---
title: "Cloudflare Agent Readiness vs Chrome's Agentic Browsing Audit in 2026: 28 Checks, One Overlap"
slug: cloudflare-agent-readiness-vs-lighthouse-agentic-browsing
published: 2026-08-31T03:24:57.504297+00:00
updated: 2026-08-31T03:24:57.504297+00:00
author: "Asif Rahman"
author_url: https://masifrahman.com
category: "AI Readiness"
tags: AI readiness, agent readiness score, Lighthouse, Cloudflare, WebMCP, llms.txt, check:C1, check:C2, check:P2, check:P3, check:B2, check:D1, platform:nextjs
description: "Cloudflare grades your site on 22 agent readiness checks. Chrome Lighthouse runs 6 agentic audits and weights 4 at zero. Both run live here on four URLs."
url: https://aiscan.site/blog/cloudflare-agent-readiness-vs-lighthouse-agentic-browsing
---

**Verified 31 August 2026.** Every score, status code and audit weight below was produced on this date by running both tools live. The Lighthouse figures come from Lighthouse 13.4.1 driving Chrome for Testing 152.0.7977.64; the Cloudflare figures come from its own public scan endpoint.

Two organisations now publish a rubric for whether a website is ready for AI agents. Cloudflare grades your site on 22 checks and hands back a level from 0 to 5. Chrome ships an Agentic Browsing category inside Lighthouse with 6 audits and hands back no score at all. Both are free, neither needs an account, and they disagree so completely that the same site can sit at the bottom of one scale and near the top of the other on the same afternoon.

That is not a bug in either tool. It is the consequence of two rubrics measuring two different webs. This article runs both against four live URLs, prints every check, and adjudicates the disagreements by hand.

## Quick summary

| If you want to know | Run this | What it answers | What it cannot answer |
|---|---|---|---|
| Whether agents can reach and read your site | [AIScan](https://aiscan.site/), `npx aiscan-cli yoursite.com` | 21 checks across discoverability, content, bot access, capabilities and commerce, with a 0 to 100 score and a platform-specific fix for each failure | Whether a browser agent can click your buttons |
| Whether you publish the agent protocol manifests | Cloudflare, `isitagentready.com` | 22 protocol and infrastructure checks with the full request evidence chain for each one | Anything about page quality, llms.txt or readable content |
| Whether a browser agent can operate your page | Chrome, Lighthouse `agentic-browsing` category | Accessibility tree integrity, layout stability, and whether you have adopted WebMCP | Anything a server returns: robots.txt, sitemaps, feeds, content negotiation |

**The finding that matters most:** of the 6 audits in Chrome's Agentic Browsing category, **4 carry a weight of 0**, including the llms.txt audit. Only the accessibility tree and Cumulative Layout Shift affect the result, and neither is agent-specific. A page that has adopted nothing scores exactly the same as a page that has adopted everything, and the control test below proves it.

**Best for a first look:** Cloudflare, because it is one HTTP request and returns evidence rather than advice.
**Best for a browser agent audit:** Lighthouse, because nothing else inspects the accessibility tree an agent actually navigates.
**Best for deciding what to fix:** a scanner that spans both halves, which is the gap AIScan was built for and the gap this article measures honestly.

## The criteria before the comparison

Ranking these tools against each other would be dishonest, because they do not attempt the same job. Judged against the questions each set out to answer, both are competent. The criteria used here are:

1. **Coverage.** How many distinct signals does the rubric inspect, and which layer of the stack do they sit on?
2. **Discrimination.** Does the output separate a prepared site from an unprepared one?
3. **Evidence.** Does the tool show its working, or only its verdict?
4. **Reproducibility.** Can a reader run the same test and get the same answer?
5. **Actionability.** Does a failure tell you what to change?

Every number below was produced against those criteria on 31 August 2026.

## What each rubric actually checks

Cloudflare's scanner runs 22 checks in 5 groups. The list was fetched from its API response on 31 August 2026, not copied from marketing pages.

| Group | Checks |
|---|---|
| Discoverability | `robotsTxt`, `sitemap`, `linkHeaders`, `dnsAid` |
| Content accessibility | `markdownNegotiation` |
| Bot access control | `robotsTxtAiRules`, `contentSignals`, `webBotAuth` |
| Discovery | `apiCatalog`, `oauthDiscovery`, `oauthProtectedResource`, `authMd`, `mcpServerCard`, `a2aAgentCard`, `agentSkills`, `webMcp`, `ard` |
| Commerce | `x402`, `mpp`, `ucp`, `acp`, `ap2` |

Chrome's category runs 6 audits. The IDs come from Lighthouse 13.4.1's own configuration, read out of the report JSON rather than from the documentation.

| Audit ID | What it inspects | Weight |
|---|---|---|
| `agent-accessibility-tree` | Names, labels, roles and parent-child integrity in the accessibility tree | **1** |
| `cumulative-layout-shift` | Movement of visible elements, because agents interact by position | **1** |
| `webmcp-registered-tools` | WebMCP tools registered via the Declarative or Imperative API | 0 |
| `webmcp-form-coverage` | Forms lacking `toolname` and `tooldescription` | 0 |
| `webmcp-schema-validity` | Symmetry of `toolname` and `tooldescription`, and `name` on required fields | 0 |
| `llms-txt` | Presence of a machine-readable summary at the domain root | 0 |

![Cloudflare's 22 agent readiness checks listed beside Chrome's 6 Lighthouse agentic browsing audits, with the WebMCP checks highlighted as the only shared subject and the audit weights marked](https://gqdxuwsuuasfjeeqafyq.supabase.co/storage/v1/object/public/blog-covers/cloudflare-vs-lighthouse-checks.jpg)

**28 checks between the two rubrics, and exactly one subject in common.** Cloudflare's `webMcp` check and Chrome's three WebMCP audits are the entire overlap. Cloudflare does not look for llms.txt at all. Chrome does not look at robots.txt, sitemaps, content negotiation, feeds or any commerce protocol. Neither one reconciles with the other, and neither says so on its own page.

## The weight table is the whole story

Chrome's [Agentic Browsing scoring page](https://developer.chrome.com/docs/lighthouse/agentic-browsing/scoring), last updated 2026-05-05 UTC, says verbatim that "the Agentic Browsing category does not have a weighted average score from 0 to 100" and that the report shows "a fractional score: a ratio showing how many agentic readiness checks your site passes."

Reading the weights out of the report shows what that ratio is made of. The two audits that count, the accessibility tree and Cumulative Layout Shift, both predate the agentic web by years. Every audit written for agents specifically carries a weight of 0.

The audit documentation confirms the design in its own words. The [llms.txt audit page](https://developer.chrome.com/docs/lighthouse/agentic-browsing/llms-txt) says that when the file is absent, "the audit is marked as Not Applicable (N/A), as providing the file is optional at the moment." The [forms audit page](https://developer.chrome.com/docs/lighthouse/agentic-browsing/forms-missing-declarative-webmcp) says "for now, this audit is informational and does not result in any warnings." The [registered tools page](https://developer.chrome.com/docs/lighthouse/agentic-browsing/registered-webmcp-tools) says "this audit is informational."

So the only audit in the category that can fail is `webmcp-schema-validity`, and it can only fail if you have already adopted WebMCP and made a mistake doing it. A site that has never heard of WebMCP cannot fail it.

## The control test: two pages, opposite preparation, identical result

This is the part a reader can reproduce in about two minutes. Two static pages were served locally. Both carry the same heading and the same newsletter form.

**Page A** has no llms.txt and a plain `<form>` with no annotations.
**Page B** has an llms.txt at its root, `toolname` and `tooldescription` on the form, and `toolparamdescription` on the input, exactly as Chrome's own example shows.

```bash
export CHROME_PATH=/path/to/chrome-152
lighthouse "http://127.0.0.1:8801/" --only-categories=agentic-browsing \
  --output=json --output-path=/tmp/a.json --quiet \
  --chrome-flags="--headless=new --no-sandbox"
```

| Audit | Page A (nothing adopted) | Page B (everything adopted) |
|---|---|---|
| `agent-accessibility-tree` | score 1, binary | score 1, binary |
| `webmcp-form-coverage` | score 1, informative, "1 form missing annotations" | notApplicable |
| `webmcp-registered-tools` | score 1, informative | score 1, informative |
| `webmcp-schema-validity` | notApplicable | score 1, binary |
| `cumulative-layout-shift` | score 1, numeric, 0 | score 1, numeric, 0 |
| `llms-txt` | notApplicable | score 1, binary |
| **Category score** | **1** | **1** |

Page A is told, in an informational audit worth nothing, that one form is missing annotations. Then it is given the same category score as the page that did the work. On this measure, a site that has done nothing for agents and a site that has done everything are indistinguishable.

Chrome is not hiding this. The scoring page explains that "because the standards for the agentic web are still emerging, the current focus is to gather data and provide actionable signals rather than a definitive ranking." That is a defensible position for a browser vendor holding an origin trial. It is a bad position for anyone treating the number as a grade.

## Four live URLs, two rubrics, four disagreements

All eight scans below ran on 31 August 2026. Cloudflare's endpoint is open and unauthenticated, so every row is reproducible with one command.

```bash
curl -s -X POST https://isitagentready.com/api/scan \
  -H 'Content-Type: application/json' -d '{"url":"https://nextjs.org"}'
```

| URL | Cloudflare level | Cloudflare pass / fail / neutral | AIScan score and level | Gap |
|---|---|---|---|---|
| `aiscan.site` | 5, Agent-Native | 11 / 10 / 1 | 100, Level 5 Agent-Native | none |
| `developer.chrome.com` | 1, Basic Web Presence | 3 / 13 / 6 | 73, Level 4 Interactive | 3 levels |
| `nextjs.org` | **0, Not Ready** | 3 / 13 / 6 | 73, Level 4 Interactive | 4 levels |
| `stripe.com` | 1, Basic Web Presence | 4 / 17 / 1 | 41, Level 2 Readable | 1 level |

Three results deserve attention.

**Chrome's own documentation site fails the agentic web it documents.** `developer.chrome.com` sits at Cloudflare Level 1. It publishes no llms.txt, which is the file its own Lighthouse audit checks for. Fetched from `https://developer.chrome.com/llms.txt` on 31 August 2026, the response was **404**. It also fails `markdownNegotiation`, `contentSignals`, `apiCatalog`, `mcpServerCard`, `agentSkills` and `webMcp`. The team shipping the audit has not adopted the thing the audit looks for, which is fair enough given the audit weights it at 0.

**The best Markdown implementation on the public web is rated Not Ready.** `nextjs.org` serves `content-type: text/markdown; charset=utf-8` at 3,939 bytes to a request carrying `Accept: text/markdown` or a GPTBot user agent, against 353,849 bytes of HTML for a browser, verified on 31 August 2026. It publishes a valid llms.txt at 12,249 bytes. Cloudflare's `markdownNegotiation` check correctly passes it. The overall level is still 0, because the other 13 failures are protocol manifests that a documentation site has no reason to publish. Our own read of the same URL is 73 and Level 4. Both are internally consistent; they are answering different questions.

**A high fail count does not mean a low level.** `aiscan.site` fails 10 of Cloudflare's 22 checks and still returns Level 5. The level tracks what you have adopted, not the ratio you passed, which is worth knowing before anyone reports a Cloudflare level as a percentage.

## Adjudicating the disagreements by hand

Two of the disagreements were checked manually against the live sites, in the same way the [ten-scanner benchmark](https://aiscan.site/blog/best-ai-agent-readiness-scanners-2026) adjudicated its own. One of them found a defect in our scanner.

**Markdown negotiation on `developer.chrome.com`: Cloudflare is right and AIScan is wrong.** Cloudflare fails the check. Our C1 check passes it. Fetched by hand, `Accept: text/markdown` on the scoring page returns `200 text/html; charset=utf-8`, and appending `.md` to the path also returns HTML. No Markdown is served anywhere. Our own evidence string gives the bug away: C1 recorded `/index.md → 200 (text/html; charset=utf-8)` and marked the check **pass**. C1 accepts a 200 on the `.md` path without requiring the response to actually be Markdown, so any site that soft-serves HTML for unknown paths false-passes. That is a false positive in production, it is ours, and it is now on the fix list next to the P3 path bug published in the benchmark above.

**Commerce classification on `aiscan.site`: Cloudflare is wrong.** Its response carries `isCommerce: true` with `commerceSignals: ["platform:shopify", "payment:apple-pay", "schema:Offer", "meta:shopify"]`. This site is not a Shopify store. The word "shopify" appears six times on the homepage because we publish [a Shopify setup guide](https://aiscan.site/blog/ai-readiness-setup-shopify). That misclassification then converts five commerce checks from `neutral` to `fail`, which is why our fail count reads 10 while `developer.chrome.com`, correctly classified as non-commerce, gets those same five checks back as neutral. Both scanners in this article misidentify platforms from string matches. Ours did it to `stripe.com`; theirs did it to us.

## Where each tool is right

| Question you actually have | Best tool | Why |
|---|---|---|
| Can a retrieval crawler read my content at all? | AIScan (C1, C3, E3) | Cloudflare has one content check and Chrome has none that inspect server HTML |
| Do I publish the agent manifests? | Cloudflare | 11 of its 22 checks are manifests and it returns the fetch evidence for each |
| Can a browser agent click my buttons? | Lighthouse | Nothing else inspects the accessibility tree or layout stability |
| Have I declared my AI bot preferences? | AIScan (B2) or Cloudflare (`robotsTxtAiRules`) | They disagree by design, covered in the benchmark linked above |
| What do I change on my CMS to fix it? | AIScan | Neither of the others returns a platform-specific remediation |

## Where AIScan fits, and where it doesn't

AIScan runs 21 checks and returns a 0 to 100 score plus a level, under a versioned public rubric (`2026.08.2` as of 31 August 2026). It covers the server half that Chrome ignores and the content half that Cloudflare barely touches. It does not cover the browser half at all.

| What AIScan sees | What AIScan cannot see |
|---|---|
| Markdown negotiation (C1), llms.txt (C2), server-rendered HTML (C3, E3) | The accessibility tree an agent navigates |
| Explicit AI bot rules in robots.txt (B2), sitemaps and feeds (D1, D2, E5) | Cumulative Layout Shift and element movement |
| MCP server cards and Agent Skills indexes (P2, P3) | WebMCP tools registered at runtime by JavaScript |
| Commerce protocol discovery (M1, M3, M4) | Whether an agent can complete a task end to end |

The honest negatives, all checkable today. Cloudflare's scanner is free with no account and unmetered, while our free tier meters at 20 scans a month. Cloudflare returns a full per-check evidence chain, including every request it made and the status it got back, and we do not. Chrome's audit runs inside a real browser, which we never do. And our C1 check false-passed a site in this very article, which is the second scanner defect of our own that this blog has published this month.

Where a WordPress reader needs the fixes rather than the diagnosis, [ThinkRank](https://thinkrank.ai) handles robots.txt, robots meta, schema, sitemaps and llms.txt from one plugin, which is the answer to the familiar problem of three SEO plugins writing to the same robots.txt, and it migrates settings from Rank Math, Yoast, All in One SEO and SEOPress so adopting it costs nothing in re-entered configuration. Rank Math and Yoast both remain stronger at traditional on-page SEO workflows and content analysis, and neither writes an llms.txt. For a Shopify store, [StoreSEO](https://storeseo.com/) generates llms.txt from products, collections, pages and articles and ships an agents.md editor; it is rated 5.0 from 685 reviews on [the Shopify App Store](https://apps.shopify.com/storeseo).

## How this got here: a dated timeline

| Date | What happened | Why it matters |
|---|---|---|
| 17 Apr 2026 | Cloudflare publishes the Agent Readiness score and `isitagentready.com` ([announcement](https://blog.cloudflare.com/agent-readiness/)) | First public rubric, built on Cloudflare's own protocol priorities |
| 2026-05-05 | Chrome's agentic browsing audit pages last updated, according to each page's own footer | Five of the six audit pages have not moved since |
| 2026-07-01 | The registered WebMCP tools page last updated | The only audit page revised after May |
| 10 Aug 2026 | [llms.txt](https://llmstxt.org/) v2 published, according to the spec page's own `modified` field | Adds `rel="describedby"` and Markdown link relations that neither rubric checks |
| 25 Aug 2026 | Chrome 152 reaches stable, according to the [Chromium dashboard](https://chromiumdash.appspot.com/releases?platform=Linux) | Clears the "Chrome 150 or later" requirement for running the category |
| 28 Aug 2026 | Cloudflare's [BotBase](https://blog.cloudflare.com/botbase-for-operators/) begins validating Web Bot Auth signatures during operator onboarding | The protocol half of Cloudflare's rubric is what Cloudflare itself is investing in |

## Run both, in this order

**Start with the scan, because it is one action and covers the widest surface.** Paste your URL at [aiscan.site](https://aiscan.site/) or run the CLI. No account, no card.

```bash
npx aiscan-cli yoursite.com
```

Read these rows first: **C1** Markdown content negotiation, **C2** llms.txt, **C3** and **E3** server-rendered HTML, **B2** explicit AI bot rules, **D1** robots.txt, **P2** MCP endpoints and **P3** Agent Skills index. Those are the checks this article's disagreements live in, and each failure comes back with a fix for your platform. The [content dimension page](https://aiscan.site/docs/checks/content) explains what C1, C2 and C3 want. If C2 fails, the [llms.txt generator](https://aiscan.site/llms-txt-generator) will build the file for you.

**Then add Cloudflare for the manifest layer,** because its evidence chain tells you which path it probed and what came back:

```bash
curl -s -X POST https://isitagentready.com/api/scan \
  -H 'Content-Type: application/json' -d '{"url":"https://yoursite.com"}'
```

**Then add Lighthouse if you have interactive pages,** meaning checkout, booking, search or anything an agent would operate rather than read. You need Chrome 150 or later, which stable has satisfied since 25 August 2026:

```bash
npx lighthouse https://yoursite.com --only-categories=agentic-browsing --view
```

Read `agent-accessibility-tree` and `cumulative-layout-shift` as the real result. Treat the WebMCP rows as a checklist of things you could adopt, not as a grade you failed.

Note that Google's PageSpeed Insights API returned `HTTP 429 RESOURCE_EXHAUSTED` on this container's keyless quota on 31 August 2026, so the CLI above is the reliable route rather than the hosted one.

## Common mistakes when reading either score

**Reporting a Cloudflare level as a percentage.** `aiscan.site` fails 10 of 22 checks and returns Level 5. The level is not a pass ratio.

**Treating a Lighthouse category score of 1 as a pass.** Four of the six audits carry weight 0, so the score is mostly telling you about your accessibility tree.

**Assuming the commerce checks apply.** Cloudflare returns them as `neutral` unless it classifies your site as commerce, and that classification runs on string matching that misfired on this site.

**Reading either result as coverage of the other.** Cloudflare never looks for llms.txt. Chrome never looks at robots.txt. A clean result from one says nothing about the other.

**Comparing scores across rubrics.** Both scales run 1 to 5 and both name the top level "Agent-Native", which invites exactly the comparison that this article's four rows show is meaningless.

## Baselines worth knowing

According to Cloudflare's own measurement across the 200,000 most visited domains, published with the Agent Readiness announcement and the widest sample anyone in this category has released: 78% of sites have a robots.txt, but "the vast majority are written for traditional search engine crawlers, not AI agents"; 4% have declared AI usage preferences in robots.txt; 3.9% pass Markdown content negotiation; and fewer than 15 sites in the entire dataset carry both an MCP Server Card and an API Catalog.

Against that baseline, `nextjs.org` is in the top 3.9% of the web on the one check that governs whether a non-rendering crawler can read it, and Cloudflare still rates it Not Ready. That single row is the clearest argument for reading the checks rather than the level.

## Which of the three to run first

Run the scan, then decide from what it returns. If **C1** or **C3** fail, agents are not reading your content and no manifest will fix that, which is the failure mode traced end to end in [the Next.js rendering teardown](https://aiscan.site/blog/nextjs-react-invisible-to-ai-crawlers). If **C2** fails, the [generator](https://aiscan.site/llms-txt-generator) produces a valid file, and [the evidence review](https://aiscan.site/blog/does-llms-txt-actually-work-2026) explains what publishing one is realistically worth. If **B2** fails, you have not told any AI crawler what it may do.

Start here: [aiscan.site](https://aiscan.site/), or `npx aiscan-cli yoursite.com`. Every platform walkthrough lives at [aiscan.site/guides](https://aiscan.site/guides), and the [Next.js platform page](https://aiscan.site/docs/platforms/nextjs) collects the framework-specific ones.