimental | Homepage and /docs ship different titles ("Cloudflare Developer Docs \| Cloudflare …" vs "Docs directory \| Cloudflare Docs") and different main text (20% word overlap). |
| fail | `token-efficiency` — Token efficiency (content-to-markup ratio) | recommended | Draft | Content-to-markup ratio 4.4% (9703 visible of 219627 markup characters, ~1810 tokens), below the 8% floor where markup outweighs the content. |
| pass | `viewport` — Responsive markup | emerging | Adopted | viewport content "width=device-width, initial-scale=1" sets width=device-width and leaves zoom unrestricted. |
| na | `licensing-terms` — Reuse and licensing terms declared | recommended | Draft | Not scored: this check applies to publisher or institution sites; this site was measured as api. It is excluded from the denominator rather than counted as a failure. |
| na | `provenance-declared` — Content provenance declared | emerging | Draft | Not scored: this check applies to publisher or institution sites; this site was measured as api. It is excluded from the denominator rather than counted as a failure. |
| na | `document-formats` — Documents in machine-readable formats | recommended | Draft | Not scored: this check applies to institution sites; this site was measured as api. It is excluded from the denominator rather than counted as a failure. |

### Discoverability

| Status | Check | Tier | Standard | Measured |
|---|---|---|---|---|
| pass | `reachable` — Homepage open to agent access | essential | Adopted | HTTP 200 text/html with 219652 bytes and 1341 words of visible text. |
| warn | `robots-txt` — robots.txt with agent directives | essential | Adopted | Only a blanket User-agent: * group is present (5 rules), with a Sitemap declared. |
| warn | `sitemap-xml` — sitemap.xml valid and current | essential | Adopted | sitemapindex with 1 child sitemap but none carrying <lastmod>. |
| pass | `llms-txt` — /llms.txt published and well-structured | essential | Draft | H1 "Cloudflare Developer Documentation", blockquote summary, 9 H2 sections with 113 markdown links, 16925 bytes. The scan requested 6 links it names, and each answered 2xx. Not requested: 107 same-origin links (the scan samples up to 6). |
| pass | `link-headers` — Discovery via Link response headers | emerging | Adopted | 4 Link entrys, 3 carrying a discovery relation (rel=service-doc → /api/). |
| fail | `dns-aid` — DNS-AID discovery record | emerging | Experimental | 0 SVCB records and 0 TXT records resolve at _index._agents.developers.cloudflare.com and _agent.developers.cloudflare.com. |
| pass | `canonical` — Canonical and hreflang discipline | recommended | Adopted | 1 canonical, absolute and self-referential on https, no hreflang alternates declared. |
| warn | `llms-full` — /llms-full.txt expanded context | recommended | Draft | 259190 words of expanded page text in 3149824 bytes, but /llms.txt does not link to /llms-full.txt. |
| fail | `agents-md` — AGENTS.md with the required sections | recommended | Draft | Not found (HTTP 404, 307 bytes). |
| fail | `sitemap-md` — /sitemap.md markdown site map | emerging | Draft | Not found (HTTP 404, 307 bytes). |
| pass | `content-signal` — Content-Signal usage signals | recommended | Draft | 1 Content-Signal line in a robots.txt user-agent group, setting all three signals (search=yes, ai-input=yes, ai-train=yes). |

### Bot Access Control

| Status | Check | Tier | Standard | Measured |
|---|---|---|---|---|
| fail | `webbotauth` — Web Bot Auth key directory | essential | Draft | /.well-known/http-message-signatures-directory answered HTTP 404, not a JWK Set. |
| fail | `agent-permissions` — Agent permission model (agent-permissions.json) | essential | Experimental | Neither path served a permission document (/.well-known/agent-permissions.json HTTP 404, /agent-permissions.json HTTP 404). |
| warn | `ai-rules` — Named AI bot rules in robots.txt | essential | Draft | 0 of 18 named AI bots addressed: the only 5 robots.txt rules sit in the User-agent: * group. |
| warn | `ai-policy` — AI usage policy page | essential | Adopted | AI policy at /ai covers 1 of 3 expected topics (a contact route stated; permitted uses and prohibited uses missing) and is not linked from the home page. |
| warn | `bot-page` — Crawler and agent policy page | recommended | Adopted | Bot policy at /agents covers 2 of 4 expected topics (welcomed agents and a contact route stated; refused agents and identity verification missing) and is linked from the home page. |
| fail | `security-txt` — security.txt (RFC 9116) | recommended | Adopted | No security.txt was served (/.well-known/security.txt HTTP 404, /security.txt HTTP 404). |
| fail | `crawl-delay` — Crawl rate declaration | emerging | Adopted | No Crawl-delay line in 1 robots.txt group, so no crawl rate is declared. |
| fail | `ai-txt` — /ai.txt access declaration | emerging | Draft | /ai.txt answered HTTP 404, not an access declaration. |

### Commerce Protocols

| Status | Check | Tier | Standard | Measured |
|---|---|---|---|---|
| fail | `product-schema` — Product/catalog schema | essential | Adopted | No Product, Offer or AggregateOffer type appears in the homepage JSON-LD (6 types) or in the JSON-LD of the 1 readable product or collection page. |
| fail | `payment-protocols` — Agent payment standard support (AP2/ACP/x402/UCP) | recommended | Draft | None of AP2, ACP, x402 or UCP is named on the 1 readable payment and policy pages, and no UCP manifest or agent-purchase wording was found. |
| fail | `agent-purchase` — Agent purchase policy | recommended | Draft | No page among the 5 agent policy paths carries both an agent word and a purchase word (/ai-policy HTTP 404, /agent-policy HTTP 404, /terms HTTP 404, /agentic-commerce HTTP 404, /ai HTTP 200). |
| fail | `ucp-manifest` — UCP manifest (/.well-known/ucp) | emerging | Draft | Neither /.well-known/ucp nor /.well-known/ucp.json returned HTTP 200 (/.well-known/ucp HTTP 404, /.well-known/ucp.json HTTP 404), so no manifest was served. |
| fail | `returns` — Return and shipping terms machine-readable | recommended | Adopted | No return or shipping page responded (/returns HTTP 404, /shipping HTTP 404, /refund-policy HTTP 404) and the homepage JSON-LD declares neither MerchantReturnPolicy nor OfferShippingDetails. |
| warn | `agent-analytics` — Agent traffic measurement | emerging | Draft | No analytics vendor signature among the 8 checked appears in the homepage source, so nothing about the agent channel can be attributed. |
| na | `inventory-freshness` — Inventory and price freshness | recommended | Adopted | Not scored: this check applies to ecommerce or marketplace sites; this site was measured as api. It is excluded from the denominator rather than counted as a failure. |
| na | `seller-identity` — Seller identity declared | recommended | Adopted | Not scored: this check applies to ecommerce or marketplace sites; this site was measured as api. It is excluded from the denominator rather than counted as a failure. |
| na | `shipping-costs` — Shipping cost and delivery declared | recommended | Adopted | Not scored: this check applies to ecommerce or marketplace sites; this site was measured as api. It is excluded from the denominator rather than counted as a failure. |
| na | `booking-action` — Machine-readable booking action | recommended | Draft | Not scored: this check applies to services sites; this site was measured as api. It is excluded from the denominator rather than counted as a failure. |

## Not measured

The scanner could not observe these checks. Under rubric v0.7, each one stays in the denominator at 0 points, the same as a missing check.

- `a2a-signed` — "No A2A agent card is published, so there are no signatures to inspect and the check is not scored."

## Out of scope

The scan did not ask this site for these checks. Each applies to a site profile the scan did not confirm here, or needs a commercial signal it did not detect. They left the denominator. They are not failures, and they are not requests.

- `inventory-freshness` — "Not scored: this check applies to ecommerce or marketplace sites; this site was measured as api. It is excluded from the denominator rather than counted as a failure."
- `seller-identity` — "Not scored: this check applies to ecommerce or marketplace sites; this site was measured as api. It is excluded from the denominator rather than counted as a failure."
- `shipping-costs` — "Not scored: this check applies to ecommerce or marketplace sites; this site was measured as api. It is excluded from the denominator rather than counted as a failure."
- `licensing-terms` — "Not scored: this check applies to publisher or institution sites; this site was measured as api. It is excluded from the denominator rather than counted as a failure."
- `provenance-declared` — "Not scored: this check applies to publisher or institution sites; this site was measured as api. It is excluded from the denominator rather than counted as a failure."
- `booking-action` — "Not scored: this check applies to services sites; this site was measured as api. It is excluded from the denominator rather than counted as a failure."
- `document-formats` — "Not scored: this check applies to institution sites; this site was measured as api. It is excluded from the denominator rather than counted as a failure."

---

Verify this record: https://agenticwebscore.com/verify/0787874d5c8add78c55cedb842fb2b315a02b08b9f60f43acba2c150fbcb5c2c