Cloudflare Agent Readiness vs Chrome's Agentic Browsing Audit in 2026: 28 Checks, One Overlap

Verified 31 August 2026. Every score, status code and audit weight below was produced on this date by running both tools live. The Lighthouse figures come from Lighthouse 13.4.1 driving Chrome for Testing 152.0.7977.64; the Cloudflare figures come from its own public scan endpoint.

Two organisations now publish a rubric for whether a website is ready for AI agents. Cloudflare grades your site on 22 checks and hands back a level from 0 to 5. Chrome ships an Agentic Browsing category inside Lighthouse with 6 audits and hands back no score at all. Both are free, neither needs an account, and they disagree so completely that the same site can sit at the bottom of one scale and near the top of the other on the same afternoon.

That is not a bug in either tool. It is the consequence of two rubrics measuring two different webs. This article runs both against four live URLs, prints every check, and adjudicates the disagreements by hand.

Quick summary

The finding that matters most: of the 6 audits in Chrome's Agentic Browsing category, 4 carry a weight of 0, including the llms.txt audit. Only the accessibility tree and Cumulative Layout Shift affect the result, and neither is agent-specific. A page that has adopted nothing scores exactly the same as a page that has adopted everything, and the control test below proves it.

Best for a first look: Cloudflare, because it is one HTTP request and returns evidence rather than advice. Best for a browser agent audit: Lighthouse, because nothing else inspects the accessibility tree an agent actually navigates. Best for deciding what to fix: a scanner that spans both halves, which is the gap AIScan was built for and the gap this article measures honestly.

The criteria before the comparison

Ranking these tools against each other would be dishonest, because they do not attempt the same job. Judged against the questions each set out to answer, both are competent. The criteria used here are:

1. Coverage. How many distinct signals does the rubric inspect, and which layer of the stack do they sit on?
2. Discrimination. Does the output separate a prepared site from an unprepared one?
3. Evidence. Does the tool show its working, or only its verdict?
4. Reproducibility. Can a reader run the same test and get the same answer?
5. Actionability. Does a failure tell you what to change?

Every number below was produced against those criteria on 31 August 2026.

What each rubric actually checks

Cloudflare's scanner runs 22 checks in 5 groups. The list was fetched from its API response on 31 August 2026, not copied from marketing pages.

Chrome's category runs 6 audits. The IDs come from Lighthouse 13.4.1's own configuration, read out of the report JSON rather than from the documentation.

28 checks between the two rubrics, and exactly one subject in common. Cloudflare's webMcp check and Chrome's three WebMCP audits are the entire overlap. Cloudflare does not look for llms.txt at all. Chrome does not look at robots.txt, sitemaps, content negotiation, feeds or any commerce protocol. Neither one reconciles with the other, and neither says so on its own page.

The weight table is the whole story

Chrome's Agentic Browsing scoring page, last updated 2026-05-05 UTC, says verbatim that "the Agentic Browsing category does not have a weighted average score from 0 to 100" and that the report shows "a fractional score: a ratio showing how many agentic readiness checks your site passes."

Reading the weights out of the report shows what that ratio is made of. The two audits that count, the accessibility tree and Cumulative Layout Shift, both predate the agentic web by years. Every audit written for agents specifically carries a weight of 0.

The audit documentation confirms the design in its own words. The llms.txt audit page says that when the file is absent, "the audit is marked as Not Applicable (N/A), as providing the file is optional at the moment." The forms audit page says "for now, this audit is informational and does not result in any warnings." The registered tools page says "this audit is informational."

So the only audit in the category that can fail is webmcp-schema-validity, and it can only fail if you have already adopted WebMCP and made a mistake doing it. A site that has never heard of WebMCP cannot fail it.

The control test: two pages, opposite preparation, identical result

This is the part a reader can reproduce in about two minutes. Two static pages were served locally. Both carry the same heading and the same newsletter form.

Page A has no llms.txt and a plain <form> with no annotations. Page B has an llms.txt at its root, toolname and tooldescription on the form, and toolparamdescription on the input, exactly as Chrome's own example shows.

export CHROME_PATH=/path/to/chrome-152
lighthouse "http://127.0.0.1:8801/" --only-categories=agentic-browsing \
  --output=json --output-path=/tmp/a.json --quiet \
  --chrome-flags="--headless=new --no-sandbox"

Page A is told, in an informational audit worth nothing, that one form is missing annotations. Then it is given the same category score as the page that did the work. On this measure, a site that has done nothing for agents and a site that has done everything are indistinguishable.

Chrome is not hiding this. The scoring page explains that "because the standards for the agentic web are still emerging, the current focus is to gather data and provide actionable signals rather than a definitive ranking." That is a defensible position for a browser vendor holding an origin trial. It is a bad position for anyone treating the number as a grade.

Four live URLs, two rubrics, four disagreements

All eight scans below ran on 31 August 2026. Cloudflare's endpoint is open and unauthenticated, so every row is reproducible with one command.

curl -s -X POST https://isitagentready.com/api/scan \
  -H 'Content-Type: application/json' -d '{"url":"https://nextjs.org"}'

Three results deserve attention.

Chrome's own documentation site fails the agentic web it documents. developer.chrome.com sits at Cloudflare Level 1. It publishes no llms.txt, which is the file its own Lighthouse audit checks for. Fetched from https://developer.chrome.com/llms.txt on 31 August 2026, the response was 404. It also fails markdownNegotiation, contentSignals, apiCatalog, mcpServerCard, agentSkills and webMcp. The team shipping the audit has not adopted the thing the audit looks for, which is fair enough given the audit weights it at 0.

The best Markdown implementation on the public web is rated Not Ready. nextjs.org serves content-type: text/markdown; charset=utf-8 at 3,939 bytes to a request carrying Accept: text/markdown or a GPTBot user agent, against 353,849 bytes of HTML for a browser, verified on 31 August 2026. It publishes a valid llms.txt at 12,249 bytes. Cloudflare's markdownNegotiation check correctly passes it. The overall level is still 0, because the other 13 failures are protocol manifests that a documentation site has no reason to publish. Our own read of the same URL is 73 and Level 4. Both are internally consistent; they are answering different questions.

A high fail count does not mean a low level. aiscan.site fails 10 of Cloudflare's 22 checks and still returns Level 5. The level tracks what you have adopted, not the ratio you passed, which is worth knowing before anyone reports a Cloudflare level as a percentage.

Adjudicating the disagreements by hand

Two of the disagreements were checked manually against the live sites, in the same way the ten-scanner benchmark adjudicated its own. One of them found a defect in our scanner.

Markdown negotiation on developer.chrome.com: Cloudflare is right and AIScan is wrong. Cloudflare fails the check. Our C1 check passes it. Fetched by hand, Accept: text/markdown on the scoring page returns 200 text/html; charset=utf-8, and appending .md to the path also returns HTML. No Markdown is served anywhere. Our own evidence string gives the bug away: C1 recorded /index.md → 200 (text/html; charset=utf-8) and marked the check pass. C1 accepts a 200 on the .md path without requiring the response to actually be Markdown, so any site that soft-serves HTML for unknown paths false-passes. That is a false positive in production, it is ours, and it is now on the fix list next to the P3 path bug published in the benchmark above.

Commerce classification on aiscan.site: Cloudflare is wrong. Its response carries isCommerce: true with commerceSignals: ["platform:shopify", "payment:apple-pay", "schema:Offer", "meta:shopify"]. This site is not a Shopify store. The word "shopify" appears six times on the homepage because we publish a Shopify setup guide. That misclassification then converts five commerce checks from neutral to fail, which is why our fail count reads 10 while developer.chrome.com, correctly classified as non-commerce, gets those same five checks back as neutral. Both scanners in this article misidentify platforms from string matches. Ours did it to stripe.com; theirs did it to us.

Where each tool is right

Where AIScan fits, and where it doesn't

AIScan runs 21 checks and returns a 0 to 100 score plus a level, under a versioned public rubric (2026.08.2 as of 31 August 2026). It covers the server half that Chrome ignores and the content half that Cloudflare barely touches. It does not cover the browser half at all.

The honest negatives, all checkable today. Cloudflare's scanner is free with no account and unmetered, while our free tier meters at 20 scans a month. Cloudflare returns a full per-check evidence chain, including every request it made and the status it got back, and we do not. Chrome's audit runs inside a real browser, which we never do. And our C1 check false-passed a site in this very article, which is the second scanner defect of our own that this blog has published this month.

Where a WordPress reader needs the fixes rather than the diagnosis, ThinkRank handles robots.txt, robots meta, schema, sitemaps and llms.txt from one plugin, which is the answer to the familiar problem of three SEO plugins writing to the same robots.txt, and it migrates settings from Rank Math, Yoast, All in One SEO and SEOPress so adopting it costs nothing in re-entered configuration. Rank Math and Yoast both remain stronger at traditional on-page SEO workflows and content analysis, and neither writes an llms.txt. For a Shopify store, StoreSEO generates llms.txt from products, collections, pages and articles and ships an agents.md editor; it is rated 5.0 from 685 reviews on the Shopify App Store.

How this got here: a dated timeline

Run both, in this order

Start with the scan, because it is one action and covers the widest surface. Paste your URL at aiscan.site or run the CLI. No account, no card.

npx aiscan-cli yoursite.com

Read these rows first: C1 Markdown content negotiation, C2 llms.txt, C3 and E3 server-rendered HTML, B2 explicit AI bot rules, D1 robots.txt, P2 MCP endpoints and P3 Agent Skills index. Those are the checks this article's disagreements live in, and each failure comes back with a fix for your platform. The content dimension page explains what C1, C2 and C3 want. If C2 fails, the llms.txt generator will build the file for you.

Then add Cloudflare for the manifest layer, because its evidence chain tells you which path it probed and what came back:

curl -s -X POST https://isitagentready.com/api/scan \
  -H 'Content-Type: application/json' -d '{"url":"https://yoursite.com"}'

Then add Lighthouse if you have interactive pages, meaning checkout, booking, search or anything an agent would operate rather than read. You need Chrome 150 or later, which stable has satisfied since 25 August 2026:

npx lighthouse https://yoursite.com --only-categories=agentic-browsing --view

Read agent-accessibility-tree and cumulative-layout-shift as the real result. Treat the WebMCP rows as a checklist of things you could adopt, not as a grade you failed.

Note that Google's PageSpeed Insights API returned HTTP 429 RESOURCE_EXHAUSTED on this container's keyless quota on 31 August 2026, so the CLI above is the reliable route rather than the hosted one.

Common mistakes when reading either score

Reporting a Cloudflare level as a percentage. aiscan.site fails 10 of 22 checks and returns Level 5. The level is not a pass ratio.

Treating a Lighthouse category score of 1 as a pass. Four of the six audits carry weight 0, so the score is mostly telling you about your accessibility tree.

Assuming the commerce checks apply. Cloudflare returns them as neutral unless it classifies your site as commerce, and that classification runs on string matching that misfired on this site.

Reading either result as coverage of the other. Cloudflare never looks for llms.txt. Chrome never looks at robots.txt. A clean result from one says nothing about the other.

Comparing scores across rubrics. Both scales run 1 to 5 and both name the top level "Agent-Native", which invites exactly the comparison that this article's four rows show is meaningless.

Baselines worth knowing

According to Cloudflare's own measurement across the 200,000 most visited domains, published with the Agent Readiness announcement and the widest sample anyone in this category has released: 78% of sites have a robots.txt, but "the vast majority are written for traditional search engine crawlers, not AI agents"; 4% have declared AI usage preferences in robots.txt; 3.9% pass Markdown content negotiation; and fewer than 15 sites in the entire dataset carry both an MCP Server Card and an API Catalog.

Against that baseline, nextjs.org is in the top 3.9% of the web on the one check that governs whether a non-rendering crawler can read it, and Cloudflare still rates it Not Ready. That single row is the clearest argument for reading the checks rather than the level.

Which of the three to run first

Run the scan, then decide from what it returns. If C1 or C3 fail, agents are not reading your content and no manifest will fix that, which is the failure mode traced end to end in the Next.js rendering teardown. If C2 fails, the generator produces a valid file, and the evidence review explains what publishing one is realistically worth. If B2 fails, you have not told any AI crawler what it may do.

Start here: aiscan.site, or npx aiscan-cli yoursite.com. Every platform walkthrough lives at aiscan.site/guides, and the Next.js platform page collects the framework-specific ones.