The agent-web standards landscape,
in the order an agent meets it.
12 real, published standards across 5 pillars — Find, Act, Identity, Shop, Pay — with the real mechanism each one uses and whether AX Audit currently checks for it.
Five pillars, read left to right
The same order an agent actually meets a site: find what's there, act on it, prove who it is, shop the catalog, then pay. Each card names the real mechanism — not a vague description — so you can go check it yourself.
Help an agent find the tools, APIs and agents a site offers.
A machine-readable manifest at a well-known path, listing the tools, APIs and agents a site exposes.
ARD's legacy discovery path — same lineage, same purpose, different well-known filename.
Let an agent use the site directly, instead of guessing at buttons.
A page registers real tools an in-browser agent can call directly — no scraping, no guessing at the DOM.
A conversational search endpoint that answers natural-language questions about a site, structured for agents.
Prove which agent is visiting, and whom it acts for.
Signs every bot request with HTTP Message Signatures, so a server can cryptographically verify who sent it.
A well-known identity profile that lets an agent present verifiable claims about itself and its operator.
A plain-text convention — the llms.txt pattern applied to authentication — describing how agents should authenticate.
Let an agent browse a catalog, fill a cart and check out.
Universal Commerce Protocol — a well-known manifest describing a catalog, cart and checkout an agent can drive.
Agentic Commerce Protocol — structured product feeds and checkout endpoints agents can call to complete a purchase.
Let an agent pay, with proof a person agreed.
Agent Payments Protocol — cryptographically signed mandates that prove a human authorized an agent's purchase.
A payment-required handshake built on plain HTTP status codes and headers, no new protocol to adopt.
Maturity is a fact, not a marketing word
Every badge above reflects where a standard actually sits today — not where its backers wish it were.
Live in production traffic today, with real adoption beyond the standard's own authors — x402, UCP, ACP, and Web Bot Auth all qualify.
Specified and implemented by early adopters, but not yet the default anywhere — WebMCP, NLWeb, Poppy, auth.md, AP2, and MPP sit here.
A published draft spec with no broad implementation yet — ARD and its legacy ai-catalog path are still at this stage.
AX Audit already measures 2 of these 12
2 standards (WebMCP, x402) are fully covered by a real check in every AX Audit scan today. 2 more (NLWeb, Web Bot Auth) are partially covered. The rest are tracked gaps, each with an open, public issue — click through on any "Gap" or "Partial" pill above to see the real work in progress.
WebMCP Tool Quality and x402 payment-flow checks are live, weighted parts of every AX Audit scan — not a separate pipeline, not a roadmap item.
NLWeb is checked for its /ask endpoint only; Web Bot Auth is checked for its key-directory only. Both have an open core issue tracking the rest of the spec.
ARD, ai-catalog, Poppy, auth.md, UCP, ACP, AP2, and MPP aren't checked by this scanner yet. Each has its own open issue in AINative's core repo — not a silent omission.