Everyone has an opinion about whether the web is ready for AI agents. Nobody had measured it. So we did: 100 domains across ten sectors, 21 checks each, 2,100 individual measurements, all taken from the outside over plain HTTP exactly as an agent would see them.
The short version: no site in the sample earned an A, and none earned a B. Sixty-two were graded F, and the best score anyone reached was 15 of 21. Every single one of the hundred failed all three commerce checks. And the single most agent-specific surface on the list — a valid agent card — was published by exactly one domain out of a hundred.
This page was first published earlier today with figures produced by a version of our scanner that contained three defects. A code review found them the same day, we fixed them, re-ran the entire hundred-site sample against the corrected scanner, and replaced every number below.
What was wrong, and what it did to the results:
llms.txt, ucp,
pricing, x402 and api-catalog. This is what produced the
original “3% publish commerce surfaces” figure. The true number is zero.max-age=0, the header that switches HSTS off.The headline median is unchanged at 8 of 21. What changed is the top of the distribution — the best score falls from 17 to 15, and the one B grade disappears — and the commerce finding, which gets stronger rather than weaker. The earlier figures overstated how ready the web is. The scanner is the same one anyone can run, so the corrected numbers are reproducible today.
Scores cluster hard between 6 and 10 and then stop. The right-hand third of the scale is empty: not one site in the sample scored 16 or above, and only five reached 14. There is no established top of this market yet, which is the whole point — the bar is currently low enough to clear with a week of unglamorous work.
98% redirect HTTP to HTTPS and 76% set HSTS — the security basics have won. But only 39% publish any structured data at all, and 36% identify their own organisation in it. The web has learned to be secure and has not yet learned to be legible.
Zero of a hundred publish a machine-readable catalogue. Zero publish machine-readable pricing. Zero expose any payment challenge. This is not a rounding error or a small sample artefact — it is every site we measured. If an agent is told to compare vendors and buy, almost nothing on the public web can complete that sentence.
46% now serve one — far higher than we expected for a convention barely two years old, and higher than the 39% who manage JSON-LD. It is the fastest-adopted agent-facing surface we measured, presumably because it is a text file you can write in five minutes.
AI developer tools score best of any sector at a median of 9.5, and the frameworks selling agent infrastructure still average under 10 out of 21. Companies whose product is agents are, on average, not much more readable by agents than a mid-market SaaS.
A median of 5.5 — the lowest of all ten sectors. The corpus agents most want to read is the corpus least prepared to be read programmatically. Reference sites optimise for the human reader and stop there.
Only 11% send a correct JSON content type on their discovery documents and only 14% send CORS headers. Plenty of sites publish machine-readable files and then serve them in a way a strict client refuses to parse. These are one-line fixes producing measurable movement.
Ordered by pass rate. The top of this table is the settled web; the bottom is the part nobody has built yet. The gap between 98% and 1% is the entire opportunity.
| Check | Category | Passed |
|---|---|---|
| HTTP redirects to HTTPS | trust | 98% |
| robots.txt does not blanket-block AI agents | discovery | 76% |
| A client with no User-Agent is not blocked | access | 74% |
| HSTS is set | trust | 70% |
| Title and meta description are present and sane | content | 60% |
| /sitemap.xml is present and parses | discovery | 52% |
| /.well-known/security.txt names a contact | trust | 49% |
| Homepage answers quickly and is not enormous | access | 48% |
| /llms.txt is published | discovery | 46% |
| Homepage carries JSON-LD structured data | content | 39% |
| Baseline security headers are set | trust | 38% |
| Structured data identifies the organisation | content | 36% |
| A markdown twin of the homepage exists | content | 21% |
| Discovery documents send CORS headers | access | 14% |
| /.well-known/api-catalog is served | discovery | 11% |
| JSON documents are served as JSON | access | 11% |
| An OpenAPI description is reachable | discovery | 5% |
| /.well-known/agent-card.json is valid | discovery | 1% |
| A machine-readable catalogue is published | commerce | 0% |
| An agent payment challenge is discoverable | commerce | 0% |
| Pricing is machine-readable | commerce | 0% |
Ten sectors, ten domains each. The named site is the highest scorer in that sector — the only per-domain attribution in this report, and deliberately so. Publishing a league table of failures would be neither useful to the operators nor defensible for us.
| Sector | Median | Mean | Best in sector |
|---|---|---|---|
| AI developer tools and agent frameworks | 9.5 | 9.8 | 15 (crewai.com) |
| Developer platforms | 9.5 | 10.0 | 15 (render.com) |
| MCP ecosystem and automation | 9.0 | 9.4 | 15 (apify.com) |
| SaaS and productivity | 9.0 | 8.8 | 14 (monday.com) |
| Small-business software | 8.0 | 7.1 | 10 (typeform.com) |
| AI model and assistant providers | 7.5 | 7.1 | 9 (huggingface.co) |
| E-commerce and retail | 6.5 | 6.1 | 11 (shopify.com) |
| Cloud and infrastructure | 6.5 | 6.2 | 10 (heroku.com) |
| Documentation and reference | 5.5 | 5.6 | 9 (pypi.org) |
| News and publishing | 5.0 | 4.8 | 8 (bbc.co.uk) |
Category pass rates tell the same story more bluntly: trust 64%, machine-readable content 39%, access hygiene 37%, discovery 32%, commerce 0%.
All of it is reproducible, and we would rather you checked than believed us.
MoltlineAgentReadiness/1.0 with a link back to the tool, three domains at a time.One row per domain: sector, score, total and grade. Individual domains are not named, for the reason given above. CC BY 4.0 — use it, cite it, argue with it.
Download the dataset (CSV) Score your own domain
If you re-run part of this and get a different answer, we would like to know: support@moltlinestudio.com. Corrections get published.
If you run one of the ninety-five sites that scored under 14, the encouraging part is that the cheapest fixes are also the highest-scoring ones.
Write an llms.txt. Add
Content-Type: application/json and Access-Control-Allow-Origin: * to
whatever machine-readable files you already serve. Add nosniff and a
Referrer-Policy. That is four points for four configuration lines and one text
file.
Publish JSON-LD that names your organisation, serve an OpenAPI description, add an agent card and an api-catalog, and offer a markdown twin of your key pages. This is where the sample thins out fast — and therefore where the differentiation is.
Machine-readable catalogue, machine-readable pricing, a payment challenge. None of the hundred sites we measured has any of this. Whatever you think of agent commerce, being reachable by it costs very little today and cannot be retrofitted quickly once it matters.
We documented every undocumented shape we hit taking our own domain to 21 of 21, so most of this is copyable. If you would rather it were simply done, that is the audit and implementation service.