Cloudflare launched an agent readiness score in April 2026. It scores 12 checks across 4 dimensions: discoverability, content, bot access control and capabilities. Faro's AI visibility scan runs 54 checks. Before you read this as a vendor comparison, look at what the gap means, because it changes how you decide what to fix on your site.
Cloudflare sits in front of a large share of the web, so when it ships something for AI agents, it gets attention, and it should. Its score is a good test of whether agents can reach your site, read it in a format they prefer and find the files they need to take action. What it does not grade is what agents conclude once they read your pages: whether your pricing is clear, whether your facts are corroborated and whether your content answers the questions buyers ask. That second problem is the one most businesses have when they discover that ChatGPT, Claude, and Perplexity cannot find or recommend them.
Key takeaways
- Cloudflare's agent readiness score, launched in April 2026, scores 12 checks across 4 dimensions: discoverability, content, bot access control and capabilities.
- Access comes first: if your robots.txt or firewall blocks AI crawlers, nothing else on your site gets read.
- The two overlap on access and the action layer: both look at robots.txt rules for AI bots, sitemaps, MCP Server Cards and OAuth discovery.
- Faro's AI visibility scan runs 54 checks across 7 categories and adds what Cloudflare leaves out: pricing transparency, structured data, trust pages and grounding quality.
- 67% of the 2,543 sites in the Faro Registry have no sameAs links, the structured data that lets an agent confirm who you are.
- Use both: confirm access with Cloudflare's score, then audit signal quality with Faro.
What does Cloudflare's agent readiness score check?
Cloudflare's agent readiness score checks whether agents can find, read and use your site: robots.txt, sitemap.xml, Link headers, Markdown negotiation, AI bot rules, Content Signals, Web Bot Auth, and capability checks such as an MCP Server Card and OAuth discovery. It reports x402 support but does not score it. These are real, necessary checks. If you're blocking GPTBot or ClaudeBot in robots.txt, those crawlers cannot read your site at all, so nothing else you publish reaches them.
| Dimension | What Cloudflare checks |
|---|---|
| Discoverability | robots.txt, sitemap.xml, Link headers |
| Content | Markdown for agents (serving a Markdown version when an agent asks for one) |
| Bot access control | Content Signals, AI bot rules in robots.txt, Web Bot Auth |
| Capabilities | Agent Skills, API Catalog, OAuth discovery, MCP Server Card, WebMCP |
| Reported, not scored | x402 and other agentic commerce standards |
Source: Cloudflare's agent readiness announcement, April 17, 2026. llms.txt is only checked if you customize the scan.
Most of these checks ask whether a file, header or rule exists and is set up correctly. That makes the score a fast test of your technical plumbing, and plumbing is the first thing to fix. It is not the whole picture, because none of the 12 checks grades the content an agent reads once it gets in. Our explainer on what AI visibility actually means covers why access alone isn't the finish line.
What happens after an AI agent gets into your site?
An AI agent that can access your site then has to understand it. That's a different problem entirely. It reads your pricing page and needs to find structured, machine-readable pricing, not a design-heavy page with slider widgets and modal comparisons. It might read your llms.txt file, though agents mostly fetch one only when a page links to it. It looks for JSON-LD structured data to confirm basic facts about your business. It checks whether you have an OpenAPI spec, an MCP server, or OAuth documentation if it's trying to take an action rather than just read about you.
Cloudflare's score covers part of this action layer: it looks for an MCP Server Card, an API catalog and OAuth discovery. What it does not grade is the content: whether your pricing is readable without clicks, whether your structured data confirms basic facts about your business and whether trust pages exist. That is a choice of scope, not a flaw.
What are the 7 categories Faro checks?
Faro's AI visibility scan runs 54 checks across seven categories. Here's how each one maps to what an AI agent actually needs:
| Category | What it checks | Cloudflare covers? |
|---|---|---|
| Agent Permissions | robots.txt AI stanzas, GPTBot, ClaudeBot, Gemini, Content-Signal header | Yes: AI bot rules, Content Signals |
| Content Discoverability | Sitemap, llms.txt, link headers, canonical tags | Partial: sitemap, Link headers |
| Structured Data | JSON-LD, sameAs, OKF bundle, Open Graph | No |
| Pricing Transparency | Machine-readable pricing, visible plans, /pricing link in nav | No |
| Agent Infrastructure | MCP endpoint, A2A, OpenAPI, Auth.md, OAuth, agents.json, x402 | Partial: MCP card, API catalog, OAuth |
| Trust & Identity | Contact page, About page, Privacy policy, Terms of service | No |
| Grounding Quality | llms.txt content depth, OKF completeness, structured data accuracy | No |
Based on Faro's 54-check audit engine vs. Cloudflare's public agent readiness score documentation.
The Pricing Transparency Problem Is Bigger Than You Think
Pricing transparency is one of the checks that most surprises people when they see it in a Faro audit. It seems obvious: if you sell software, put your pricing on your website. But the version of that check relevant to AI agents is more specific.
An AI agent evaluating whether to recommend your product needs to answer the question: "How much does this cost, and is there a plan that fits the buyer's budget?" If your pricing page uses a JavaScript-rendered toggle between monthly and annual, requires a modal click to see enterprise pricing, or buries the per-seat cost in the FAQ, the agent cannot answer that question reliably. It will either skip your product or return an inaccurate price.
Faro's pricing transparency check looks for machine-readable pricing (in llms.txt, in pricing.md, or in structured data), a direct link to your pricing page from the main navigation, and visible plan names with associated prices. This is the kind of check that directly affects whether an AI agent recommending software to a buyer includes your product in the comparison set.
Structured Data: The Signal Most Sites Get Wrong
Structured data is not a new concept. Schema.org has defined markup standards for organizations, products, pricing, and articles for over a decade. Google has supported JSON-LD for nearly as long. But most sites still get it wrong in ways that specifically matter for AI agents.
Missing sameAs links are one of the most common gaps: 67% of the 2,543 sites in the Faro Registry (scanned August to October 2026) have none. A well-structured organization schema includes links to your LinkedIn page, Twitter/X profile, GitHub repository, and Crunchbase entry. These sameAs links let an AI agent cross-reference multiple sources to confirm that what it found on your site is accurate. Without them, the agent has only one source for your claims: your own website, which carries less evidentiary weight than corroborated sources. Faro's AI schema tool generates this markup, sameAs links included, in a couple of minutes.
Beyond basic JSON-LD, Faro checks for the Open Knowledge Format (OKF) bundle, a structured directory at /okf/ that organizes machine-readable versions of your pricing, team, products, and API documentation in a format purpose-built for LLM consumption. Only 9% of the sites in the Faro Registry publish one so far.
MCP and the Action Layer
The Model Context Protocol (MCP), published by Anthropic and since adopted well beyond Claude, defines how AI agents can take actions on your behalf. An agent with MCP access can query your product catalog, check pricing, start a trial, or retrieve account information without a human clicking through your website. Faro's guide to agent commerce readiness goes deeper into what it actually takes for an agent to complete that kind of transaction end to end, not just read about it.
Cloudflare checks for an MCP Server Card, an API catalog and OAuth discovery, and reports x402 support without counting it toward the score. Faro checks four states: MCP card and live endpoint both present, card only (declared but not active), endpoint only (active but not declared), and neither. The distinction matters because an agent that finds a card pointing to a non-functional endpoint fails silently, and the agent moves on to your competitor.
Faro's own scans point the same way: of the 2,543 sites in the Faro Registry with a result for this check (scanned August 2026 to October 2026), 13% have an MCP server. The registry is the set of sites Faro has scanned, not a random sample of the web. That gap represents a significant near-term competitive opportunity for the businesses that move first.
How should you use Cloudflare's score and Faro together?
The right approach is not either/or. Start with Cloudflare's agent readiness check to confirm the infrastructure layer is sound. If you're blocking AI crawlers, check your setup with Faro's robots.txt tool and fix that first, because nothing else matters until agents can access your site. Then run a Faro audit to understand what those agents find once they get in.
The sequence is: access and plumbing first, then content. Cloudflare's score is a quick test of the plumbing and overlaps with Faro on robots.txt rules, sitemaps and the action-layer files. Faro adds the pricing, structured data and trust checks Cloudflare leaves out. A business that only passes the Cloudflare check but fails the structured data and pricing transparency checks is in the same position as a shop that unlocks the front door but leaves the shelves empty.
In Short
Cloudflare's agent readiness score is a solid test of whether AI agents can reach your site and find the files they need to take action. It scores 12 checks and overlaps with Faro on access and the action layer. It does not grade your pricing, structured data or trust pages, which shape what an agent concludes about you. The two tools overlap but answer different questions, and neither replaces the other.
Scan your site at byfaro.ai to see your full score across all 54 checks. Results in 30 seconds, no account required.
FAQ
Does Cloudflare's agent readiness score replace Faro?
No. Cloudflare's score checks whether agents can reach your site and whether you publish the files and headers they use, such as an MCP Server Card or OAuth discovery. Faro covers most of the same signals plus pricing, structured data and trust pages, which decide what an agent concludes once it reads your pages.
What are the most important checks for AI agent visibility?
Start with AI crawler permissions in robots.txt, because a crawler you block reads nothing. After that, look at machine-readable pricing, JSON-LD structured data with sameAs links, and an MCP server or OpenAPI spec if you want agents to take actions. An llms.txt file is a cheap hedge, not a ranking factor.
How does Cloudflare's AI bot management affect agent readiness?
Cloudflare's AI bot management lets you control which AI crawlers can access your site. If you use it to block GPTBot or ClaudeBot, those agents cannot index your site. If you allow them, Cloudflare's role in agent readiness ends there; the quality of what they find is entirely determined by your content, structured data, and documentation.
What is an OKF bundle?
The Open Knowledge Format is a structured directory at /okf/ on your site that provides machine-readable versions of your pricing, team, products, and API documentation in a format designed for LLM consumption. Use Faro's OKF Generator to build one in minutes.