# What 5 well-known sites serve to AI agents (October 2026) > Scores, levels and the concrete reasons behind them for Vercel, Cloudflare, Resend, GitHub and MDN, from the scan records of 20 October 2026. - Source: /learn/five-sites-agent-readiness-october-2026 - Updated: 2026-10-25 - Reading time: 7 minutes - Tags: agent readiness, scan records, MCP, case study --- Cloudflare and Resend reached level 5 in AgenticWebScore's scans of 20 October 2026, with scores of 88.5 and 86.3. Both give agents something to act through: Cloudflare a live MCP server with 2 tools, and Resend a documented API. Vercel, GitHub and MDN are readable, and each record names a concrete reason it goes no further. Vercel serves no OpenAPI document, GitHub's homepage carries no structured data, and MDN uses no agent convention. ## The 5 scan records at a glance | Site | Score | Level | Web standards | Agent conventions | Usable by agents | | --- | --- | --- | --- | --- | --- | | [cloudflare.com](/aws/cloudflare.com) | 88.5 | 5, Agent-native | 92.4 | 79.4 | MCP server, 2 tools | | [resend.com](/aws/resend.com) | 86.3 | 5, Agent-native | 98.8 | 57.1 | Documented API | | [vercel.com](/aws/vercel.com) | 71.5 | 3, Machine-readable | 83.7 | 42.9 | None found | | [github.com](/aws/github.com) | 62.8 | 2, Crawlable | 79.0 | 25.0 | None found | | [developer.mozilla.org](/aws/developer.mozilla.org) | 61.8 | 3, Machine-readable | 88.3 | 0.0 | None found | All 5 records use rubric v0.9 and were made between 17:05 and 17:06 UTC on 20 October 2026, each with high confidence. Nothing was scanned again for this article. Each linked record lists every check, its evidence and the record's fingerprint. ## How to read the score and the level The [score](/methodology#formula) is 70% of the web-standards part plus 30% of the agent-conventions part. For GitHub that is 0.7 × 79.0 + 0.3 × 25.0 = 62.8. Web standards are adopted formats such as robots.txt, a sitemap and structured data. Agent conventions are formats agents read and search engines do not, such as `/llms.txt` and markdown negotiation. The [level](/methodology#readiness-levels) is a set of gates, and levels are cumulative. Level 3 needs text, a title, headings and structured data in the HTML. Level 4 needs an MCP server that lists a tool, or an OpenAPI document an agent can find with documentation that answers. Level 5 adds an API catalog or an MCP server card, a published status, and any OAuth described. Levels 4 and 5 apply only to a site where the scan saw an API or agent surface. On any other site, level 3 is the highest it can reach. ## Cloudflare: 88.5, level 5, a live MCP server The scan measured `www.cloudflare.com`, where `cloudflare.com` redirects with a 301. Its server card at `/.well-known/mcp/server-card.json` names `https://docs.mcp.cloudflare.com/mcp`. That server answered `initialize` with protocol version 2025-11-25, and `tools/list` named 2 tools: `search_cloudflare_documentation` and `migrate_pages_to_workers_guide`. The scan called neither. The record shows 4 more surfaces for agents. An OpenAPI 3.1.0 document at `/openapi.json` describes 4 paths, and the homepage `Link` header points to it. `/llms-full.txt` carries 17,307 words of page text. The homepage serves markdown to an agent that asks for it, and an agent skills index lists 19 skills, each with a sha256 digest. The record also shows 4 gaps: - The homepage sends `Cache-Control: max-age=10` and no `ETag` or `Last-Modified`, so a crawler cannot ask whether it changed. - `/.well-known/api-catalog` answered 404. - The 1 WebMCP tool on the homepage does not declare a name, a description and an input schema together. - The only `Content-Signal` line sits in the `Cohere-ai` group, so a crawler that reads the `*` group sees no signal. ## Resend: 86.3, level 5, a documented API Resend has the strongest web-standards part of the 5, at 98.8, with no failed scored check in it. An OpenAPI 3.0.3 document at `/openapi.yaml` describes 47 paths. An API catalog at `/.well-known/api-catalog` points to it, and OAuth metadata at `/.well-known/oauth-authorization-server` names the issuer. That is what the record's usable line means by a documented API: a description an agent can find, and documentation that answers. It also serves markdown to an agent that asks, and its JSON-LD Organization names a support email. Its `*` group states a `Content-Signal` of `yes` for all 3 uses. One limit is the scanner's: it reads API operations only from JSON, so it requested none of the 47 paths in the YAML file. The record lists 4 gaps: - The viewport sets `maximum-scale=1`, which stops a reader from zooming. - `/llms-full.txt` is a list of links, 56 of its 92 lines, not page text. - No AI crawler token has its own robots.txt group. - The card at `/.well-known/mcp/server-card.json` names the server `resend`, which is not a reverse-DNS name, and has 0 `remotes` entries. Resend's AI catalog lists a second card on `mcp.resend.com`, which the 20 October scan did not request. Since 25 October 2026, the scanner reads a card that a site lists on its own subdomain. A new scan may therefore find an MCP server here. ## Vercel: 71.5, level 3, no OpenAPI document Vercel passes 3 of the agent conventions the scan scores: `/llms.txt`, a `Link` header, and markdown negotiation. The homepage answers `Accept: text/markdown` with markdown and `Vary: Accept`, and the 8 `/llms.txt` links the scan sampled all answered 2xx. An agent skills index lists 9 skills with sha256 digests, and an AI catalog lists 6 complete entries. The homepage also answers a conditional request with 304. It stops at level 3. Level 4 needs a working MCP server or an OpenAPI document, and none of the 5 OpenAPI paths the scan requested answered with OpenAPI 3.x. The scan found no MCP endpoint either. The record names the [OpenAPI definition check](/checks/openapi) as the gap to level 4. Three more gaps are in the record. A path that does not exist redirects to `/login` and answers 200, a soft 404 that makes every missing URL read as a page. `/llms-full.txt` answers with a 2,479 KB HTML page, not a text file. No AI crawler token has its own group, and there is no `Content-Signal` line. ## GitHub: 62.8, level 2, no structured data GitHub does well on the files agents read. `/llms.txt` opens with an H1 and holds 117 links in 12 sections. Its robots.txt gives 6 of the 18 AI crawler tokens their own group and disallows Bytespider. The homepage carries 7,396 characters of text before any script runs, sends an `ETag`, and answers a conditional request with 304. The homepage has 0 JSON-LD blocks, 0 Microdata items and 0 RDFa items. Level 3 needs [structured data](/checks/jsonld), so GitHub stops at level 2. The record names that check as the gap to level 3. Other gaps hold no level. The title is 70 characters, and the first H1 shares none of its 4 words, brand names aside. `/llms-full.txt` is a list of links, and the homepage answers a markdown request with HTML. The AI catalog lists an MCP server card at `https://api.githubcopilot.com/mcp/server-card`, on another site, which the scanner never requests. So no MCP server was measured, and the MCP server check is out of scope. The site profile was not identified: `api` and `saas` tied at 4 points each. GitHub was scored as a general site, and checks that belong to 1 site profile were left out of scope. ## MDN: 61.8, level 3, no agent convention The scan measured `developer.mozilla.org/en-US/`, where the root redirects with a 302. MDN's web-standards part is 88.3. The homepage sends `Cache-Control: public, max-age=3600`, an `ETag` and a `Last-Modified` date, and answers a conditional request with 304. Its sitemap index lists 10 child sitemaps, and 6,265 characters of text arrive before any script. Level 3 is MDN's ceiling. The scan saw no API or agent surface, so levels 4 and 5 are out of scope for this site. The agent-conventions part is 0, with 0 of 5 points: `/llms.txt` answered 404, and the homepage answers a markdown request with HTML. All 18 AI crawler tokens fall to a `*` group of 3 rules, and there is no `Content-Signal` line. A missing path, asked for JSON, answers with an HTML page. Each of these is a convention MDN does not use, and none of them holds a level. ## What the 5 sites have in common - None answers a request for a missing path, asked for JSON, with a JSON error. - Four of the 5 homepages answer a conditional request with 304. Cloudflare's sends no validator. - Only Cloudflare and Resend state a `Content-Signal`, and only GitHub and Cloudflare name AI crawler tokens. - Only 1 MCP server was measured: Cloudflare's. ## What these records do not say A record measures a homepage and the paths its checks ask for, from 29 requests for MDN to 89 for Cloudflare. A check asks for its own paths only when it applies to the site. It does not predict ranking or traffic, and it is a snapshot of 20 October 2026: each site may have changed since. The [methodology](/methodology#verification) explains how to recompute a score from its record and check the fingerprint. [What agent readiness means](/learn/what-is-agent-readiness) explains what the rubric measures and what it leaves out. To measure your own site against the same rubric, [scan it](/scan).