Let Agents In

Agent readiness · cloudflare.com

2026-08-12 10:41 UTC · formula v9.2 · 11.6s

Your signup page answers 403 to anything that is not a browser.

https://dash.cloudflare.com/sign-up returned 403 across three tries. An agent that got this far still cannot open an account.

13/ 14

A dashed column is a stage we could not measure, not a stage you failed.

A · Discovery
5/5
B · Agent entry
3/4
C · Registration
n/m
D · Provisioning
3/3
E · Integration
2/2

of the 14 points that apply to you and we could measure · 3 of 17 were not scored

You 13 · category median 7 · best cloudflare.com 13 · 15 deterministic HTTP checks, published formula

Pass it onEmail itLinkedIn

Fix this first

+1point, taking 13/14 to 14/14

This is the whole list: everything we could measure and you do not pass. Another 3 points sit behind checks we could not evaluate on your domain, and each of those lines below says what would make it measurable.

  1. 1
    Agent entry pointan afternoon · +1

    The file is there and it states a policy rather than a procedure. It counts when it names a credential, an endpoint or a way to get an account: the path from nothing to a working key, in steps. Ours is at /agent-signup.md and it is 1.7 kB.

Take it with you

2 of the checks an agent depends on, cloudflare.com does not pass.

Send yourself the list above with the checks that cost the most, and a permanent link. Whoever owns the fix is usually not the person who ran the scan.

One email with the report, and one follow-up asking what you did with it. No newsletter, no sequence. Delete on request at hello@letagentsin.com.

None of this tells you whether an agent picked you

Everything above is a file an agent could read. Whether one actually chose you is a different measurement, and we have not run it on cloudflare.com. What we have run it on is a rich text editor vendor: six agents, one brief, six isolated copies of a real codebase. All six picked the same competitor, and the vendor being studied was never named, not even on a rejection list, while the runs named and dismissed ten alternatives between them. In an earlier round, run before we isolated the copies, it was named twice and struck off both times in four words: Fully commercial, licence key required. That study is about them, not about you. It is here because it is the difference between a file and a decision.

Read the audits in fullWhat the same run on cloudflare.com costs

Against file upload and storage

You lead the 9 we have scanned in this category.

  1. 1
    cloudflare.comyou
    13/14
  2. 2
    cloudinary.com
    10/13
  3. 3
    imagekit.io
    11/16
  4. 4
    transloadit.com
    10/16
  5. 5
    bunny.net
    7/14
  6. 6
    tigrisdata.com
    7/15
  7. 7
    uploadcare.com
    7/15
  8. 8
    uploadthing.com
    6/14
  9. 9
    filestack.com
    5/13

Where competitors pass and cloudflare.com does not

  • Paths robots.txt points at answertransloadit.com

Only domains we have actually scanned appear here, so the ranking is a floor: a competitor missing from the list has not been measured, not beaten.

By stage

A
DiscoveryCan an agent find and read you?
5/5
B
Agent entryIs there a door built for a machine?
3/4
C
RegistrationCan an agent get an account?
not measured
D
ProvisioningCan it get credentials without a human?
3/3
E
IntegrationCan it ship working code?
2/2

Every check

Each line is one HTTP observation with a published rule, so you can rerun any of them yourself. Most are the same tomorrow if you are: the two that are not are the bot gate and the pricing page, which answer inconsistently on their own, which is why those run more than once and say so when the tries disagreed. PASS and PART are counted. UNMEASURED means we could not evaluate it, N/A means it does not apply to a product like yours, and neither is in the score or its denominator. See the formula

A · Discovery

  • PASS
    Answers an agent user-agentAnswered 200 to LetAgentsIn/1.0 (+https://letagentsin.com/methodology)
  • PASS
    llms.txt publishedllms.txt and llms-full.txt present at https://www.cloudflare.com/llms.txt and https://www.cloudflare.com/llms-full.txt and https://docs.cloudflare.com/llms.txt and https://developers.cloudflare.com/llms-full.txt, and the 12 links we sampled across both files all answer
  • PASS
    Docs readable without JavaScript9,312 characters of text without JS
  • PASS
    On-demand agents not blockedExplicitly allowed: ChatGPT-User
  • N/A
    Paths robots.txt points at answerrobots.txt names no concrete path, only patterns or nothing, so there is no claim to check
  • PASS
    No punishing crawl delayNo Crawl-delay applies to the agents we check

B · Agent entry

  • PART
    Agent entry pointOnly service descriptors: https://www.cloudflare.com/.well-known/mcp.json, https://www.cloudflare.com/.well-known/agent.json. No procedure written for a machine.A markdown file written for a machine turns a guessing game into a procedure it can follow.
  • PASS
    OAuth dynamic client registrationregistration_endpoint published, but none of the 2 advertised grants (authorization_code, refresh_token) finishes without a person at a browser
  • PASS
    MCP surfaceLive MCP endpoint at https://mcp.cloudflare.com/mcp, answered 401 with an auth challenge

C · Registration

  • UNMEASURED
    No CAPTCHA in the signup HTMLUnmeasurable: the signup form at https://dash.cloudflare.com/sign-up is not in the server HTML, so its gates are not eitherServer-render the form, or tell us the endpoint it posts to, and the gates become visible to us and to an agent.
  • UNMEASURED
    Signup reachable without a browserUnmeasurable: https://dash.cloudflare.com/sign-up answers 403 to an agent and 403 to a Chrome user-agent, so nothing gets in from here and the difference we test for cannot be seenNothing for you to do here. It becomes measurable from a network your edge admits.

D · Provisioning

  • PASS
    Programmatic key provisioning2 of 7 provisioning phrases across the 8 documents we read: "account api", "create an api key (or api token, access token, personal access token, service account, auth token, secret key), next to something programmatic"
  • PASS
    Free tier or no-card trial stated in textFree tier or no-card signals at https://www.cloudflare.com/plans/: "$0"

E · Integration

  • PASS
    Typed SDK on the registrycloudflare@7.0.0 ships types, matched from the registry by who publishes it rather than by a link on your site
  • PASS
    Machine-readable API descriptionOpenAPI at https://www.cloudflare.com/openapi.json

What we discovered on the way

Docs
https://developers.cloudflare.com/ · from your llms.txt
Pricing
https://www.cloudflare.com/plans/ · linked from the site
Signup
https://dash.cloudflare.com/sign-up · linked from the site
npm package
cloudflare (registry guess)
GitHub
cloudflare/cloudflare-docs
Package licence
Apache-2.0
Crawl-delay
none
Content-Signal
ai-train=yes, search=yes, ai-input=yes
Blocked on-demand agents
none