![[Translate to English:] Serverschrank im halbdunklen Rechenzentrum mit leuchtenden blauen Status-LEDs an einem Patchfeld.](/fileadmin/_processed_/c/4/csm_e1c62ab00ffafca3ade9d9402d5e54c7fed1fa3eca8c1f7216554f051fe7a4ea_770909362f.webp)
Two days ago we reported on this blog that moselwal.de is one of the few websites worldwide that achieved a score of 100 out of 100 in the Cloudflare Agent Readiness Check. Brief recap: with isitagentready.com, Cloudflare has launched a kind of Lighthouse for AI agents and measured 200,000 top websites. The headline finding: the web is not yet ready for agents.
Since then we've had a lot of messages from clients, partners and the wider TYPO3 community. The most common question: “What does that mean concretely for us, and when will we get there?” This post is the answer. It is explicitly an update; you'll find the technical foundations in the original article at /blog/level-5-agent-native-100/100-im-cloudflare-agent-readiness-check.
Where we are in the rollout
We are now rolling the package out to existing clients in stages, as part of the next scheduled upgrade. “Level 5 Agent-Native” isn't an add-on module you buy once and forget about. It's part of our CMS-as-a-Service platform and is embedded into the regular upgrade windows, without your team having to set up a project for it.
The current wave includes mid-market websites running TYPO3 14 LTS. The first systems are live in production; more will follow over the coming weeks. Every rollout includes the same core:
- TYPO3 14 MCP extension for structured access to content and resources
- Front-end MCP server and WebMCP tools, so agents can not only read but interact meaningfully
- MCP OAuth 2.1 with PKCE as the safeguard for authenticated agent access
- Web Bot Auth with Ed25519 signatures, so legitimate agents are clearly distinguishable
- Fine-grained bot access rules along the four dimensions of the check
In the score, that translates to Discoverability 3/3, Content 1/1, Bot Access Control 3/3 and API/Auth/MCP/Skill Discovery 6/6.
What we've learned from the first rollouts
Every production setting brings different conditions, and this rollout wave is no exception. Three findings run through every installation so far.
1. Clean content pays off twice
Websites we have consistently moved into our three-layer model over the past few years are the first to pass through the rollout without friction. Structured content, clear taxonomies and consistent metadata are the foundation that lets an agent not just crawl your site but understand it.
2. Bot access control is a leadership topic
Deciding which agent is allowed to do what is not a technical detail but a strategic decision. We work it through with you during the rollout: which AI search engines should be allowed to cite your content? Which training crawlers are ruled out? Which agents may your own team set up? We bring proposals and default policies that fit your business model.
3. MCP only works with governance
An open MCP server without authentication is, at best, naive. We therefore consistently rely on MCP OAuth 2.1 with PKCE and Web Bot Auth. That way you know at any time which agent is acting in your name and which isn't.
What the score means for your organisation
For the German mid-market, agent readiness is not an academic topic. More and more buying, research and evaluation paths now run through AI assistants. If your website is unreadable or not authenticatable for those agents, you lose visibility without classic analytics tools even showing the loss.
A 100/100 score isn't an end in itself. It is evidence that your digital infrastructure is robustly set up for the agentic web. For you that means: more findability in agent answers, robust authentication of legitimate bots, clear defence against everything else and a CMS operation that maintains this standard in steady state.
If you'd like to be in one of the next waves
If you're already a CMS-as-a-Service client, we'll reach out to you actively as soon as your upgrade window comes up. You don't need to do anything except agree the rollout dates with us. If you're not working with us yet, we start in the classic way — with an intake conversation.
30 minutes, no pitch. We look together at where your system stands today in the Agent Readiness Check and which path makes most sense for getting you to 100/100.
Frequently asked questions
What clients ask us most often on this topic — answered openly.
What if the standards still change?+
We absolutely expect that. MCP, Web Bot Auth and the related protocols continue to evolve. We keep your system current as part of our operating model, without you having to spin up a project for each step.
Do we need our own AI strategy and AI team for this?+
No. Level 5 Agent-Native is infrastructure, not an AI strategy. You prepare your website so that AI agents can use it correctly and securely — regardless of whether you build AI products yourself or not.
Do we decide ourselves which AI bots may use our site?+
Yes, very much so.
Bot Access Control is not a side issue, it is part of your digital strategy.
Together we define rules that fit your business model and put them in place technically — e.g. via robots.txt, access controls and network rules.
At the same time: full control over external crawlers cannot exist on the open internet. What matters is a clean, well-thought-out approach to access — not the illusion of absolute lock-down.
What does the rollout cost us on top?+
For existing CMS-as-a-Service clients, the rollout is part of the upgrade window and therefore included in the agreed model. For external projects we do a baseline assessment up front and quote the effort transparently.
We're still on TYPO3 12 or 13 — are we out?+
No, you're not out, but the current wave is built for TYPO3 14 LTS. We plan your upgrade path together and decide whether an interim step makes sense or whether we lift you straight to TYPO3 14 and therefore to Level 5 Agent-Native.