Measuring your website's agent readiness: a framework

You Can't Improve What You Don't Measure

Most SaaS companies have no idea how their platform looks to an AI agent. They know their Lighthouse scores, their Core Web Vitals, their conversion rates. They obsess over page load time, mobile responsiveness, and SEO rankings.

But ask them "Can an AI agent sign up for your product?" and you'll get a blank stare.

Agent readiness — the degree to which your platform can be discovered, accessed, and used by AI agents — is the next critical metric for SaaS companies. It's the SEO of the agent era: invisible to most companies today, table stakes in two years.

This framework gives you a way to measure it. Five dimensions, each scored on a clear scale, with specific criteria and actionable improvements. Run the assessment, get a score, and know exactly what to fix.

The Five Dimensions of Agent Readiness

Agent readiness isn't a single metric. An agent interacting with your platform goes through a sequence of stages, and you can fail at any one of them. The five dimensions map to this sequence:

1. Discovery — Can an agent find your product and understand what it does?
2. Access — Can an agent reach your signup or onboarding flow without being blocked?
3. Authentication — Can an agent create an account and get credentials programmatically?
4. Documentation — Can an agent understand your API and capabilities?
5. Integration — Can an agent actually use your product once authenticated?

A platform scoring 90% on Discovery but 10% on Access is effectively invisible to agents — great SEO doesn't matter if the front door is locked.

Dimension 1: Discovery (0-20 points)

Discovery measures how easily an AI agent can find your product and understand its capabilities.

What to Measure

Machine-readable product description (0-5 points)

• 0: No structured data about your product
• 2: Basic meta tags and OpenGraph data
• 5: Complete schema.org markup, agent manifest at .well-known/agent-access.json, and structured product description

LLM visibility (0-5 points)

• 0: Product not mentioned in LLM responses when relevant queries are asked
• 2: Product mentioned but with incomplete or outdated information
• 5: Product accurately described by major LLMs (Claude, GPT-4, Gemini) with correct capabilities and pricing

Search and directory presence (0-5 points)

• 0: Not listed in any API directories or agent registries
• 2: Listed in 1-2 directories with basic information
• 5: Listed in major directories (AgentGate Discover, RapidAPI, ProgrammableWeb) with complete, current listings

robots.txt and crawl policy (0-5 points)

• 0: robots.txt blocks all bots, or no robots.txt exists
• 2: robots.txt allows search crawlers but blocks AI agents
• 5: robots.txt explicitly allows AI agent crawlers, with clear policies for different agent types

How to Improve Discovery

The highest-leverage improvement is publishing a .well-known/agent-access.json manifest. This single file tells agents everything they need to know about your platform in a machine-readable format. It takes 30 minutes to create and deploy.

Second priority: review your robots.txt. If you're blocking GPTBot, ClaudeBot, anthropic-ai, or CCBot, you're reducing your LLM visibility. These crawlers feed the training data and context that determines whether agents recommend your product.

Third: ensure your product is accurately described on comparison sites, documentation hubs, and developer forums. These are the sources agents draw on when evaluating options.

Dimension 2: Access (0-20 points)

Access measures whether an agent can actually reach your platform without being blocked by security measures.

What to Measure

CAPTCHA presence (0-5 points)

• 0: CAPTCHA on every form (signup, login, contact)
• 2: CAPTCHA on signup only, with alternative programmatic path available
• 5: No CAPTCHAs on agent-accessible paths, or CAPTCHA-free agent onboarding endpoint

JavaScript challenge / WAF blocking (0-5 points)

• 0: Cloudflare "Under Attack" mode or equivalent that blocks all non-browser traffic
• 2: Standard bot protection with API subdomain exemption
• 5: Agent-aware security that identifies and routes agent traffic appropriately

Programmatic access path (0-5 points)

• 0: No way to access the platform without a browser
• 2: API exists but requires browser-based setup first
• 5: Complete programmatic access path from discovery to first API call

Response to agent user-agents (0-5 points)

• 0: Requests with agent user-agents are blocked or return errors
• 2: Agent user-agents treated the same as unknown browsers
• 5: Agent user-agents recognized and routed to agent-optimized paths

How to Improve Access

The biggest wins come from creating an agent-specific endpoint that bypasses your bot detection stack. This doesn't mean reducing security — it means routing identified agent traffic to a path that uses identity verification instead of behavioral challenges.

If you're using Cloudflare, create an API subdomain with different security rules. If you have CAPTCHAs on signup, add an alternative /v1/agent/signup endpoint that uses email verification instead.

Quick test: run curl -H "User-Agent: Claude-Code/1.0" https://yoursite.com/signup and see what you get. If the response is a Cloudflare challenge page, your access score is near zero.

Dimension 3: Authentication (0-20 points)

Authentication measures how easily an agent can create an account and obtain credentials.

What to Measure

Programmatic account creation (0-5 points)

• 0: Account creation requires navigating a multi-step web wizard
• 2: API endpoint for account creation exists but requires manual steps
• 5: Complete programmatic account creation with email verification

Credential issuance (0-5 points)

• 0: API keys can only be generated through a web dashboard
• 2: API keys can be requested programmatically but require a browser-based setup step
• 5: Credentials issued programmatically immediately after account verification

Scoped permissions (0-5 points)

• 0: Only full-access credentials available
• 2: Basic scoping (read/write) available
• 5: Fine-grained capability scoping with minimum-privilege defaults

Credential management (0-5 points)

• 0: No programmatic credential management (rotation, revocation)
• 2: Programmatic revocation available
• 5: Full lifecycle management — creation, rotation, revocation, and listing via API

How to Improve Authentication

The most impactful change: add a programmatic credential issuance endpoint. When an agent creates an account, it should be able to request API keys via the same API — not by navigating to a dashboard page.

Support scoped credentials from day one. When an agent requests a key with ["read"] scope, don't give it ["read", "write", "admin"]. Minimum privilege reduces your risk surface and builds trust with security-conscious agent operators.

Dimension 4: Documentation (0-20 points)

Documentation measures how well an agent can understand your API without human interpretation.

What to Measure

OpenAPI / machine-readable spec (0-5 points)

• 0: No machine-readable API specification
• 2: Partial or outdated OpenAPI spec
• 5: Complete, current OpenAPI 3.1 spec at a predictable URL with all endpoints, schemas, and error codes

Error response quality (0-5 points)

• 0: Generic error messages ("Something went wrong")
• 2: HTTP status codes with basic error messages
• 5: Structured error responses with error code, human message, machine-parseable details, and suggested fix

Documentation accessibility (0-5 points)

• 0: Docs behind a login wall or blocked by bot detection
• 2: Docs publicly accessible but not machine-optimized (PDF, image-heavy, JavaScript-rendered)
• 5: Docs publicly accessible, fast-loading, with clean HTML structure and machine-readable formatting

Example quality (0-5 points)

• 0: No code examples
• 2: Examples in 1-2 languages
• 5: Copy-pasteable examples in 4+ languages with realistic sample data and expected responses

How to Improve Documentation

Publish an OpenAPI spec. This is the single most important thing you can do for agent documentation readiness. The spec should be at a predictable URL (/api/openapi.json or /api/v1/openapi.yaml) and should be complete — every endpoint, every parameter, every response schema.

Make your docs crawlable. If they're behind a login wall, agents can't read them. If they require JavaScript rendering, many agents will see an empty page. Plain HTML with good structure is ideal.

Fix your error responses. An agent that receives {"error": "bad request"} has no idea what to fix. An agent that receives {"error": "invalid_parameter", "parameter": "start_date", "message": "start_date must be ISO 8601 format", "example": "2026-02-19T00:00:00Z"} can fix the problem and retry immediately.

Dimension 5: Integration (0-20 points)

Integration measures how successfully an agent can use your product after authentication.

What to Measure

First API call success rate (0-5 points)

• 0: First call typically fails due to missing setup, configuration, or undocumented prerequisites
• 2: First call succeeds with manual guidance
• 5: First call succeeds with only the information provided during onboarding

SDK / library availability (0-5 points)

• 0: No official SDKs
• 2: SDKs in 1-2 languages
• 5: SDKs in 4+ languages with idiomatic design, published on standard package managers

Quickstart endpoint (0-5 points)

• 0: No quickstart guidance
• 2: Written quickstart guide on documentation site
• 5: Programmatic quickstart endpoint that returns working code examples customized to the agent's credentials

Health and status endpoints (0-5 points)

• 0: No way to verify integration health programmatically
• 2: Basic status endpoint
• 5: Rich health endpoint with account status, usage stats, and diagnostic information

How to Improve Integration

Build a quickstart endpoint. When an agent has just received credentials, a GET /v1/quickstart that returns working code examples with the agent's actual API key is incredibly powerful. The agent can immediately use these examples without any additional research.

Add a health check endpoint that returns more than "ok." Include account status, recent usage, quota remaining, and any configuration issues. This lets agents self-diagnose problems without escalating to support.

Scoring and Interpretation

Add up your scores across all five dimensions for a total out of 100:

80-100: Agent-Ready. Your platform is discoverable, accessible, and usable by AI agents. You're positioned to capture agent-driven growth. Focus on optimizing the trust and relationship layers.

60-79: Agent-Aware. You've made progress but have significant gaps. Agents can find you and might be able to use you, but the experience is inconsistent. Identify your lowest-scoring dimension and prioritize it.

40-59: Agent-Hostile. Agents struggle to interact with your platform at multiple stages. Most agent-initiated signups fail. You're losing the agent channel to competitors who score higher.

20-39: Agent-Invisible. Agents can't find you, can't access you, or both. Your platform effectively doesn't exist in the agent economy. This requires a strategic initiative, not incremental improvement.

0-19: Pre-Agent. Your platform was built before agents were a consideration, and it shows. Major architectural decisions (bot detection, auth flows, documentation) need revisiting.

Running Your Own Assessment

You can score yourself manually using the criteria above, or run an automated scan using AgentGate's benchmark tool. The automated scan tests each dimension by simulating actual agent behavior — fetching your manifest, testing your signup flow, checking your documentation accessibility, and verifying your API.

The automated scan takes under 60 seconds and produces a detailed report with:

• Overall score and per-dimension breakdown
• Specific failures and their causes
• Prioritized recommendations
• Comparison to industry benchmarks

Whether you score manually or automatically, the goal is the same: turn an invisible metric into a visible one. You can't compete for agent traffic if you don't know where you stand.

The Benchmark Is Moving

These scoring criteria will evolve. In 2025, having an OpenAPI spec was a nice-to-have. In 2026, it's table stakes. By 2027, agent manifests and programmatic onboarding will be standard expectations.

The companies that measure now and improve continuously will stay ahead of the curve. The ones that wait until agent readiness is a checkbox item on a compliance audit will be playing catch-up.

Start measuring today. The assessment takes an hour manually, or 60 seconds with a scan. Either way, you'll know exactly where you stand — and more importantly, exactly what to fix.