A well-funded competitor just published a report card for the entire web. How ready is the internet for AI agents? Their answer: not very.

13,268 sites scanned. Average score: 34 out of 100. Forty percent graded F. Three out of four sit at D or F. Fewer than one in three thousand reach an A. Read the report fast and you'd think the web is a smoking ruin.

So I ran my own site, botvisibility.com, through their index. About thirty minutes of work. I landed in the top five out of more than thirteen thousand sites.

That's their board, not mine. I'm at number five. The company that built the leaderboard is at number eight, three spots below the site they'd never heard of a month ago.

That should tell you something. Not about me. About the test.

A test you pass by over-engineering

Here is how these indexes work. They hand out points for collecting protocols. x402 payments. A2A agent cards. Intent endpoints, agent sessions, scoped tokens, sandbox environments. The more exotic the plumbing, the higher your grade.

Look at what the index itself admits. Their Payments layer sits at 7 percent across the whole web. The x402 payment protocol shows up on 0.136 percent of sites. Then they grade the absence of those things as failure.

Almost nobody has adopted these protocols because almost nobody needs them yet. That is not a crisis. That is a market being sensible. Scoring it as an F doesn't measure readiness. It manufactures a problem so the report has a headline.

Thirty minutes of the right work vaulted me past thirteen thousand sites. If a grade moves that fast, it was never measuring the thing that matters.

Auth is not a login screen

Here's the tell. Their index rewards OAuth support as one of its top signals. OAuth's consent flow is a human at a browser, clicking "Allow." It was built for a person to log in.

An agent shouldn't have to knock on your door and announce its user's email. The whole point of a delegated, scoped token is that the human consented once, somewhere else, and handed the agent a key with limits on it. The agent presents the key. It never re-introduces its owner on every visit.

So the index rewards the browser-redirect handshake built for people, and files the actual agent-native identity work — scoped tokens, agent sessions, delegated access — under a top tier that almost no site reaches. Then it grades everyone below it an F. It measures how well the web greets humans, and acts surprised the web isn't ready for agents.

The thing that matters is the bill

An AI agent doesn't need a PhD to buy a pair of socks. It needs to find your product, understand it, and pay. Every extra token it burns doing that is a tax. A tax on walking in the front door to do business.

That is what botvisibility.com actually measures. Not a letter grade. A bill.

Readiness isn't a report card. It's the toll an agent pays every time it visits.

Here is the shape of it. A single page can cost an agent 39,767 tokens to read as raw HTML. Serve the same content as clean markdown and it drops to about 619. Same product. Same transaction. Sixty times cheaper. That gap is the agent tax, and your customer's agent pays it on every fetch, forever.

The graders never paid their own toll

So I did the obvious thing. I ran the index-maker's own homepage through botvisibility.com.

Level 4. Twenty-nine of fifty-two checks. Seventeen outright fails. A 77x agent tax baked into their own front page. Their raw page hands an agent 39,767 tokens to get to a few hundred useful ones.

Priced out, that is a best case of $3,714 a year and a worst case of $238,602 a year in tokens. Paid by their customers' agents, not by them. The one fix that collapses the bill is a markdown endpoint. They haven't shipped it.

The people grading the web on agent readiness are carrying a quarter-million-dollar toll on their own doorstep. They just never measured it, because their test doesn't.

Don't pay the agent tax. Don't charge it either.

You do not need to be Agent-Native to be agent-ready. You do not need intent endpoints and scoped tokens and a sandbox environment to sell a t-shirt. Ship the markdown endpoint before the moon-shot protocol. Be legible. Be cheap. Be easy to buy from.

The goal was never to force every merchant on earth to turn their storefront into a research lab. That's a tax dressed up as a standard. Make agents be geniuses to do something simple and you have priced yourself out of the transaction.

The leaderboard that matters isn't how many protocols you collect. It's how little your customers pay to walk in the door. That's the number I'm building for.

Update: they noticed

This post went up in the morning. Inside 24 hours, the leaderboard moved.

Ora rescanned themselves. Their score jumped to 85 — the exact same 85 as botvisibility.com. A dead tie. So on their own leaderboard they slotted in at number five and pushed me down to six.

Read that back. Called out in public over a quarter-million-dollar toll sitting on their own doorstep, they spent the next day moving a number. Just not that one. They tuned the ranking, not the bill.

The 77x agent tax is still baked into their front page. The markdown endpoint that would actually collapse it still isn't shipped. But hey — they're back in the top five.

Same score. One rank apart. The gap they closed was the leaderboard. The gap that matters is still the one their customers' agents pay for.