webmcp

4 posts

cloudflare

Building an open Agentic Internet: readable, discoverable, callable, and payable (opens in new tab)

Agents are becoming a new kind of web visitor: they fetch information, use tools, and make purchases on behalf of people, without rendering pages like traditional browsers. The post argues that the web must evolve into an “Agentic Internet” that is readable, discoverable, callable, and payable. Cloudflare advocates open standards and interoperable infrastructure so agents and website owners can cooperate rather than rely on closed platforms. ## Why the Web Must Adapt - Well-behaved bots are generating billions of requests for unchanged pages, wasting bandwidth, compute, and money. - Agents differ from conventional scrapers: - They act on behalf of paying humans or businesses. - Blocking them can mean blocking potential customers. - Treating them like ordinary scrapers prevents publishers from understanding legitimate demand. - Existing web infrastructure, analytics, and business models were designed for human visitors and pageviews, not programmatic interactions with specific outcomes. - The future could be controlled by a few platforms, or remain open through publicly implementable standards. ## Open Infrastructure for Agents - Cloudflare proposes an open ecosystem based on standards including: - **x402** for payments - **MCP** for agent tools and interactions - **Web Bot Auth** for cryptographic agent identity - **PACT** for privacy-preserving trust signals - Website owners can choose their own identity providers, payment processors, and agent partners. - Cloudflare positions itself as one participant in the infrastructure rather than a mandatory intermediary. ## Identity and Trust - **Web Bot Auth** allows agents to cryptographically identify themselves to websites instead of relying on spoofable `User-Agent` headers. - **Private Access Control Tokens (PACT)** let trusted sites anonymously vouch for agents. - These mechanisms can reduce friction for legitimate agents while giving publishers more control over access. ## Readable: Content Designed for Agents - **Markdown for Agents** provides content in a format that requires fewer tokens and less bandwidth than full human-oriented HTML. - Rendering CSS, images, advertisements, and other interface elements is wasteful when an agent only needs the underlying information. - Cloudflare’s **Kitesurf** browser is designed for agents, running on Workers per request and omitting unnecessary human-browser features. ## Discoverable: Helping Agents Find Resources - Agents need interfaces designed for machine-oriented discovery rather than conventional keyword search. - **AI Search** allows public websites to become searchable by agents. - **Agent Engine Optimization (AEO)** measures how visible a brand is across relevant AI models and agents. - Poor visibility to the agents customers use could effectively make a business invisible to those customers. ## Callable: Exposing Actions Directly - Human-oriented websites force agents to parse HTML, identify controls, and simulate clicks. - **WebMCP** lets websites expose explicit tools through the browser, including structured schemas and executable actions. - This removes the need for DOM guessing and makes interactions more reliable. - Tools run within the page, allowing them to reuse the user’s session and existing state. - **Code Mode** lets agents invoke tools by writing code, which can be faster and more precise than natural-language tool calls. - Direct endpoint usage also gives content owners clearer insight into which content and actions agents actually use. ## Payable: Building a Sustainable Economic Model - Advertising depends on pageviews, rendered ads, and human attention—none of which necessarily occur during agent interactions. - Seat-based pricing is also poorly suited to software agents acting for users. - Micropayments could allow publishers to charge for individual fetches or articles: - Recipe sites might charge fractions of a cent per request. - Newspapers could license articles at read time without requiring a separate subscription. - Agents could use wallets and budgets configured by their users. - Payment standards such as **x402** are presented as a foundation for direct transactions between agents and merchants. ## Practical Conclusion The Agentic Internet will succeed if agents can reliably identify themselves, read content efficiently, discover useful resources, invoke structured actions, and pay directly. Open standards and interoperable systems are preferable to a future where a small number of platforms control discovery, identity, and commerce.

cloudflare

From ranking to recommended: get your site ready to thrive in the age of AI agents (opens in new tab)

AI assistants are becoming a major channel through which customers discover, compare, and purchase from businesses. As agents replace traditional search journeys, discoverability increasingly depends on whether a site is easy for machines to access, understand, trust, and recommend. Cloudflare’s Agent Readiness and Answer Engine Optimization (AEO) tools measure both technical accessibility and visibility in AI-generated recommendations. ## The Rise of the Agentic Audience - Fewer than half of HTML page requests reportedly come from humans, with the remainder including crawlers, bots, and increasingly capable agents. - Customers may ask AI assistants for: - Solutions to specific problems - Recommendations tailored to their needs - Comparisons between products or services - Actions performed on their behalf - Traditional metrics such as clicks and page views do not show whether AI systems can use a site or recommend it. - Agent-focused discoverability requires being found, read, and confidently cited by answer engines, shopping assistants, and research tools. ## Diagnostics: Measuring Agent Readiness Cloudflare’s Diagnostics feature evaluates a site from an agent’s perspective rather than simply loading its homepage. - It checks whether agents: - Are permitted to access the site - Can discover its content - Can retrieve clean, machine-readable content - Can identify callable interfaces and authentication methods - Diagnostic checks examine: - `robots.txt` - XML sitemaps - Response headers - Markdown content - Published metadata - APIs and agent-facing tools - Results are grouped into readiness levels from “Not Ready” to fully agent-native. - Each check returns: - Pass, fail, or neutral status - An explanation of its significance - Evidence showing the exact request and response ### Diagnostic Improvement Areas - **Quick wins:** Crawler-readable `robots.txt`, XML sitemaps, AI-crawler rules, and clean Markdown. - **Technical groundwork:** Content Signals, API catalogs, link headers, and agent login instructions. - **Advanced integration:** OAuth discovery, MCP, A2A agent cards, skills indexes, Web Bot Auth, and WebMCP. - **Commerce:** Emerging standards such as x402, ACP, UCP, and AP2. These are currently informational and do not affect the readiness score. - Recommended fixes either link directly to Cloudflare settings or generate a coding prompt that can be given to an agent. ## AEO: Measuring AI Recommendations Agent Readiness shows whether agents can access a site; AEO measures whether assistants actually recommend it. - Cloudflare infers a site’s industry and category, then tests likely customer prompts against assistants such as Claude and GPT. - Prompts cover recommendations, product comparisons, and general category advice without naming the customer’s brand. - AEO reports several visibility metrics: - **Citation Rate:** How often the site is cited as a source. - **Prominence:** How early and substantially the site appears in an answer. - **Mention Rate:** How often the brand is named, even without a source citation. - **Share of Voice:** The site’s share of citations compared with competitors. - Comparing mention and citation rates distinguishes brand awareness from authoritative attribution. ## Category Benchmarks and Industry Fit Cloudflare builds a benchmark for each industry and category before scoring individual sites. - AI assistants are queried with representative prompts to identify: - Which sites are cited - Where citations appear - How prominently each brand is represented - The benchmark is reused across accounts in the same category rather than regenerated for every scan. - This approach provides: - Instant result loading - Lower AI-compute costs - An **Industry Fit** score showing whether the site appears alongside its real competitors ## Multimodel Evaluation Because AI responses vary, Cloudflare queries assistants multiple times across different models using AI Gateway. - The system analyzes the actual answer text and cited sources customers would see. - Workers AI evaluates citation and mention patterns on Cloudflare’s infrastructure. - Exact text analysis is used alongside model-based judgment, rather than asking a model to grade its own response. - The process converts many variable responses into consistent, actionable metrics without requiring site owners to build their own evaluation framework. ## Operator Activity Cloudflare also reports real crawl and referral activity from AI operators. - Activity is shown by operator, including OpenAI and Google. - Site owners can see: - Which operators read their content - Which operators send visitors back - Errors encountered during crawling, such as `403` blocks and `404` links The broader goal is to connect controlled AEO benchmarks with real-world agent traffic, helping businesses understand both how AI systems perceive them and whether those systems can successfully access and use their sites. Businesses should treat agents as a core audience: first make the site technically accessible and machine-readable, then measure whether AI assistants cite and recommend it. Acting early may provide an advantage because most websites are not yet optimized for agent discovery.

cloudflare

Give any website a WebMCP interface (opens in new tab)

Cloudflare is launching a developer preview of WebMCP that lets browser-based AI agents use websites through structured tools instead of scraping pages or navigating human-oriented interfaces. Cloudflare injects a browser-side bridge at the edge, requiring no origin-code changes or redeployment. The system currently supports tool packs such as Content Credentials and proxying an existing MCP server, with all preview tools executing in the visitor’s browser. ## Why WebMCP Matters - Traditional websites assume a human will read pages, click controls, and submit forms. - AI agents increasingly visit the web but often rely on crawlers that copy content away from the original site. - WebMCP provides a browser-native interface through `document.modelContext`. - Sites can expose tools that agents can call directly, reducing navigation overhead and token usage. - The standard is experimental in Chrome 146 and normally requires site-level implementation. ## Cloudflare’s No-Code Integration - Cloudflare adds WebMCP support through a Dashboard setting. - Enabled sites receive groups of related tools called tool packs. - New packs can be activated later without redeploying the site. - The preview includes: - A Content Credentials pack for reading C2PA metadata. - A Site MCP Server pack for exposing tools from an existing MCP server. ## Edge Injection and Browser Bridge - Cloudflare uses `HTMLRewriter` to inject a same-origin bridge script into HTML responses. - The injection leaves the site’s original HTML and application code otherwise unchanged. - The script includes: - `data-packs`, identifying enabled tool packs. - `data-mcp-url`, identifying the site’s MCP endpoint, defaulting to `/mcp`. - The bridge exits harmlessly when the browser lacks WebMCP support. - It registers tools with `document.modelContext.registerTool`. - Static packs define tools in advance, while dynamic packs discover available tools during startup. ## MCP Tools and Site Sessions - Tools use standard MCP `Tool` and `CallToolResult` types. - Existing MCP clients can interact with these browser tools without special integration. - For a site’s MCP server, the bridge: - Retrieves the server’s tool definitions through `tools/list`. - Registers browser-side proxy tools. - Sends calls to the site’s MCP endpoint using same-origin requests. - Preserves the visitor’s existing session through `credentials: "same-origin"`. - Preview tools run locally in the visitor’s browser, without requests to Cloudflare-owned services. - The edge worker architecture leaves room for future packs that use Workers AI or AI Search. ## Reading Content Credentials - The Content Credentials pack analyzes C2PA metadata embedded in images. - `scan_images_c2pa` scans images on the page and reports: - Image counts and formats. - Whether C2PA metadata exists. - Manifest counts. - Claim generators, titles, and signing organizations. - `inspect_image_c2pa` retrieves more detailed manifest data, including edit history, authorship, and certificates. - The reader examines only the metadata near the beginning of the image rather than downloading or processing the entire image. - In the current preview, credentials are reported but not cryptographically verified; results therefore indicate `signatureVerified: false`. Cloudflare’s approach makes WebMCP adoption largely configuration-driven: sites can expose agent-friendly capabilities without changing their origin code, while retaining browser execution and the visitor’s authentication context. Developers should treat it as an experimental preview, especially because browser support and credential verification are still evolving.

cloudflare

Browser Run: give your agents a browser (opens in new tab)

Cloudflare is renaming Browser Rendering to Browser Run and positioning it as a full browser platform for AI agents. It provides remotely hosted Chrome sessions that agents can control, observe, debug, record, and scale globally, while allowing humans to intervene when necessary. The update expands access through CDP and MCP, making existing automation tools and AI coding assistants compatible with Cloudflare’s browser infrastructure. ## Browser Run for AI Agents - Agents can navigate websites, read content, fill out forms, extract data, take screenshots, and verify results. - Browser sessions run on Cloudflare’s global network, reducing infrastructure and browser-maintenance requirements. - Sessions can scale dynamically and open near users for lower latency. - The platform now supports up to 120 concurrent browsers, up from 30. ## Observability and Human Intervention - **Live View** shows an agent’s browser session in real time, making it easier to confirm success or diagnose failures. - **Human in the Loop** allows agents to transfer control when they encounter login screens or unusual edge cases. - A human can resolve the issue and return control to the agent. - **Session Recordings** capture DOM changes, interactions, and navigation for debugging and postmortem analysis. ## Browser Control Options Browser Run supports several levels of automation: - Low-level control through the Chrome DevTools Protocol (CDP). - Higher-level automation with Puppeteer and Playwright. - Quick Actions for simpler tasks. - WebMCP for websites that expose agent-discoverable actions. ### Chrome DevTools Protocol - Browser Run now exposes CDP directly through a WebSocket endpoint. - Existing CDP-based frameworks, scripts, and agent tools can connect with minimal changes. - CDP provides capabilities beyond Puppeteer and Playwright, including JavaScript debugging. - Raw protocol messages can be sent directly to models, potentially reducing token usage. - Developers can connect from any language or environment without creating a Cloudflare Worker. - Self-hosted Chrome scripts can be migrated by changing the browser WebSocket URL and adding Cloudflare authentication headers. ### MCP Client Support - MCP clients such as Claude Desktop, Cursor, Codex, and OpenCode can use Browser Run as a remote browser. - Cloudflare supports the `chrome-devtools-mcp` package, which provides browser automation, debugging, and performance-analysis capabilities. - Configuration requires pointing the MCP server to Browser Run’s CDP endpoint and supplying an API token. ### WebMCP - WebMCP is intended to make websites more reliable for AI agents. - Websites can declare actions that agents can discover and call directly. - This addresses the limitations of a web originally designed primarily for human navigation. ## Overall Direction Cloudflare’s update combines hosted browser infrastructure, multiple automation interfaces, real-time visibility, replayable sessions, and human fallback. The goal is to make browser-based agents more dependable in production while avoiding the operational burden of managing Chrome infrastructure themselves. For teams building web-using agents, Browser Run offers a practical path from self-hosted or local browser automation to scalable, observable remote sessions, especially when existing CDP, Puppeteer, Playwright, or MCP tooling is already in use.