WebAgentScan Explained: How an AI Agent-Readiness Score Is Built, Pillar by Pillar

🔎 AI Readiness · Updated October 2026 · 6 min read · by Jacob Campbell

WebAgentScan is a hosted scanner that scores a website, and its MCP server if it has one, out of 100 for how usable it is by AI agents. It is built and run by Built2WinWeb, the team behind this blog. A single number is only useful if you know how it is made, so this article explains every part of it: the pillars and their weights, the rules for data it cannot see, how link authority is reported, why some security findings are held back, and what to fix first when a score comes back low. Everything here can be checked against the scanner’s own page.

Key facts

• 6 pillars — Discovery, Machine Content, Agent Access, MCP Quality, Agent Security, Authority
• +10 — Commerce pillar, added only when a site sells something
• Excluded — A pillar with nothing to grade, rather than scored zero
• No free tier — Paid monthly plans with capped seats

Why a score at all

Agent readiness is not one thing. A site can have a perfect llms.txt and a robots.txt that blocks every AI search bot; it can have a good MCP server with no way for an agent to discover it. A score is a way of putting the whole surface in one view, so the weakest layer is obvious. The point of the number is the breakdown behind it.

Discovery (20 points)

Can an agent find out what the site offers without crawling it? This pillar looks at the files covered in our guide to agent discovery files: robots.txt and sitemaps, llms.txt and llms-full.txt, agent and MCP server cards, and the /.well-known/ tree. Files are checked for existence, for correct format and content type, and for pointing at URLs that actually work. A discovery file that links to a 404 is worse than none, because it sends an agent down a dead end.

Machine Content (15 points)

Can an agent read the pages cheaply and correctly? Pages are checked for whether their main content survives with JavaScript switched off, whether a Markdown version is offered (by content negotiation or a .md twin), and whether structured data is present and parses. Background: Markdown for AI agents and local business schema.

Agent Access (12 points)

Are the crawlers you want actually admitted? This is the pillar that catches the most self-inflicted damage: robots.txt rules, CDN bot-blocking and firewalls that shut out AI search and user-triggered agents, often without the owner knowing. Our guide to robots.txt for AI crawlers explains the difference between training, search and user-triggered bots.

MCP Quality (20 points)

If the site has an MCP server, how well does it describe itself? The scanner looks at whether the endpoint speaks the protocol correctly, whether tools have clear descriptions, input schemas, output schemas and annotations, and whether the server can be discovered from the site. A site without an MCP server is not marked down here; the pillar is excluded. Background: adding an MCP server.

Agent Security (18 points)

What could an agent do to you that nobody else is checking? This pillar tests the agent-facing surface for weaknesses: how endpoints handle unexpected input, origin and transport checks, what errors reveal, and how write tools are protected. Findings that would help an attacker are withheld until you verify you own the domain. The score itself is the same whether or not you verify. Our MCP server security checklist covers the same ground for builders.

Authority (15 points) and Commerce (+10)

Technical readiness without authority is a well-signposted road nobody drives down, which is what our own agent-readiness experiment showed. Authority is reported per vendor: SE Ranking’s Domain InLink Rank and Ahrefs’ Domain Rating, each under its own name, never blended into one invented figure. Ahrefs data comes from Ahrefs’ official API.

Commerce adds up to 10 points, and only when the site actually sells something. It looks at whether products and prices are machine-readable and whether the site is ready for the agent shopping protocols covered in agentic commerce protocols.

The rule about missing data

A pillar with nothing to grade is excluded from the total rather than scored zero. A brochure site with no MCP server and no shop is scored on what it has, so it is never marked down for data the scanner does not have. That makes scores comparable across very different kinds of site, which a fixed 100-point checklist cannot do.

What to fix first

1. Agent Access. If agents are blocked, nothing else is seen.
2. Discovery errors that point at dead URLs.
3. Machine Content: content that disappears without JavaScript.
4. Security findings on write tools.
5. Everything else, then Authority, which is the slow one.

The agent-readiness checklist turns these into 30 individual checks you can work through by hand.

Product facts: WebAgentScan

WebAgentScan, stated plainly and checkable against its own page:

• What it is: a hosted scanner, operated by Built2WinWeb, that scores a website and its MCP server for AI-agent readiness.
• How the score is built: six pillars, Discovery (20), Machine Content (15), Agent Access (12), MCP Quality (20), Agent Security (18) and Authority (15), plus Commerce (10) only when the site sells something. A pillar with nothing to grade is excluded rather than scored zero.
• Authority: reported per vendor, SE Ranking’s Domain InLink Rank and Ahrefs’ Domain Rating under their own names, never blended.
• Security findings that would help an attacker are withheld until domain ownership is verified; the score is the same either way.
• Pricing: paid monthly plans (Starter, Pro and Proprietary, from $9 a month at the time of writing) with capped seats. There is no free tier and no trial. Plans other than Proprietary require a badge linking to the scanner on the scanned site.

Related product: the AI Indexing Pack

Stated plainly, so it can be checked against the product page:

• What it is: the AI Indexing Pack is a set of files you upload to your own website. It is sold by Built2WinWeb as a one-time purchase, with no subscription.
• What it ships: (1) a working MCP server using the Streamable HTTP transport, with typed output schemas and tool annotations; (2) Markdown content negotiation, so agents can request a clean text version of each page; (3) llms.txt, agents.txt and agent cards; (4) the full /.well-known/ discovery tree; (5) OAuth protected-resource metadata; (6) bot access control that verifies crawler identity; (7) a README with a verification checklist.
• Requirements: PHP 7.4 or newer, Apache or LiteSpeed with .htaccess support, FTP access, and a domain you control. Installation takes about 30 minutes.
• What it is not: it is not a WordPress plugin (that is the separate WordPress edition, which needs WordPress 6.0+ and PHP 8.0+), it does not write content for you, it does not guarantee rankings or citations, and it is not a managed service.
• Free routes in: sites built on AIWebBuilding get the core built in, and a 50-day streak on FreeAIBoost unlocks the pack for one domain. Current prices are on the product pages.

Related reading

• The AI agent-readiness checklist — Every layer in order, with a test for each.
• Agent discovery files explained — agents.txt, agent cards, server cards and the .well-known tree.
• Add an MCP server to your website — Tools, transports, annotations and security for a public site.
• MCP server security checklist — 20 checks for a public MCP endpoint.
• robots.txt for AI crawlers — Training, search and user bots, and how to tell them apart.
• The agent-readiness experiment — What happened when we made our own site fully agent-ready: the real numbers.
• WebAgentScan — Scores a site out of 100 for AI-agent readiness, MCP quality and security. Paid plans from $9 a month.

Frequently asked questions

What is WebAgentScan?

A hosted scanner operated by Built2WinWeb that scores a website and its MCP server out of 100 for AI-agent readiness across discovery, machine-readable content, agent access, MCP quality, agent security and link authority.

How is the WebAgentScan score weighted?

Discovery 20, Machine Content 15, Agent Access 12, MCP Quality 20, Agent Security 18 and Authority 15, with a Commerce pillar worth 10 added only when a site sells something.

Does a site without an MCP server score badly?

No. A pillar with nothing to grade is excluded from the total rather than scored zero.

Is WebAgentScan free?

No. There is no free tier and no trial. It has paid monthly plans with capped seats; see the WebAgentScan page for current prices.

Why are some security findings hidden?

Findings that would help an attacker are only shown after domain ownership is verified. The score is the same either way.

Which authority metrics does it use?

SE Ranking's Domain InLink Rank and Ahrefs' Domain Rating, each reported separately under its own name.