The Agentic-Web Cheatsheet

Agents are the new browsers. More and more of the visits to your site will come from an AI agent that someone sent to compare, book, buy or file a return on their behalf. Since mid-2025, a dozen new open standards have appeared to teach websites how to deal with that.

They're easy to mix up. They're young, they overlap, several are only drafts, and the press releases make all of them sound finished. So here's the whole map in one place: what each standard does, who's behind it, and how real it actually is today.

The short version: twelve standards, five jobs, and only four of them (UCP, ACP, x402 and Web Bot Auth) carry real production traffic yet. Some help an agent find what a website offers, some let it use the site directly, some prove who the agent is, some let it shop, and some let it pay. The rest are drafts or early experiments.

“This article is a snapshot. The living version, kept up to date and open to contributions, is at ax.guide.”

Read it left to right as an agent's visit: find what's offered, use the site, prove who it is, shop, then pay. Green means real traffic today; x402's is real but small.

A search engine for agent tools. Today an AI assistant can only use the tools someone wired into it beforehand, like a phone that only runs its pre-installed apps. ARD flips that. A website publishes a small file at /.well-known/ard.json (".well-known" is just the web's agreed folder for files like this, the same idea as robots.txt) listing what it offers: an MCP server, an agent other agents can talk to, an API, a skill. Separate "registries" collect these files and answer plain-language searches. Say your travel agent needs a live-weather tool it has never heard of: it asks a registry, gets a ranked list, checks who published each tool, and connects. A high ranking doesn't mean a tool is trustworthy; the spec keeps relevance and trust separate. Entries can include sample questions a real user would ask, which makes search work better.

Google announced ARD on June 17, 2026. The current version is v0.91, a "Proposal" dated August 26, 2026, from authors at Google and Hugging Face plus R.V. Guha (the creator of RSS and Schema.org). It tells agents to look for ard.json first and treats the older ai-catalog.json address as its predecessor. On July 9, 2026 the two formally split into a publishing format (ai-catalog) and a discovery format (ARD). The file name changed within a few months, so early tutorials already show the old address.

Reality check: early. Hugging Face runs a public registry, but one independent check in June found that none of the named contributor companies served a catalog yet.

Your site's table of contents for AI. It doesn't contain the chapters; it tells you where each one is. MCP servers, AI agents, plugins and datasets each invented their own way to be found, so an assistant would have to know a dozen conventions. AI Catalog replaces that with one JSON list at /.well-known/ai-catalog.json, where each entry says what kind of thing it is and either links to its full description or includes it. A restaurant that works with a booking provider and a jobs provider can list both AI tools, so any assistant that only knows the restaurant's web address can find the booking tool. Catalogs can also point to other catalogs, so a big platform can list many sub-catalogs.

It's developed in a Linux Foundation working repository (started October 2025) with members from the MCP and A2A communities, and published at ai-catalog.io. Even the group's name is inconsistent: ai-catalog.io calls it the "Agent Card Working Group," while Google thanks the "AI Catalog Working Group." Its biggest recent boost: MCP's "Server Cards" proposal points discovery at ai-catalog.json (reported as finalized October 6, 2026, though one implementer still saw it in review). ARD calls ai-catalog its predecessor, but ai-catalog sees itself as a lightweight publishing format that stays separate: it was split off, not retired.

Reality check: early, with experimental catalogs at GitHub, Buildkite and Hugging Face. The fix is easy: serve the same file at both ai-catalog.json and ard.json.

Your website's own shop assistant, one who answers from your stock list rather than making things up. Most websites already describe their content in structured ways (Schema.org tags, RSS feeds), yet you can still only search them with keywords. NLWeb indexes that structured data and adds an "ask" endpoint: type "vegetarian recipes under 30 minutes without nuts" and get answers drawn only from that site. Every NLWeb site is also an MCP server, so AI agents can ask the same questions through a standard plug. Cloudflare offers a one-click "NLWeb Website" option that crawls your site and sets up an /ask page for people and an /mcp endpoint for agents.

Microsoft introduced it at its Build conference on May 19, 2025; R.V. Guha conceived it. The code is open source and the current spec is v0.55. A W3C community group launched in October 2025 but still has no chairs, 15 participants and no published reports, and community groups aren't a standards track, so NLWeb is not a W3C standard. Launch partners included Allrecipes, Eventbrite, Tripadvisor, O'Reilly and Shopify. A security bug that let attackers read server files was reported and fixed in mid-2025. It complements ARD and ai-catalog (which can list an NLWeb endpoint) and differs from WebMCP, which works inside the browser page.

Reality check: early. Nobody publishes a deployment count, partly because NLWeb has no fixed address to crawl.

A labeled menu of actions for the agent in your browser. More and more AI assistants work inside your browser, clicking and typing on the page for you. Today they mostly do it by looking: reading the page's code or a screenshot, guessing which box is "departure date," and hoping the "Book" button didn't move in last week's redesign. WebMCP lets the site say it plainly. A page registers "tools" in JavaScript (document.modelContext.registerTool()) with a name, a plain-English description, the fields it expects and the function that does the work, or tags an existing form with two attributes, toolname and tooldescription. On a hair-salon site, the agent stops hunting for the calendar widget and calls book_appointment with a date, time and service. It all happens in your own tab and signed-in session, so you can watch and step in.

Microsoft and Google proposed it together in August 2025; the W3C's Web Machine Learning community group took it up that September, with editors from both companies. The current text is a draft dated October 9, 2026 that says plainly it is "not a W3C Standard." Chrome has been testing it in a time-limited "origin trial" (Chrome 149–156) since May 2026; on September 28 Google asked to extend the trial to Chrome 162 because feedback is still changing the API, so there's no ship date. Edge runs its own trial (since Edge 150, through March 30, 2027) and calls it "ready for testing." ChatGPT's desktop browser calls these "site tools" automatically, and Shopify puts WebMCP tools on every standard storefront, including a checkout tool that only completes after the buyer confirms. Safari's team opposes it and Firefox is neutral. Its neighbours: MCP servers serve agents that never load your page, and computer-use agents that read the screen remain the fallback. A related layer, MCP Apps (not one of the twelve), goes the other way: it lets an MCP server ship interactive UI into the agent's chat. One caveat: a page's tool descriptions are text the AI reads, so a malicious site can try to trick the agent, and Chrome says the defence is the agent's job.

Reality check: early use with two big real-world users, ChatGPT's desktop browser and Shopify, while Chrome and Edge are still in trials.

A tamper-proof ID badge for bots, instead of a name tag anyone could write. Today websites identify bots by a label (the "user agent") that anyone can fake, or by IP address, which breaks easily. With Web Bot Auth, the company running the bot publishes a public key at a well-known address and signs every request with the matching private key, using an existing IETF standard for signing web requests (RFC 9421). The website, or its CDN such as Cloudflare, checks the signature and knows for certain "this really is OpenAI's agent" before deciding to let it in, block it or charge it. A news site can let a verified shopping agent through while stopping an anonymous scraper wearing the same label.

Cloudflare proposed it in May 2025. On September 1, 2026 the IETF's webbotauth working group adopted it as an official working-group draft, written by authors from Cloudflare and Google; it's the group's only adopted document. It's still a draft, not an RFC: adoption isn't approval. Visa's Trusted Agent Protocol and Mastercard's Agent Pay build on it, adding a tag that says whether the agent is browsing or buying, and observers report OpenAI, Cloudflare and DuckDuckGo signing requests today. It answers which agent is visiting, not whom it represents; that's Poppy's and OAuth's job. The next revision is expected to change how the key directory is referenced, so early implementations may need updates.

Reality check: in production. A draft, but a real one.

A valet key for your personal agent. It lets the agent act for you at a company, with only the permissions you gave it, without opening the boot or the glovebox. Right now an AI agent acting for you has two bad options: pretend to be you in a browser, or not get in at all. Poppy gives the company a file at /.well-known/poppy.json that says how agents can start a session, how you sign in, and which web pages, APIs and company agent are available. Sign-in uses OAuth, the familiar "Sign in with…" approval screen: you approve on the company's own page, on another device with a code, or (if the company allows it) the agent signs in for you. Permissions are simple scopes like "read" and "write," plus custom ones such as "manage saved addresses." You also get a different anonymous ID at each company, so companies can't match you with each other. In the launch demo, Meta's Muse agent found Rocket Mortgage's agent and, with the user's permission, completed a mortgage pre-approval.

Sierra (led by Bret Taylor and Clay Bavor) and Meta announced it on October 6, 2026, with Genesys, Instinct, Rocket, Shopify, Stripe and Walmart as partners, then published Draft 0.1 on October 9 with 35 design partners (reported to include OpenAI, Visa, Mastercard and PayPal). The spec warns that any part can change, even in ways that break compatibility, and lists payments as not yet covered. A reference implementation is promised within about a month. It reuses OAuth, OpenAPI and MCP rather than replacing them, sits next to Web Bot Auth (which proves the bot's identity), and leaves shopping to UCP/ACP and payment consent to AP2.

Reality check: a draft first published October 9, 2026. Impressive partners, but no company is publicly known to serve a working poppy.json yet.

A sign-up page written for robots. When your agent needs a service you've never used, it hits a wall built to keep bots out: an email, a password, a CAPTCHA, a confirmation link. So it stops and asks you to make an account and paste back a key. auth.md replaces the wall with instructions at yourapp.com/auth.md. Ask a coding agent to add web scraping to your app, and it calls the scraping service, gets "401: who are you?" plus a pointer to the service's login details and auth.md file, then signs you up one of three ways: vouched for, where the company running the agent signs a short-lived pass saying "this is a verified user" and registration finishes on its own; by email, where you type a 6-digit code on the service's own page; or anonymously, where the agent starts with limited access and you "claim" the account later. Either way, it ends with a normal, short-lived, revocable OAuth token tied to you.

WorkOS, an identity company, published it as an open, MIT-licensed spec on May 21, 2026 and shipped six versions in three weeks, reaching v0.6.0 on June 10. It isn't with any standards body; WorkOS's own recap calls it "a spec, not an IETF-ratified standard." It's built from existing parts: OAuth's login-discovery files, and a vouching token ("ID-JAG") that is itself a draft in the IETF's OAuth working group. WorkOS lists 15 adopters, and implementations vary a lot: Neon lets an agent spin up a temporary database the person claims within 72 hours; Cloudinary does the same with a temporary media cloud claimable within 24 hours; monday.com has the agent solve a captcha and then creates the account; Firecrawl only accepts identities vouched for by WorkOS; Cloudflare and Resend said "not yet" at last check. Several follow the idea more than the exact spec. MCP's latest spec (2026-07-28) recommends identifying the app with Client ID Metadata Documents, while auth.md adds on whose behalf; Poppy signs in existing customers, auth.md signs up new ones.

Reality check: early use, and growing. The fully hands-free "vouched for" path needs the big agent makers to issue those passes, and none (Anthropic, OpenAI, Cursor) has announced it yet.

A universal power socket for shopping. Any assistant plugs into any store without a custom adapter. UCP defines the common steps of buying (catalog, cart, checkout, order) and carries them over ordinary web APIs or the plugs agents already use (MCP, A2A). A store describes what it supports at /.well-known/ucp. Ask Google's AI Mode for waterproof hiking boots under $150, and it compares several shops and checks out right in the chat, while the retailer stays the "merchant of record," the legal seller who handles returns and customer data.

Google launched it with Shopify on January 11, 2026, co-developed with Etsy, Wayfair, Target and Walmart. A Governing Council has Google and Shopify as permanent members, and Stripe joined on April 28; a technical council added Amazon, Meta, Microsoft, Salesforce and Stripe in April, and industry councils for food, lodging and payments followed over the summer. A council seat isn't a storefront: Amazon being at the table doesn't mean Amazon sells through UCP. The current release, v2026-08-25, added support for more industries and stronger card security. Its rival is ACP, AP2 plugs in for payment consent, and Poppy may overlap on sign-in.

Reality check: in production, and the most real of the twelve: an independent checker counts more than 15,000 verified storefronts, mostly through Shopify. One catch: the August release made 17 breaking changes, so "supports UCP" doesn't tell you which version.

A catalogue mailed straight to your personal shopper, with an optional order form attached. ACP started as the plumbing for buying inside ChatGPT: a merchant shares a product feed and checkout endpoints, and payment travels as a one-time token tied to one merchant and one amount, so the assistant never holds your card number. The original idea: ask ChatGPT for a ceramic mug, see an Etsy seller's listing, and tap to buy without leaving the chat. Today its main job is discovery: merchants push feeds and promotions so ChatGPT shows accurate, current products, prices and comparisons.

OpenAI and Stripe launched it on September 29, 2025, alongside "Instant Checkout" in ChatGPT. The spec is still labeled beta; its latest stable version is dated April 17, 2026. On March 24, 2026 OpenAI said it was expanding ACP to support product discovery, naming Target, Sephora, Nordstrom, Lowe's, Best Buy, The Home Depot and Wayfair as integrated, while checkout moved back to the merchant's side. Its rival is UCP (Stripe sits in both camps), and payment rails like AP2, MPP and x402 can sit underneath.

Reality check: in production for discovery. The headline feature that launched ACP, buying inside ChatGPT, is exactly the part that was scaled back.

A signed, notarized shopping list with a spending limit the bank can check before paying. When an agent pays, the bank and merchant need answers to "did a real person agree to this?" and "who's liable if it goes wrong?" AP2 answers with mandates, tamper-proof signed records of your instructions. An intent mandate captures what you asked for ("concert tickets, under $200, this week"); a cart mandate locks the exact items and price; a payment mandate tells the card network an agent was involved. Version 0.2 adds "Human Not Present" purchases: you pre-sign the rules, and the agent buys later when conditions are met, say when tickets go on sale at 3 a.m. It works with cards, bank transfers and stablecoins. AP2 authorizes payments; it doesn't process them.

Google announced it on September 16, 2025 with more than 60 organizations, including American Express, Coinbase, Mastercard, PayPal and Salesforce. On April 28, 2026 Google released v0.2 and handed AP2 to the FIDO Alliance (the group behind passkeys), which formed working groups chaired by members from Google, OpenAI, CVS Health, Visa and Mastercard. Mastercard's Verifiable Intent, a similar auditable record of what a user approved, co-developed with Google, went to FIDO at the same time. FIDO's work is only months old, so v0.2 isn't yet a FIDO-approved standard.

Reality check: early. Real use is mostly inside other protocols, like the AP2 extension in UCP's latest release; consumer-facing AP2 checkout is still limited.

A turnstile that takes a tap of your card. No account, no membership; pay and walk through. Paying for an online service usually means signing up, getting a key and setting up billing, which an autonomous agent can't easily do. MPP uses the web's long-unused "402 Payment Required" code: the server replies "this costs 2 cents, here's how to pay," the client pays, and the server returns the result plus a receipt. It supports one-off charges, subscriptions and streaming pay-as-you-go "sessions," with stablecoins on Stripe's Tempo blockchain or ordinary cards through Stripe. Picture a research agent paying a fraction of a cent per article from a paywalled archive and settling the total when it finishes.

Stripe and Tempo launched it on March 18, 2026, the same day Tempo's payments blockchain went live. Its core spec is an IETF Internet-Draft (draft-httpauth-payment-01, September 9, 2026), but an individual one: the IETF lists it as having no formal standing, and no working group has taken it on. The ecosystem is growing (Circle drafted a USDC payment method), and MPP now accepts x402's simplest payment flow from the same toolkit, so the two are more compatible than competing.

Reality check: early use, live on Tempo. Unlike x402, no neutral foundation owns it; it's written and maintained by two companies with a commercial stake.

A parking meter on every web page. Drop in a few cents and the gate opens; no account needed. The internet never had a built-in way to charge tiny amounts, so content is either free with ads or behind subscriptions. With x402, a server answers "402: pay $0.01 to this address," the client attaches a signed stablecoin payment (usually USDC), and a "facilitator" settles it on a blockchain in seconds, for fees of a fraction of a cent that card networks can't match. Picture an agent paying a weather API a cent per lookup, or a crawler paying a publisher per page instead of being blocked.

Coinbase created it, and version 2 shipped on December 11, 2025. The Linux Foundation announced an x402 Foundation on April 2, 2026 and made it operational on July 14 with 40 members; the 17 premier members include AWS, Google, Visa, Mastercard, American Express, Stripe, Shopify, Cloudflare, Coinbase and Circle, the broadest coalition of any agent-payment standard. Its neighbours: MPP (which now accepts x402 flows), AP2 (which can settle through it), and Web Bot Auth (Cloudflare pairs them for pay-per-crawl).

Reality check: in production, but small. Cumulative counts range from about 100 million to more than 200 million transactions, but CoinDesk (March 11, 2026) found about $28,000 a day of real payments, averaging about 20 cents, with roughly half judged artificial. Cloudflare's "billion 402 responses a day" counts payment requests, not payments. Count dollars, not transactions.

Three patterns jump out once you see all twelve side by side.

Platforms move faster than standards bodies. The standards with real traffic are the ones a big platform switched on: Shopify accounts for most of UCP's 15,000+ verified storefronts and puts WebMCP tools on every standard storefront; Visa and Mastercard build on Web Bot Auth; OpenAI pipes ACP feeds into ChatGPT. The drafts with the most impressive partner lists are often the ones with no known deployments.

Partner lists aren't adoption, and transaction counts aren't commerce. A design-partner list isn't a deployment list, and 100 million+ cumulative transactions can sit next to about $28,000 a day of real payments. When you read an announcement, ask two questions: who has actually turned it on, and how much real money moves through it?

The plumbing is still settling. File names are shifting (ai-catalog and ARD split into publishing and discovery formats within months), APIs are still changing mid-trial, and the headline commerce experiment of the past year, buying inside ChatGPT, was scaled back. Build in a way that survives that: one source of truth, published in more than one place.

All twelve side by side, in the same order as the map.

Then comes the money: shopping and paying, where most of the live traffic is.

• 1You offer APIs, MCP servers or agents and want to be found → ARD and ai-catalog: serve the same file at both ard.json and ai-catalog.json
• 2Agents use your site inside people's browsers → WebMCP on your key flows, keeping the normal page
• 3You have lots of structured content people and agents want to query → NLWeb
• 4Your bot visits other sites, or you need to verify bots on yours → Web Bot Auth
• 5You want agents to create accounts on your service without a sign-up form → auth.md
• 6Customers' own agents should sign in and act on their accounts → Poppy (track it; Draft 0.1 is from October 9, 2026)
• 7You sell goods and want any AI assistant to browse, cart and check out → UCP
• 8You want your products shown in ChatGPT → ACP
• 9An agent pays and you need proof a person approved those exact terms → AP2
• 10Agents pay per call or by the minute, with cards or stablecoins → MPP
• 11You charge per API request in stablecoins, with no accounts → x402

The pairs people mix up: ARD vs ai-catalog (discovery vs. publishing; serve both), UCP vs ACP (any assistant vs. ChatGPT), MPP vs x402 (cards and stablecoins via Stripe vs. stablecoin payments per request under a neutral foundation), and Web Bot Auth vs auth.md vs Poppy (which bot is this / sign up a new user / act for an existing customer).

Agents are becoming the web's main users. These twelve standards are the plumbing for an agent's whole visit: find what's on offer, act on the site, prove who it is, shop, and pay. What matters in the end is whether the agent actually finishes the job.

“These standards change monthly, so this list will too. ax.guide is the open-source version: every standard is a file, and if something here is wrong or missing, open a pull request.”

Status as of October 11, 2026.