Methodology

1. What is measured

Every grade is a set of plain server-side fetches against https://<host>: no browser, no JavaScript execution, no cookies, no login. Each area scores 0, 1 or 2.

1. Crawler access. /robots.txt is fetched and parsed by user-agent group for 8 tokens (GPTBot, ClaudeBot, OAI-SearchBot, PerplexityBot, Google-Extended, Amazonbot, CCBot, Bytespider). 2 = none of them is disallowed at the root; 1 = one to three are; 0 = four or more are, or robots.txt answers HTTP 5xx (RFC 9309 treats that as "disallow everything"). A missing robots.txt or an HTML page in its place scores 2 (everything allowed by default). If robots.txt cannot be fetched at all the area is unmeasured.
2. Machine-readable surfaces. /llms.txt, /sitemap.xml, /.well-known/x402, /.well-known/agent-card.json, /.well-known/mcp-registry-auth, /openapi.json, /ai.txt are fetched. One point for a sitemap (the file, or one declared in robots.txt), one for /llms.txt or /ai.txt, one for any agent surface (/openapi.json, /.well-known/agent-card.json, /.well-known/mcp-registry-auth or /.well-known/x402), capped at 2. A catch-all HTML page served at one of these paths does not count. A 429 is retried once after 1.5 seconds.
3. Readability without JavaScript. The home page is fetched and stripped of scripts, styles and tags. 2 = at least 1,200 characters of visible text (or at least 300 with two or fewer external scripts) and no empty root container; 0 = fewer than 300 characters, an empty root container with fewer than 800 characters, a bot challenge, or a non-200 response; 1 otherwise. A 200 that is not HTML scores 1 if it carries text, else 0.
4. Structured data. One point for at least one JSON-LD block that parses, one point for both og:title and og:description on the home page.
5. Legal notices. The TAKE IT DOWN desk check of six required notices and request mechanisms (its own score, out of 12). 2 = at least half the desk points; 1 = at least one sixth; 0 = fewer. Unmeasured when the desk check does not answer.
6. MCP census entry. One point if the host is listed in the agent-economy index hosts file (sites selling to agents), one point if /mcp answers with something other than a 404 or an HTML page.

Fetch rules: 7-second timeout per request, run in parallel; redirects followed manually (at most 4); localhost, raw IPs, private and dotless hosts and non-default ports refused; images and binaries never downloaded; HTML read up to 1.5 MB. User agent: Mozilla/5.0 (compatible; AgentReadyBot/1.0; +https://agentexchange.work/). Limit: 30 grades per hour per IP; results cached 15 minutes (add &fresh=1 to bypass).

2. How letters are assigned

Total = round(points scored ÷ (2 × areas measured) × 12). A 11–12B 9–10C 7–8D 5–6F 0–4 Areas that could not be measured are left out and the total is scaled to 12; the profile says so. If nothing at all could be measured the result is "?" and no profile is stored.

3. Profiles, categories and peer ranking

Every completed grade is stored as a public profile at /site/<host> with the last 30 grades. Each host is assigned one of 7 categories (News & media, SaaS & platforms, Communities & social, Retail & marketplaces, Docs, reference & open source, Education & research, Other) by a heuristic: a curated list of well-known hosts first, then keywords in the host name (for example "news", "shop", "docs", "forum", "api"), then the top-level domain (.edu and .ac.xx are education; .gov, .mil and .int are other; .dev and .io are docs; .ai and .app are SaaS). Anything else is "other". The heuristic is deterministic and dated 2026-09-30; a wrong category can be disputed like any check.

Within a category, hosts are ranked by score, best first; equal scores share a rank (competition ranking), so "#12 of 58" means eleven hosts score strictly higher. The profile shows the rank and links to the category page, where the named peers above and below are listed.

4. Claiming a scorecard

Any graded host can be claimed by its operator, free, with no account and no email. The claim page shows a token that is specific to the host. The operator publishes it either as a plain-text file at https://<host>/.well-known/agentexchange-claim.txt (the same file name the agent-economy index uses for its operator claims; one token per line) or as <meta name="agentexchange-claim" content="<token>"> on the home page, then submits the claim. We fetch the file, then the home page, with the user agent agentexchange-grade-claim/1.0 and a 7-second timeout; a redirect off the host (other than to or from www.) fails the claim.

Example of the file format: ours, at https://grade.agentexchange.work/.well-known/agentexchange-claim.txt. (This host cannot grade or claim itself: a Worker cannot fetch its own hostname.)

A verified claim stores the host, the proof method and the date, marks the profile and the badge as "CLAIMED", and issues a private management link (shown once, not indexed, not sent anywhere) with the grade history and a re-grade button limited to one per hour per host. A claim proves control of the host; it is not an endorsement and it does not change the score. Limit: 10 verification attempts per hour per IP.

5. Disputing a check

Anyone can dispute a check from a profile: pick the area (or none) and give a plain-text reason of up to 500 characters. The host is re-graded immediately from a fresh fetch; the dispute, the reason and the before and after scores are stored and shown publicly on the profile ("2 disputes, last re-graded on a date, score 7 to 9"). There is no human review and no other path to a changed score: what the fresh fetch sees is what counts. Limits: 3 disputes per host per day and 10 per IP per day.

6. Counting and exclusions

/stats.json publishes totals for claims, disputes, on-demand re-grades and clicks on the paid-report button. Requests that carry our internal token, requests from our own user agents (agent-ready, AgentReadyBot, sentinel, homebase) and requests from the agent-economy monitors named in the census report are never counted as stranger events; blank user agents are not counted either. Stripe checkout sessions are read from Stripe, not inferred from clicks. No IP addresses are stored: rate limits use a truncated hash of the address that expires within two days.

7. Crawlers

Per-crawler pages, with vendor-documented purpose, user-agent string, robots.txt behaviour and verification: GPTBot, OAI-SearchBot, ChatGPT-User (not scored), ClaudeBot, Claude-User (not scored), PerplexityBot, Google-Extended, Amazonbot, CCBot, Bytespider.

8. Dates and versions

• 2026-09-29: version 1.0 to 1.2 — six areas, public profiles, badges, per-crawler pages, comparisons, census report, click counting on the paid button.
• 2026-09-30: version 1.3.0 — categories and peer rankings, claims with the token file or meta tag, disputes with immediate re-grade, stranger-only counters, this page.