What 5 well-known sites serve to AI agents (October 2026)

Cloudflare and Resend reached level 5 in AgenticWebScore's scans of 20 October 2026, with scores of 88.5 and 86.3. Both give agents something to act through: Cloudflare a live MCP server with 2 tools, and Resend a documented API. Vercel, GitHub and MDN are readable, and each record names a concrete reason it goes no further. Vercel serves no OpenAPI document, GitHub's homepage carries no structured data, and MDN uses no agent convention.

The 5 scan records at a glance

All 5 records use rubric v0.9 and were made between 17:05 and 17:06 UTC on 20 October 2026, each with high confidence. Nothing was scanned again for this article. Each linked record lists every check, its evidence and the record's fingerprint.

How to read the score and the level

The score is 70% of the web-standards part plus 30% of the agent-conventions part. For GitHub that is 0.7 × 79.0 + 0.3 × 25.0 = 62.8. Web standards are adopted formats such as robots.txt, a sitemap and structured data. Agent conventions are formats agents read and search engines do not, such as /llms.txt and markdown negotiation.

The level is a set of gates, and levels are cumulative. Level 3 needs text, a title, headings and structured data in the HTML. Level 4 needs an MCP server that lists a tool, or an OpenAPI document an agent can find with documentation that answers. Level 5 adds an API catalog or an MCP server card, a published status, and any OAuth described.

Levels 4 and 5 apply only to a site where the scan saw an API or agent surface. On any other site, level 3 is the highest it can reach.

Cloudflare: 88.5, level 5, a live MCP server

The scan measured www.cloudflare.com, where cloudflare.com redirects with a 301. Its server card at /.well-known/mcp/server-card.json names https://docs.mcp.cloudflare.com/mcp. That server answered initialize with protocol version 2025-11-25, and tools/list named 2 tools: search_cloudflare_documentation and migrate_pages_to_workers_guide. The scan called neither.

The record shows 4 more surfaces for agents. An OpenAPI 3.1.0 document at /openapi.json describes 4 paths, and the homepage Link header points to it. /llms-full.txt carries 17,307 words of page text. The homepage serves markdown to an agent that asks for it, and an agent skills index lists 19 skills, each with a sha256 digest.

The record also shows 4 gaps:

• The homepage sends Cache-Control: max-age=10 and no ETag or Last-Modified, so a crawler cannot ask whether it changed.
• /.well-known/api-catalog answered 404.
• The 1 WebMCP tool on the homepage does not declare a name, a description and an input schema together.
• The only Content-Signal line sits in the Cohere-ai group, so a crawler that reads the * group sees no signal.

Resend: 86.3, level 5, a documented API

Resend has the strongest web-standards part of the 5, at 98.8, with no failed scored check in it. An OpenAPI 3.0.3 document at /openapi.yaml describes 47 paths. An API catalog at /.well-known/api-catalog points to it, and OAuth metadata at /.well-known/oauth-authorization-server names the issuer. That is what the record's usable line means by a documented API: a description an agent can find, and documentation that answers.

It also serves markdown to an agent that asks, and its JSON-LD Organization names a support email. Its * group states a Content-Signal of yes for all 3 uses. One limit is the scanner's: it reads API operations only from JSON, so it requested none of the 47 paths in the YAML file.

The record lists 4 gaps:

• The viewport sets maximum-scale=1, which stops a reader from zooming.
• /llms-full.txt is a list of links, 56 of its 92 lines, not page text.
• No AI crawler token has its own robots.txt group.
• The card at /.well-known/mcp/server-card.json names the server resend, which is not a reverse-DNS name, and has 0 remotes entries.

Resend's AI catalog lists a second card on mcp.resend.com, which the 20 October scan did not request. Since 25 October 2026, the scanner reads a card that a site lists on its own subdomain. A new scan may therefore find an MCP server here.

Vercel: 71.5, level 3, no OpenAPI document

Vercel passes 3 of the agent conventions the scan scores: /llms.txt, a Link header, and markdown negotiation. The homepage answers Accept: text/markdown with markdown and Vary: Accept, and the 8 /llms.txt links the scan sampled all answered 2xx. An agent skills index lists 9 skills with sha256 digests, and an AI catalog lists 6 complete entries. The homepage also answers a conditional request with 304.

It stops at level 3. Level 4 needs a working MCP server or an OpenAPI document, and none of the 5 OpenAPI paths the scan requested answered with OpenAPI 3.x. The scan found no MCP endpoint either. The record names the OpenAPI definition check as the gap to level 4.

Three more gaps are in the record. A path that does not exist redirects to /login and answers 200, a soft 404 that makes every missing URL read as a page. /llms-full.txt answers with a 2,479 KB HTML page, not a text file. No AI crawler token has its own group, and there is no Content-Signal line.

GitHub: 62.8, level 2, no structured data

GitHub does well on the files agents read. /llms.txt opens with an H1 and holds 117 links in 12 sections. Its robots.txt gives 6 of the 18 AI crawler tokens their own group and disallows Bytespider. The homepage carries 7,396 characters of text before any script runs, sends an ETag, and answers a conditional request with 304.

The homepage has 0 JSON-LD blocks, 0 Microdata items and 0 RDFa items. Level 3 needs structured data, so GitHub stops at level 2. The record names that check as the gap to level 3.

Other gaps hold no level. The title is 70 characters, and the first H1 shares none of its 4 words, brand names aside. /llms-full.txt is a list of links, and the homepage answers a markdown request with HTML.

The AI catalog lists an MCP server card at https://api.githubcopilot.com/mcp/server-card, on another site, which the scanner never requests. So no MCP server was measured, and the MCP server check is out of scope.

The site profile was not identified: api and saas tied at 4 points each. GitHub was scored as a general site, and checks that belong to 1 site profile were left out of scope.

MDN: 61.8, level 3, no agent convention

The scan measured developer.mozilla.org/en-US/, where the root redirects with a 302. MDN's web-standards part is 88.3. The homepage sends Cache-Control: public, max-age=3600, an ETag and a Last-Modified date, and answers a conditional request with 304. Its sitemap index lists 10 child sitemaps, and 6,265 characters of text arrive before any script.

Level 3 is MDN's ceiling. The scan saw no API or agent surface, so levels 4 and 5 are out of scope for this site.

The agent-conventions part is 0, with 0 of 5 points: /llms.txt answered 404, and the homepage answers a markdown request with HTML. All 18 AI crawler tokens fall to a * group of 3 rules, and there is no Content-Signal line. A missing path, asked for JSON, answers with an HTML page. Each of these is a convention MDN does not use, and none of them holds a level.

What the 5 sites have in common

• None answers a request for a missing path, asked for JSON, with a JSON error.
• Four of the 5 homepages answer a conditional request with 304. Cloudflare's sends no validator.
• Only Cloudflare and Resend state a Content-Signal, and only GitHub and Cloudflare name AI crawler tokens.
• Only 1 MCP server was measured: Cloudflare's.

What these records do not say

A record measures a homepage and the paths its checks ask for, from 29 requests for MDN to 89 for Cloudflare. A check asks for its own paths only when it applies to the site. It does not predict ranking or traffic, and it is a snapshot of 20 October 2026: each site may have changed since. The methodology explains how to recompute a score from its record and check the fingerprint.

What agent readiness means explains what the rubric measures and what it leaves out. To measure your own site against the same rubric, scan it.