The agent layer: the six signals almost no website has yet

Six of the nineteen signals checked in an AI visibility scan do not look at what an AI can read on your site. They look at what a software agent can understand and do there: an agent-readable version of your content, a capability card, a skills index, an authentication framework, a service catalogue and an access guide. This is the axis almost no website satisfies today, and it is the only one whose absence is invisible when you look at your own site.

What does an AI agent need from a website, beyond its content?

An AI agent needs a declared interface, where a human reader is happy with a page. The Model Context Protocol (MCP), whose 2026-07-28 revision is published on modelcontextprotocol.io, defines what a service exposes to an AI application: resources, meaning data; prompts, meaning procedures; and tools, meaning functions the model can execute. None of the three has a visual equivalent on a web page.

The difference is one of kind, not degree. Well-written copy lets a generative AI quote your company in an answer. That same copy does not let an agent check availability, request a quote or place an order. The MCP specification also requires explicit user consent before a tool is invoked, which presupposes that the tool exists and is described somewhere a machine can find it.

Why does an agent look for a file instead of a page?

An agent looks for a file because a file can be read without interpretation. Google asks merchants who want to sell inside its AI answers to host a UCP profile (Universal Commerce Protocol) at a fixed public path, /.well-known/ucp. The Google for Developers documentation states that this JSON file must be publicly accessible with no authentication, and that it declares the merchant's capabilities, the protocol versions supported, the endpoints of its services, the payment configuration and the public keys that sign its messages.

That fixed path is the opposite of a home page. A generative AI can infer the meaning of a paragraph, and then paraphrase it badly. An agent that has to trigger an action infers nothing: it reads a declaration at an address it knew in advance, or it moves on. This was already the lesson of "Google put a cart inside its AI answers. Agents find you through a file, not your pages." The agent door is not one of your pages.

What exactly do the six agent signals check?

The six signals on the agent axis check whether the public declarations an agent would come looking for exist on your domain, and whether they can be read. A Biencité scan reads them in read-only mode, the way an AI crawler would, installing and changing nothing:

• an agent-readable version of your content, rather than the rendering built for humans;
• a capability card, stating what your site allows an agent to do;
• a skills index, listing the operations you expose;
• an authentication framework, stating how an agent identifies itself before acting;
• a service catalogue, describing what you sell in a form a machine can use;
• an access guide, setting out the rules for using those interfaces.

The full list of nineteen signals, across the three axes, is published on /en/methode. The weight of each signal is not published and will not be: weights move as generative engines change their habits, and a public scoring table would invite people to optimise the score rather than the visibility.

Why is this axis read separately from the other two?

The agent axis is read separately because a strong agent score cannot offset a failure upstream of it. A scan verdict does not come from an average, it follows a cascade. A site whose content AI cannot read is declared invisible to AI, whatever the rest of the score says. A site that is readable but unstructured is visible, but not citable. A site that holds the first two axes without the agent layer gets the verdict readable and citable.

That separation is what prevents absurd advice. Installing agent files on a site that AI crawlers cannot read produces nothing, and a single blended score would hide exactly that order of priority. "Why an AI visibility scan checks 19 signals, not fifty" explains why the list stays short; the cascade explains why the order matters as much as the list.

Is having these files enough to get picked by an agent?

No, and Google's own documentation says so. To sell through UCP in AI Mode and in Gemini, a public profile is not sufficient: Google states that the integration must be approved before it goes live, and that eligibility also depends on product data approved in Merchant Center. The file is an entry condition, not an entry ticket.

This is the same limit that applies to the other two axes. An AI visibility scan measures eligibility: the conditions without which a citation, or an automated action, is very unlikely. It does not promise the citation, and no serious tool can.

Why measure a layer almost nobody has?

Because this is the axis where the gap between websites is still open, and because an honest report has to distinguish three states rather than two. A missing signal is an observed absence. A signal that could not be reached, through a timeout or a server error, is marked not measured and leaves the calculation instead of counting as zero. A signal your platform forbids is marked impossible and never appears in your action plan: Shopify, Wix, Webflow and Framer lock certain files at the domain root, and those signals are not counted against your site.

Every report therefore states how many of the nineteen signals were actually verified. A score that dropped because a server was slow to answer would be measuring the weather that day, and you would end up paying to fix a problem that does not exist.

When is the agent layer the wrong thing to spend on?

The agent layer is the wrong thing to spend on when your site has nothing to expose, or when a more serious problem comes first. These cases are common:

• your verdict is invisible to AI, in which case crawler access and readable content come before everything else;
• you do not sell or take bookings online, so a service catalogue would have nothing to describe;
• your site has no content an AI could cite yet, and the money belongs in writing rather than in files;
• nobody searches for you by name yet, because reputation is not installed with a public file;
• your platform locks the domain root, which turns this into a migration decision rather than a checkbox.

There is one more, plainer reason to wait: these protocols are still moving. The MCP specification carries a revision date, and the UCP profile has gone through successive versions, including 2026-04-08. Shipping a declaration you will not maintain is worth less than a site that is readable, citable and accurate about what it offers.