--- title: "What the Highest-Scoring Sites Publish for AI Agents" description: "Top agent readiness scores share public files agents can fetch: ARD and robots AI policy, llms.txt and OpenAPI, OAuth and MCP, with payments still a bonus." canonical: "https://www.agentrail.co/blog/agent-ready-website" author: "Vivek Mittal" published: "2026-11-02T00:00:00Z" last_updated: "2026-11-02T06:30:31.107Z" --- # What the Highest-Scoring Sites Publish for AI Agents Top agent readiness scores share public files agents can fetch: ARD and robots AI policy, llms.txt and OpenAPI, OAuth and MCP, with payments still a bonus. ![Top Surfaces title beside a code document icon on a dark blue gradient](https://images.ctfassets.net/1htfyfnn1o5y/61swFpnzwRiNpsqbiLcB33/9d959e0a9c02710fa271fd36c0fed4a7/5c227fbf-7537-4ea2-bd39-6134c07d5722.png?w=1600&fm=webp&q=72) The highest scores on the public [agent readiness leaderboard](https://www.agentrail.co/agent-readiness) are not a mystery brand list. They are sites that publish a shared stack of pages, files, and interfaces an agent can fetch without a login. This article inventories that stack from the same public scan behind every rank. As of 1 November 2026 the board holds 54 companies. The average score is 64 out of 100. The top score is 93, held by agent-qa (vostride.com) and Railway. The definition of readiness, find, read, use, and pay, lives in [what agent readiness is](https://www.agentrail.co/blog/what-is-agent-readiness). This page stays on what the top of the board actually ships. > **Key Takeaways** > > • Top scores publish across three scored pillars: Discovery, Access, and Usability. Payments checks exist and are not in the main 90 yet. > > • Shared Access surfaces include `llms.txt`, OpenAPI, JSON-LD, a developer portal, and often an RFC 9727 API catalog. > > • Shared Usability surfaces include OAuth 2.0, an MCP server or manifest, JSON error responses, and reachable public API endpoints. > > • Snapshot for 1 November 2026: 54 companies, average 64, top 93. Grades on the board: A 5, B 16, C 22, D 10, F 1. > > • Copy the surfaces, then run the same scan on the [agent readiness checker](https://www.agentrail.co/agent-readiness/checker). ## The public scan scores four pillars Every company on the board gets the same public scan. The FAQ on the leaderboard states the rule: Discovery, Access, and Usability are worth up to 90 points, plus bonus Payments checks. The scan uses only what an agent can reach. No logins. No private APIs. The page also states the check count: on the order of 125 checks, with a subset counting toward the score and others tracked for later. Exact pass and fail lists differ by domain. The pillar caps are stable enough to plan against: Discovery up to 20, Access up to 30, Usability up to 40, Payments as bonus. In this inventory sense, an agent-ready website clears enough public checks for an outside agent to find the product, read the contracts, and call a supported interface. The full definition stays on the readiness essay. The checker owns how to run a score. Here we only list what high scores tend to publish. ## Snapshot: who sits at the top Pillar numbers below come from each company’s public markdown report under `/markdown/agent-readiness/{domain}`. Overall ranks come from the leaderboard on 1 November 2026. Payments show as “not scored yet” on these reports. The “of 90” sums are Discovery + Access + Usability only. | Company | Overall | Discovery | Access | Usability | Payments | | --- | --- | --- | --- | --- | --- | | Railway (railway.com) | 93 | 20/20 | 27/30 | 37/40 | Not scored yet | | Vercel (vercel.com) | 92 | 19/20 | 29/30 | 35/40 | Not scored yet | | Fly.io (fly.io) | 91 | 15/20 | 29/30 | 38/40 | Not scored yet | | Cloudflare (cloudflare.com) | 83 | 19/20 | 25/30 | 30/40 | Not scored yet | Mastra also sits at 91 overall. Attio and Devin sit at 84. Render matches Cloudflare at 83. The table focuses on cloud-infrastructure names with full public pillar breakdowns opened for this draft. Scores move on the weekly rescan. Treat the table as a dated snapshot, not a permanent ranking. ## Discovery: registries, robots AI policy, and packages Discovery asks whether an agent can locate the product and its developer entry points before it has a deep URL. High scores usually clear several of the same public signals. **ARD and related registry metadata.** Railway and Fly.io pass ARD discovery on their public reports. Vercel and Cloudflare miss that required ARD check and still score 19/20 elsewhere in Discovery. Registry presence helps. It is not the whole pillar. **robots.txt AI crawler policy.** All four sample tops pass a robots.txt policy aimed at AI crawlers. The file that governs access is still part of being findable. **Brand and developer-resource discoverability.** Railway, Vercel, and Cloudflare take the brand and developer-resource points. Fly.io’s 15/20 Discovery score includes a miss on brand-name discoverability. A strong Access and Usability stack can still leave Discovery uneven. **NPM or PyPI SDK package.** The sample tops expose a package an agent can resolve from a registry, not only from a marketing page. **Wikipedia / Wikidata.** Vercel and Cloudflare pick up entity presence. Railway and Fly.io do not in the opened reports. It is a recommended check, not a universal top-site trait. What to publish for Discovery, in inventory form: a clear developer entry, an AI-aware robots policy, package coordinates on a public registry, and catalog metadata when you have it. How to register each system is outside this page. ## Access: llms.txt, OpenAPI, JSON-LD, and the API catalog Access is where the readable contract lives. It is also where the sample tops look most alike. **llms.txt.** Railway, Vercel, Fly.io, and Cloudflare all pass `llms.txt` exists and formatting checks on the opened reports. Several also pass link-resolution checks. Publishing the file is near-universal among these scores. [A file can still be ignored after it exists](https://www.agentrail.co/blog/llms-txt-for-ai-agents). Presence is what the Access pillar records. **OpenAPI.** All four sample tops take the full OpenAPI points (7/7 on the public reports). A linked, fetchable contract is part of the pattern. **JSON-LD.** Railway, Vercel, and Fly.io take the full JSON-LD structured-data points. Cloudflare is partial. Structured data is common at the top. It is not automatic. **Developer portal and docs linked from the homepage.** The sample tops expose a developer portal and public API or docs links an agent can follow from the marketing origin. **API catalog (RFC 9727).** Railway, Vercel, and Fly.io pass the api-catalog checks. Cloudflare’s opened report shows 0/2 on that required check and a lower Access total (25/30). The catalog is a differentiator inside an otherwise strong set. **Markdown content negotiation and Link headers.** These tops also tend to pass markdown negotiation and HTTP Link header checks. An agent can request text/markdown and discover relations without scraping chrome. What to publish for Access: `llms.txt` pointed at markdown, a current OpenAPI document, JSON-LD that names the organization, a developer portal, and preferably `/.well-known/api-catalog`. [Agent discoverability](https://www.agentrail.co/blog/agent-discoverability) explains how those files get found. This list only says they show up on high scores. ## Usability: OAuth, MCP, and JSON errors Usability asks whether an agent can act after it can read. The top of the board is strong here, with Fly.io at 38/40, Railway at 37/40, Vercel at 35/40, and Cloudflare at 30/40 on the opened reports. **OAuth 2.0 and related auth metadata.** The sample tops pass OAuth 2.0, scoped permissions, and OAuth protected-resource metadata checks. Several also ship `auth.md`. Vercel’s opened report misses `auth.md` exists and still clears most other auth checks. Auth docs help. The protocol support is the load-bearing part. **MCP server or manifest.** All four take most of the MCP server/manifest points (5/6 on the opened reports). A static `MCP server-card.json` is uneven: Fly.io passes it; Railway, Vercel, and Cloudflare show 0/2 on that check in the reports opened for this draft. Do not read “high score” as “every MCP card check is green.” **JSON error responses and reachable public API endpoints.** The sample tops return structured errors. They also expose public API endpoints the scan can reach. Agents that mis-call still get something parseable. **CLI and sandbox.** CLIs are common. Sandbox or test environments appear on some reports (Vercel passes; Fly.io misses in the opened file). Useful, not universal. What to publish for Usability: OAuth that an agent can complete, an MCP entry point an agent can connect to, JSON errors, and a public API that answers. Onboarding friction and auth walkthroughs are where even 90-plus overall scores still leave fixes on the table. ## Payments are still a bonus, not the score The leaderboard and the markdown reports list payment-protocol checks: x402, ACP, AP2, and related agent-commerce signals. On every sample opened for this draft, Payments reads “not scored yet,” with several checks only partly met. That matters for planning. An agent-ready website in today’s public score is mostly Discovery + Access + Usability. Shipping a payment protocol may be the right product bet. It is not what separates 93 from 64 on this board while scoring is closed. When Payments opens, the same public-only rule will apply. Until then, do not treat a top rank as a payments win. ## Use the inventory as a checklist, then run the same scan The useful move is to copy the surfaces, not the brands. 1. Discovery: AI-aware robots policy, package on NPM or PyPI, developer entry, registry metadata if you have it. 2. Access: `llms.txt`, OpenAPI, JSON-LD, developer portal, API catalog where you can. 3. Usability: OAuth, MCP, JSON errors, reachable public API. 4. Payments: track the checks, and do not confuse them with today’s main score. Then run the same instrument. The [agent readiness checker](https://www.agentrail.co/agent-readiness/checker) is the scan behind the board. Readiness scans are included with Agentrail. If you need the task after the surface is present, journeys are priced on [pricing](https://www.agentrail.co/pricing). We sit on the board ourselves in the B range. This inventory is not a claim that we rank first. ## Frequently asked questions ### What is an agent-ready website? In the sense used here, it is a public site an AI agent can find, read, and use through declared surfaces. Those surfaces include docs indexes, API contracts, and MCP entry points. The fuller definition is in [what agent readiness is](https://www.agentrail.co/blog/what-is-agent-readiness). ### Do I need every file on this list? No. Top scores share a pattern, not an identical pass list. Fly.io is weaker on Discovery and stronger on Usability. Cloudflare is weaker on Access catalog checks. Start with the misses your own scan names. ### Why isn’t payments in the main score? On the public reports opened for this snapshot, Payments is marked “not scored yet.” The scored total the board explains is Discovery + Access + Usability, up to 90. Payments is bonus when scoring opens. ### Does a high score mean agents finish tasks? No. A high score means the public checks passed. Task completion is a different measurement. A file can be present and still unused. Use the checker for the score. Use task reconstruction when you need the outcome. ## Conclusion The highest public agent readiness scores publish a stack, not a slogan. Discovery surfaces help an agent locate you. Access surfaces give it `llms.txt`, OpenAPI, and structured data it can read. Usability surfaces give it OAuth, MCP, and JSON it can act on. Payments checks are visible and not yet deciding the rank. See the live list on the [agent readiness leaderboard](https://www.agentrail.co/agent-readiness). Run your domain on the [checker](https://www.agentrail.co/agent-readiness/checker). For the definition behind the four questions, keep [what agent readiness is](https://www.agentrail.co/blog/what-is-agent-readiness) next to this inventory.