Web A / The stack

The agentic web already has a stack.

Five layers. Live protocols. Real companies shipping each one, today.

Most of the web is invisible to agents. Cloudflare scanned the 200,000 most visited sites and found fewer than 15 carry the agent-native standards that let an agent authenticate and call a real action. The rest still speak only to old search crawlers. The gap is the opportunity.

The map

The stack, ground floor up. Find, read, verify, call, cooperate.

It stacks like a society. Each layer assumes the one below it. Tap any layer to open the live protocols, the companies shipping them, and the numbers.

Layer 1 is the ground floor. An agent has to find you before it can read you, read you before it can trust you, trust you before it can call you, and call you before you can settle up and cooperate.

1

Discovery be found

Shopify auto-shipped these files to every store, with no merchant action.

The live protocols

  • llms.txtA plain-language file at a known address that explains a site to an agent. Originated by Jeremy Howard at Answer.AI, September 2024.
  • ai-agent.jsonA machine-readable manifest. The site's business card: what it is, what it can do, where to look.
  • agents.txtStates how to work with a site as an agent.
  • /.well-known/*The agreed-on folder where agents already know to look for all of the above.

Who ships it

  • Answer.AI originated llms.txt in 2024. It is now the default discovery file.
  • Shopify quietly switched llms.txt, llms-full.txt, agents.md, a /.well-known/ucp folder, and an MCP endpoint on for every store in May 2026, with no merchant lifting a finger.
  • Cloudflare measures discovery as the first of its agent-readiness categories.

Source: Shopify rollout, May 2026 · llms.txt origin

2

Content be read

Only 3.9% of the 200,000 top sites can hand an agent clean Markdown.

The live protocols

  • Markdown content negotiationA site serves the same page as clean text when an agent asks for it, instead of a wall of layout. Meaning over decoration.
  • Structured data (JSON-LD)Schema.org markup that tells an agent what a page means, not just how it looks.

Who ships it

  • Cloudflare scores Content as one of its agent-readiness categories, and found only 3.9% of the top 200,000 sites support Markdown negotiation.
  • The open web already carries JSON-LD widely for search. The same markup is what lets an agent read meaning. This page ships it too.

Source: Cloudflare Agent Readiness, 2026-04-17

3

Trust be verified

A2A passed 150+ organizations in its first year, with production use.

The live protocols

  • Signed agent cards (JWS)A passport for an agent. The card is signed so you can verify it was not tampered with. Part of the A2A spec.
  • Per-request signaturesA signature on every message, so nobody can forge or alter it between two agents in flight.
  • Mandates (AP2)A signed receipt that proves a human actually consented to an action. Cryptographically verifiable credentials.

Who ships it

  • A2A / Linux Foundation defines the signed agent card. At its one-year mark in April 2026 it surpassed 150 organizations and landed in major cloud platforms with production use.
  • Google AP2 adds mandates: signed proof of user consent that a merchant and a network can each verify independently.

Source: A2A specification · A2A at one year, 150+ orgs

4

Execution be called

The agent-native call standard shows up on fewer than 15 of 200,000 sites.

The live protocols

  • MCP (Model Context Protocol)Tools an agent can call, not just text it can read. The difference between a site an agent can describe and one it can actually use.

Who ships it

  • Anthropic created MCP. It is now the common way to expose callable tools to an agent.
  • The MCP ecosystem spans thousands of servers, but on the open web it is still rare. Cloudflare found MCP server cards and machine-readable API catalogs on fewer than 15 sites across the entire top 200,000.
  • Immersive Commons runs MCP in production today, so a member's agent can call real tools on the floor.

Source: Cloudflare Agent Readiness, 2026-04-17 (fewer than 15 sites carry the API + auth standards)

5

Payments + A2A settle and cooperate

x402: 165M+ payments, ~$50M moved, across 69k agents.

The live protocols

  • x402An open standard that uses the old HTTP 402 status code so one agent can pay another in seconds, with no human login.
  • AP2Mandates: signed proof of consent that stacks on top of a payment. One signature says you agreed, the other says money moved.
  • ACPThe Agentic Commerce Protocol. Instant checkout inside ChatGPT.
  • A2AAgent to agent. The layer where your agent and mine cooperate directly.

Who ships it

  • x402 Foundation (Coinbase-originated) backs x402, with a member list that reads like the financial system: Visa, Mastercard, Stripe, Google, AWS, Microsoft, Circle, American Express, Shopify. As of April 21, 2026 it had moved 165M+ payments, about $50M, across roughly 69,000 active agents (lifetime totals).
  • Google ships A2A and AP2.
  • Stripe + OpenAI shipped instant checkout inside ChatGPT via the Agentic Commerce Protocol.

Source: x402 Foundation · volume, 2026-04-21 · Stripe + OpenAI ACP

The move

become a Web A citizen

The stack is open. You can be on it by tonight.

You do not need all five layers to start. You need the bottom one. Ship the discovery files and an agent can find you, read you, and cite you. That is what makes a site a Web A citizen. This very page is one.

  1. Ship an ai-agent.json at /.well-known/ai-agent.json, so agents can find you.
  2. Ship an llms.txt at your root, so they can read you in plain language.
  3. When you are ready, add MCP so agents can call you, the way Immersive Commons already does.
Read the whitepaper Join the network

Every number, sourced

We don't invent the figures.

  1. Bots = 53% of web traffic in 2025, the second straight year automation outnumbered humans. Imperva Bad Bot Report 2026. imperva.com
  2. AI web traffic grew ~187% in 2025 while human traffic grew ~3%. HUMAN Security, 2026 State of AI Traffic. implicator.ai
  3. Agents pass humans by 2027, Cloudflare CEO Matthew Prince, March 2026. techcrunch.com
  4. Discovery: Shopify auto-shipped llms.txt + agents.md + MCP to every store, May 2026. craftshift.com · llms.txt origin: answer.ai
  5. Content + Execution: 3.9% support Markdown negotiation; fewer than 15 of 200,000 sites carry the agent-native API + auth standards. Cloudflare Agent Readiness, 2026-04-17. blog.cloudflare.com
  6. Trust: A2A signed agent cards; 150+ organizations at one year. A2A spec + Linux Foundation. a2a-protocol.org · linuxfoundation.org
  7. Trust + Payments: AP2 mandates are signed verifiable credentials. zinc.com
  8. Payments: x402, 165M+ payments / ~$50M / 69k agents (lifetime, as of 2026-04-21). x402 Foundation. x402.org · volume: coinbase.com
  9. Payments: Stripe + OpenAI Agentic Commerce Protocol, Instant Checkout in ChatGPT. stripe.com

A note on honesty: x402's 165M / $50M / 69k figures are lifetime totals, not daily. Current daily volume is small and partly test traffic. The claim here is only that agents already pay each other, and they do.