agentsiteaudit · Research
The Agent Readiness Report · October 2026
Three in four businesses selling to AI agents don't tell agents who they are.
We checked the websites of the businesses listed in the Coinbase x402 Bazaar, the main catalog of services that AI agents can pay for. These are the businesses most likely to be ready for AI agents. We wanted to know how ready their own websites are.
The catalog
On 30 October 2026 the Bazaar listed 100,028 paid resources. They come from just 2,300 sellers. The ten largest sellers account for 78% of all listings. 978 sellers (43%) run on free hosting platforms or bare IP addresses, which leaves 1,322 sellers with a website of their own. Those are the websites we audited.
Solid websites
On classic quality, these sites do well. Across 1,168 websites that could be scored, the median score was 86 out of 100. The score covers security, SEO, the certificate, speed, the connection, accessibility, links, mobile and domain set-up.
The most common classic problems were:
- 82% dns.caa.present
- 73% dns.dmarc.present
- 72% security.permissions_policy.present
- 67% security.csp.present
- 57% security.frame_protection.present
- 53% security.referrer_policy.present
- 49% security.content_type_options.present
- 45% dns.address.ipv6
Agent readiness, check by check
Agent readiness is a separate set of eight checks. Each one is shown on its own. "Not applicable" means the check does not apply to that site, for example a site that publishes no API description. Those sites are not counted as failing.
PassWarningFailNot applicableNot tested
A plain-text guide at /llms.txt telling agents what the site offers. Pass rate counts only the 1181 sites where the check applies.
479 pass · 702 warning · 0 fail · 0 not applicable · 9 not tested
The links inside llms.txt open, so agents are not sent to dead pages. Pass rate counts only the 477 sites where the check applies.
413 pass · 64 warning · 0 fail · 698 not applicable · 15 not tested
robots.txt does not shut out the main AI agents and crawlers. Pass rate counts only the 1139 sites where the check applies.
1040 pass · 99 warning · 0 fail · 0 not applicable · 51 not tested
The homepage gives a name plus a way to contact or locate the business, readable by machines. Pass rate counts only the 1168 sites where the check applies.
289 pass · 879 warning · 0 fail · 0 not applicable · 22 not tested
Where prices are shown, they are written as text an agent can read. Pass rate counts only the 362 sites where the check applies.
268 pass · 94 warning · 0 fail · 806 not applicable · 22 not tested
Any published OpenAPI description is valid and readable. Pass rate counts only the 546 sites where the check applies.
514 pass · 32 warning · 0 fail · 550 not applicable · 94 not tested
A /.well-known/x402 file lists the paid resources in a readable form. Pass rate counts only the 381 sites where the check applies.
331 pass · 50 warning · 0 fail · 668 not applicable · 141 not tested
The listed paid resources answer with a valid HTTP 402 price tag. Pass rate counts only the 290 sites where the check applies.
200 pass · 80 warning · 10 fail · 668 not applicable · 232 not tested
What to fix first
- Say who you are. Put the business name and a way to contact or locate it on the homepage, and add it as Organization structured data.
- Publish an llms.txt guide at /llms.txt, and check that every link in it opens.
- Check robots.txt. Make sure it does not block the AI agents you want to reach you.
- If you sell to agents, describe it. Publish an OpenAPI description and a /.well-known/x402 file, and make sure every listed resource returns a valid price tag.
- Write prices as text, not only in images or scripts, so an agent can read them.
How we did it
- Source: the public Coinbase x402 Bazaar catalog, collected on 30 October 2026. Each listing was matched to its seller's main website (for example, api.example.com belongs to example.com).
- What we checked: the homepage of each of the 1,322 seller websites, with AgentSiteAudit's 69 passive checks (rule version 2026-10-30). 1,190 sites could be audited; 132 could not, because the domain had no address or the page did not load.
- Passive and polite: one site at a time, with a pause between sites. We read public pages and files only. Nothing was paid for, logged into or submitted.
- Limits: one page per site. Files over 2 MB, and sites that refuse automated requests, could not be fully checked; those checks are shown as "not tested", never as failures. Agent readiness is reported separately and is not part of the classic score.
- x402 checks: 232 price-tag checks could not be run (very large catalog files, formats not read yet or slow servers). They are shown as not tested.
- Privacy: we publish totals only. No website is named for doing badly.
Published 30 October 2026 by AgentSiteAudit. Questions or corrections: derek@agentsiteaudit.com.