The agent readiness checklist for online stores

Work down the list, tick what is done, and follow the links for the tasks that are not. Each task names the check that tests it and the article that explains it. The ticks are saved in your browser, so you can come back next week and find your place. They are not sent anywhere, so nobody will know how many you skipped.

The groups follow the stages of our scan. An agent that cannot read your products never gets to judge them, and one that cannot judge them has no reason to reach checkout, so the early groups matter most. The last group, measurement, is about you rather than the agent.

Start with robots.txt, the file a well-behaved crawler reads before it reads your pages. RFC 9309, the standard behind it, calls its rules ones "that crawlers are requested to honor". A Disallow: / under an agent's name asks it to skip the whole store. Asking every bot to stay out of the cart, checkout and account pages is normal, and our robots.txt check reports a file like that as a WARN rather than a failure. robots.txt for AI agents lists which bots to allow, with a generator for the file.

Next, a sitemap with your product URLs, which is the cheapest way to hand any crawler the whole catalogue. Our sitemap check looks for product URLs in it.

Then product structured data, the block of JSON-LD in a product page that states the facts as data. Google's merchant listing markup requires a product name, an image and an offers block, and says that "priceCurrency is required if price is specified". Our product data check asks for one thing more, an identifier such as a SKU or GTIN. That is our rule, not Google's. Its partner, DISC-005, checks that the markup agrees with the page.

Make sure the price and the buy button are in the page's HTML and not only drawn later by scripts. The AI vendors' crawler pages do not say whether their agents run JavaScript, so a page whose facts appear only after scripts run is a bet on an answer nobody has given. How agents read a page shows the difference, and our JavaScript check measures it.

The next two are cheap and optional. An llms.txt is a Markdown file at the root of your site that lists your key pages for language models. Google's own guide says it does not need one, and that "Google Search ignores them". Our llms.txt check wants an H1, at least 20 lines and links that resolve, and llms.txt for online stores has a builder for the file. A Markdown version of a page, served when a client asks for text/markdown, is a switch on Cloudflare: "Markdown for Agents is available to Pro, Business and Enterprise plans". Elsewhere it takes a developer.

Last in this group is a UCP profile, the file that tells an agent which commerce services your store offers. The specification says "Businesses publish their profile at /.well-known/ucp", and that version, services and payment handlers are required. On some platforms the profile is written for you, so check what yours serves before you write one. UCP explained goes through it key by key.

An agent shopping for someone has to answer the questions a careful person would ask: how much, in which currency, is it in stock, what does delivery cost, and can it go back. If the answer is on your site in plain words, the agent can repeat it. If it is hidden behind "calculated at checkout", the agent has nothing to compare.

Show every price with an explicit currency. A bare "$" could be one of several dollars, and a currency code in the markup settles it. Our price check reads both. Say whether each product is in stock, in the markup and on the page, which our availability check reads.

Write your shipping terms with a cost and a currency, or a plain rule such as free delivery over a stated amount, and your return window in days. "30 days from delivery" is a fact an agent can pass on. "Contact us to arrange a return" is homework. The shipping and returns checks look for exactly those words.

Mark up sizes and colours as variants. Google's variant markup is a ProductGroup with "variesBy, hasVariant, and productGroupID", which gives each variant its own price and stock instead of one product with a dropdown nobody can read. Our variant check looks for it.

Let shoppers check out without creating an account. An agent buying for someone has no account on your store. In UCP, guest checkout needs only the agent's own platform credentials, and the specification puts the principle in one line: "identity linking upgrades the experience, it does not gate it." In our reading, a store that requires sign-in stops an agent at the door. Our guest checkout check reads your checkout entry for it.

Keep CAPTCHAs off the way to the payment step. Anthropic says plainly that its bots respect anti-circumvention technology: "we will not attempt to bypass CAPTCHAs". In our reading, a puzzle before payment can end a polite agent's visit. Our CAPTCHA check looks for one before payment.

Check there is a way from a product page to checkout at all, which our path check tests.

The biggest task on the list is an agent checkout, an endpoint an agent can call through a protocol such as UCP or ACP instead of filling in your form. It is often your platform's or payment provider's job rather than yours. UCP vs ACP vs MCP vs AP2 explains which protocol does what, and why agents stall at checkout covers the rest of this group.

You still want to stop scrapers and card testers. The trick is to stop them without stopping the agents your customers send.

Use bot management that knows the difference. Cloudflare, for example, describes a verified bot as one "that Cloudflare has confirmed is transparent about who it is and what it does". A rule that blocks every bot blocks those too, along with agents that sign their requests with Web Bot Auth. Our bot management check looks for a bot layer in front of your store.

Put stricter controls on checkout than on your product pages. An agent reading a product page costs you almost nothing, while a bad bot placing orders costs you money, so the two can be treated differently. Our VER-003 compares them.

State how AI may use your content, with a Content-Signal line in robots.txt. One line can say yes to search and to AI answers and no to training. It states a preference and does not enforce one. Our VER-004 reads it, and how agents discover a store explains the syntax.

Probably not in Google Analytics. Its help page says "traffic from known bots and spiders is automatically excluded", and adds "you cannot disable known bot traffic exclusion". The tag that feeds it is a script in the page, too, so in our reading a client that never runs your scripts never shows up there at all. Agent traffic has to be counted at your edge, in a service such as Cloudflare, or in your server logs. Our MEAS-001 cannot be answered by visiting your store, because the answer is in your own traffic data.

With what you can change yourself today. The same twenty tasks, sorted by who does the work and, within that, by the size of the job, as our scan labels each check's fix:

Start with the settings group. Our scan labels guest checkout, the CAPTCHA and the sitemap as small jobs, done in your platform's settings or your bot vendor's. The theme and code group is where structured data, prices and policies live, and it rewards an afternoon with a developer. Integrations such as an agent checkout depend on your platform's roadmap more than on you.

Each of our platform guides has a matrix of what the platform ships against what an agent needs. Here is that matrix laid over this checklist:

For the full picture, with the admin path for every setting, read the guide for your platform: Shopify, WooCommerce, BigCommerce or Magento and Adobe Commerce. If your store runs on something else, the checklist above still applies; you will just be doing more of it yourself.

What is an agent readiness checklist?

A list of the things an AI shopping agent needs from an online store to find a product, judge it and buy it, plus what the store needs to tell good agents from bad bots. This one has twenty tasks in five groups, each tied to a check in our scan.

What should I fix first?

Whatever stops an agent earliest. A robots.txt that blocks agents, a checkout that requires an account and a CAPTCHA before payment can each end a purchase. Product pages without structured data leave the agent to guess from the HTML. Policies, variants and llms.txt make the agent's answer better once it can get in.

Do I need an llms.txt for Google?

No. Google's AI optimization guide says you do not need new machine-readable or AI text files to appear in Google Search, and that "Google Search ignores them". An llms.txt is aimed at other tools, and our scan counts it as a small, optional signal.

Do I need UCP or MCP to be agent ready?

Not to start. Most of this checklist is ordinary pages, markup and settings. A UCP profile and an agent checkout matter once the basics are in place, and on some platforms they are published for you.

How do I know whether my store passes?

Run a scan. It reads your store the way an agent would, from robots.txt to checkout, and reports each of these checks as pass, warn, fail or skipped, with the reason.

The sources below were last checked on the date shown.