The open web is becoming a customs house. Pages, products, identities, and actions now need to declare what they are, who may fetch them, and which agent may act. This is the audit — and the drop-in declarations to fix it.
No install. No account. No data leaves your machine. Node ≥ 20.
The 1 June 2026 Kirke Labs strategic paper — The Web Becomes a Customs House — argues the new web bargain is declared-access-for-action. AI search, agentic commerce (ACP, Universal Cart), bot authentication (Web Bot Auth), Cloudflare Content Signals, and the EU DSA/DMA all push in the same direction: every web property now needs a customs-house posture, not just a content strategy. agent-readiness-scan audits that posture across eight dimensions and generates the drop-in robots.txt, .well-known/* manifests, and JSON-LD scaffolds you need to ship the declaration.
robots.txt names individual AI bots — training, grounding, user-directed — with explicit rules.
Cloudflare Content Signals, noai/noimageai meta, X-Robots-Tag header.
Web Bot Auth key directory at /.well-known/http-message-signatures-directory.
Model Context Protocol server card + OAuth-protected-resource metadata (NSA-recommended).
OpenAI/Stripe ACP and Google Universal Cart manifests at the canonical .well-known/ paths.
Product/Offer JSON-LD complete enough for agent-driven checkout (price, shipping, returns, ratings).
sameAs to Wikidata, Crunchbase, Companies House, SEC EDGAR, GLEIF — registry-grade, not just social.
dateModified, security.txt, T&Cs, contact, privacy. The customs-form data.
Full rubric, thresholds and rationale: METHODOLOGY.md. These are documented judgement calls — disagree in an issue.
This measures heuristic indicators of agent-readiness across 2026 standards (MCP, ACP, UCP, Web Bot Auth, Content Signals). A high score makes a brand easier for agents to discover, declare access to, and act on — it is not a guarantee of agent uptake, citation, or transaction. Most of these standards are emerging, not universal. The bar will rise.