MCP server cards, x402, OAuth Protected Resource, NLWeb, Web Bot Auth: the standards that will define the next decade of agent-to-website interaction.
While most SEOs are still debating whether to allow GPTBot, a parallel stack of standards is being built for agent-to-website interaction: MCP server cards, x402 micropayments, OAuth Protected Resource discovery, NLWeb, Web Bot Auth and DNS for AI Discovery. Less than 2 percent of sites support any of them. The brands that adopt even two in 2026 will lead their category for the rest of the decade.
A quiet revolution is happening in the web platform. Over the last 18 months a stack of new standards has emerged for agent-to-website interaction. None of them are about ranking, citations or visibility. They are about agents actually being able to do things on websites: read structured data, authenticate themselves, pay for content, discover capabilities, and act on behalf of users.
The Spacemen Digital Website AI Agent Readiness Check audits for 23 of these emerging standards. The aggregate result across thousands of audited domains: under 2 percent of sites support any of them. The agentic web is being designed for a future that almost nobody is preparing for.
Model Context Protocol (MCP) server cards let an agent discover what data and tools a site exposes. Agent Skills manifests declare what actions an agent can take. WebMCP is the browser-callable variant. x402 revives HTTP 402 Payment Required so agents can pay per call. OAuth Discovery (RFC 8414) and OAuth Protected Resource (RFC 9728) let agents auto-discover authentication endpoints. Web Bot Auth uses HTTP Message Signatures to cryptographically authenticate agent requests. NLWeb (Microsoft) describes site capabilities in natural language. DNS for AI Discovery (DNS-AID) puts AI metadata in DNS TXT records.
None of these are theoretical. MCP server cards work today. x402 is being shipped by Coinbase and others. OAuth Protected Resource is a published RFC. The standards exist. The implementations are happening. The question is which brands will be ready to participate when agentic commerce, agentic research, and agentic browsing become the default interaction model in two to five years.
The marginal cost of publishing an MCP server card is small. A well-known URI, a JSON manifest declaring what the site can do, the same structured content the brand is already writing. The cost of declaring OAuth Protected Resource metadata at the standard location is small. The cost of registering with a Web Bot Auth signature directory is small.
These are weekend projects, not multi-quarter initiatives. The reason they don't happen is not cost. It is that almost nobody has heard of them yet.
Brands that adopt frontier standards now will become the reference implementations agents are built against. When OpenAI ships ChatGPT agents that can browse and act, the brands that already have MCP server cards will be the ones the agents can actually use. The brands with x402 will be the ones agents can transact with. The brands with Web Bot Auth will be the ones agents trust.
This is the same shape of opportunity that mobile-first sites had in 2014, structured data had in 2015, and llms.txt has today. Early movers compound. Late movers chase.
We recommend brands adopt two frontier standards in 2026: MCP server card and OAuth Protected Resource metadata. Both are well-defined, low-cost, and forward-compatible. The Spacemen Digital Website AI Agent Readiness Check at https://spacemendigital.com/tools/website-ai-agent-readiness-check/ tests for all 23 standards so you can see where you sit.
Free 50-signal AI Agent Readiness Check to see where you sit, plus a scoping call to discuss what we would ship.
Score my site →