Public methodology · editorial review August 30, 2026
How the AgentReady score works—and where it stops
AgentReady is a best-effort diagnostic, not a certification, security audit, accessibility conformance determination, search-indexing guarantee, or universal measure of whether every agent can use a site.
Six evidence-gathering phases
The public URL scan gathers observations in six phases. The previous phase score was normalized to 100; it remains in metadata.readiness.legacyScore as an auditable migration reference. Phase totals still appear in the report as evidence, but they no longer determine the headline score.
Protocol Files
20 pointsrobots.txt, sitemap, emerging agent files, OpenAPI discovery, redirects, and response truth.
DOM & Accessibility
20 pointslandmarks, headings, labels, native semantics, accessible names, forms, and automation hints when browser evidence is available.
Content Intelligence
15 pointsstructured data, useful content structure, dates, schema validity, and form-information signals.
Browser Agent Compatibility
20 pointsserver/no-JavaScript content, navigation and CTA findability, stability, console behavior, and optional browser evidence.
Security & Safety
15 pointspublic security headers, secret-exposure patterns, bot handling, consequence hints, and guardrail signals.
Legal & Trust
5 pointssubstantive public privacy and terms pages, validated content, and links that make both policies discoverable from the homepage.
The 34-check applicability-aware score
The 2026-08-23-v2 model emits 34 stable check records. Essential checks contribute 80 points, recommended checks contribute 20, and positive bonus signals can add up to 5 points without taking the headline above 100.
Each check has one of five distinct states: pass, partial, fail, not applicable, or unobservable. Not-applicable checks are excluded from score and coverage denominators. Unobservable checks do not reduce the target score, but they do lower the separate coverage percentage. A high score with low coverage is incomplete evidence, not proof of readiness.
Optional surfaces such as an API, authentication, MCP, and commerce are classified as observed, advertised, suspected, or absent. Only positive observed evidence activates scoring; marketing text alone stays suspected and unscored.
The applicability-aware score is the public headline. The prior phase-normalized score remains available only for migration comparisons; compare two reports only when their methodology version and observation coverage match.
Observation methods and missing evidence
Direct fetches inspect public protocol files, headers, redirect behavior, and HTML. When configured and available, a Playwright browser pass adds rendered DOM, accessibility heuristics, discoverability, console, form, click-target, and no-JavaScript observations. Optional GitHub access examines only the connected repository signals permitted by the approved integration. Public scan results may be retained as a read-only report history for the scanned URL.
Some checks are conditional on browser or repository evidence. Network errors, bot protection, authentication, geographic behavior, JavaScript failures, rate limits, and provider availability can produce missing or partial observations. A recommendation should be confirmed against the returned evidence and the live product before implementation.
The scan uses heuristics for many UI and security signals. Legal & Trust verifies that substantive public policy pages exist and are discoverable; it does not judge whether those policies are legally sufficient. The score does not prove WCAG conformance, vulnerability absence, correct authorization, legal compliance, API correctness, or successful completion by every model and browser tool.
Enhanced-browser safety boundary
The optional enhanced pass opens a fresh anonymous browser context with an AgentReady user agent. A public scan does not receive credentials for the target site or operate accounts in Grok Bot, Claude, ChatGPT Work, Gemini, or another provider harness. Signing in to the AgentReady dashboard stores AgentReady reports and fixes; it does not grant the scanner access to the scanned site's private product.
The runner performs bounded public observations: navigation and CTA findability, contact or documentation discovery, and synthetic values in a selected non-password form without clicking its submit control. A multi-step checkout or cart navigation attempt runs only when the page or hostname declares or strongly suggests a sandbox, and it stops after navigating to the checkout or cart entry page rather than adding an item or completing checkout.
The browser route intercept aborts observed network requests whose method is not GET or HEAD. This reduces risk but is not a universal no-side-effect guarantee: a misimplemented server can change state on GET, browser behavior can differ from the observed request, and a third-party surface can change after review. AgentReady therefore reports these scenarios as bounded prerequisite evidence, not authentication, purchase, booking, lead-submission, or end-to-end journey proof.
What a Fix Pack proves
A Fix Pack converts observed findings into a machine-readable implementation contract with stable finding IDs, evidence, candidate URLs or repository paths, review gates, and fix-specific acceptance assertions. Candidate paths remain suggestions until repository evidence resolves the exact target; the public scanner does not claim it inspected private source code that was not connected.
Verification re-runs the public scan and closes a fix when its stable finding ID is absent and the applicable live assertion passes. A score change is secondary evidence. This verifies the observed condition on the deployed public surface; it does not independently prove search indexing, provider enrollment, private authorization, or completion of a consequential customer journey.
Benchmark limitations
No public benchmark dataset exists today. AgentReady does not currently publish framework rankings, market averages, percentile claims, or pass-rate comparisons. A future benchmark would require a versioned scoring rule, collection window, inclusion criteria, sample size, missing-data treatment, framework and site-type slices, privacy controls, correction route, and explicit limitations before any comparison is presented.
Individual scores can change when the site, scanner, browser availability, or scoring rules change. Compare before and after results only when the task, environment, and methodology version are recorded.
The Agentic Customer Journey Index is independent editorial research, not the verified benchmark. Its company profiles publish task contracts, timestamps, coverage, observable evidence, strengths, gaps, and corrections without publishing an unconsented numeric ranking. Verified participant status and company-specific before-and-after claims remain owner-approved.
How to use a result responsibly
- Save the scan date, URL, phase evidence, and scanner behavior.
- Reproduce important findings with official specifications and repository or browser tests.
- Prioritize unsafe consequence, exposed secrets, blocked core tasks, accessibility, and crawl truth before optional conventions.
- Write a failing test for deterministic behavior, implement the fix, and rerun the same task.
- Repeat the production check after deployment; local green does not prove production state.