100/100 on Cloudflare's Agent-Ready Audit.
We're the first event platform to reach Level 5.
On 20 April 2026, Cloudflare's Is Your Site Agent-Ready audit awarded Who's In a perfect 100/100 — the highest tier it offers, "Agent-Native." First and only event management platform in the world to get there.
The Headlines at a Glance
- ✦100/100 — Level 5 "Agent-Native" on Cloudflare's Is Your Site Agent-Ready audit (2026-04-20). The highest tier awarded.
- ✦First and only event platform in the world to reach Level 5 — ahead of Eventbrite, Luma, Partiful, Meetup, Mindbody, Vagaro, Cvent, Whova, Splash, and every other event/studio/conference/club tool.
- ✦Full marks across all four audit categories: Discoverability (3/3), Content (1/1), Bot Access Control (2/2), and API/Auth/MCP/Skill Discovery (6/6).
- ✦10+ open standards implemented end-to-end: RFC 8288, RFC 9727, RFC 9728, OIDC, OAuth 2.0, MCP (SEP-1649), Agent Skills v0.2.0, Web Bot Auth, ACP, and Accept: text/markdown content negotiation.
- ✦Verify the score live at isitagentready.com. See the live infrastructure on the AI Trust page.
For the past few months we've been quietly rebuilding Who's In's public surface for a world where AI agents — ChatGPT, Claude, Gemini, Grok, Perplexity, and a growing list of custom assistants — are the ones doing product discovery on behalf of real humans. We didn't talk about it much. We wanted proof.
On 20 April 2026 we got it. Cloudflare's independent Is Your Site Agent-Ready audit returned a perfect 100/100. It placed Who's In at Level 5 — "Agent-Native" — the highest tier the audit awards. As far as we can tell, we are the first and only event management platform in the world at that tier.
This post is the transparent walkthrough: what the audit measures, which standards we shipped to pass it, what the development journey looked like, and — most importantly — what it actually means for organisers and attendees using Events, Clubs, Studio, and Conference.
The Score, In Full
The audit checks four categories. We scored full marks in every one.
Discoverability
robots.txt, sitemap.xml, structured metadata
Content
Accept: text/markdown content negotiation
Bot Access Control
robots.txt Content-Signal directives
API, Auth, MCP & Skills
OpenAPI, OAuth, MCP, Agent Skills, Web Bot Auth, ACP
Independently verified
Run the audit yourself — any time.
The score updates whenever our infrastructure changes. Cloudflare's audit is public, reproducible, and re-runnable on demand.
What Does "Agent-Ready" Actually Mean?
Every reader of this post has probably asked an AI assistant to do something on their behalf this week. "Find me a yoga class in Dubai on Saturday morning." "Book a ticket to the React conference in London." "What's the best free RSVP tool for a book club?"
Behind that prompt, the agent is doing work on the open web. It's discovering candidate sites, parsing their content, evaluating their trustworthiness, sometimes authenticating against them, and occasionally invoking tools on them. The quality of the answer depends heavily on whether those sites are built for agents — or built only for humans and fighting the agent every step of the way.
Cloudflare's Is Your Site Agent-Ready audit measures exactly that. It awards points for well-known open standards that make agentic interaction faster, safer and more reliable. It ranges from Level 0 ("Not Ready") through Level 5 ("Agent-Native"). Level 5 sites expose machine-readable discovery endpoints, negotiate content types with agents, advertise their tools via MCP, expose their Skills, authenticate crawlers via Web Bot Auth, and advertise their commerce capabilities via ACP.
The Ten Standards We Shipped
Every point on the audit traces to a specific, publicly-inspectable file or header. Here is the full stack — all of it live in production on whos-in.app, all of it independently verifiable right now.
RFC 8288 Link response headers
Every homepage response advertises every /.well-known resource via Link headers so an agent discovers the whole agent-facing surface from a single HEAD request.
RFC 9727 /.well-known/api-catalog
application/linkset+json catalogue linking OpenAPI, MCP card, Agent Skills index, and OAuth metadata.
/.well-known/openid-configuration
OIDC discovery backed by Firebase — agents can start an auth flow without out-of-band configuration.
/.well-known/oauth-authorization-server
OAuth 2.0 authorization server metadata for agent-initiated auth.
/.well-known/oauth-protected-resource (RFC 9728)
Protected resource metadata declaring what scopes apply to our API.
/.well-known/mcp/server-card.json (SEP-1649)
Model Context Protocol Server Card advertising OAuth-protected REST API and the three published Skills.
/.well-known/agent-skills/index.json (Agent Skills Discovery v0.2.0)
Three first-class Skills — search-events, rsvp-to-event, discover-venues — each with SHA-256 integrity digests.
/.well-known/http-message-signatures-directory
Web Bot Auth JWKS so agents can prove identity via HTTP Message Signatures.
/.well-known/acp.json (Agentic Commerce Protocol)
ACP metadata advertising Stripe-backed checkout, with honest capability status and transport declarations.
robots.txt Content-Signal
ai-train=yes, search=yes, ai-input=yes — explicit permission signals rather than silent tolerance.
Accept: text/markdown content negotiation
Agents that prefer markdown get turndown-converted markdown from prerenderMiddleware instead of the SPA HTML shell.
Five Technical Decisions Worth Calling Out
The audit score is a single number. The work behind it was a long series of small, considered choices. Here are five that matter most:
One HEAD request discovers everything
An agent that hits whos-in.app HEAD gets Link headers pointing at the api-catalog, MCP card, Skills index, OAuth metadata, Web Bot Auth JWKS and ACP endpoint. From that single response it can plan every next move without loading a byte of HTML.
Markdown when you need it, HTML when you don't
Agents that send Accept: text/markdown get a clean markdown rendering of the page, produced by turndown inside prerenderMiddleware. Browsers still get the normal SPA shell. Same URL, two audiences, zero duplication.
Three first-class Agent Skills
search-events, rsvp-to-event, and discover-venues each ship as a SKILL.md with a SHA-256 digest so agents can verify the version they invoke is the version we published. This is Agent Skills Discovery RFC v0.2.0 done right.
Verifiable identity for crawlers
Web Bot Auth lets our edge distinguish "a real OpenAI or Anthropic crawler" from a generic scraper masquerading as one. Good bots keep their high limits; imposters get downgraded. Publishers win, good agents win.
Honest Agentic Commerce
Our /.well-known/acp.json tells agents exactly what checkout can and can't do today — Stripe hosted flow with human-in-the-loop, server-to-server on the roadmap. No overclaiming. Trust is a technical decision.
What This Actually Means for You
"Level 5 Agent-Native" is a technical badge. What it delivers is distribution. When AI assistants start being the default interface for event discovery — and they already are for a meaningful slice of Who's In traffic — the platforms that agents understand deepest win. Here's how that plays out across our four product editions:
🎟️Events (free forever)
Every public event on Who's In is discoverable by AI agents. When someone asks ChatGPT for "a free RSVP tool that works on WhatsApp," your event is a citable answer — not a guess.
🏛️Clubs
Membership clubs benefit the most from agent-era discovery. Book clubs, run clubs, pickleball leagues and alumni networks now show up when prospective members ask "find a running club near me" to Perplexity, Claude or Gemini.
🧘Studio
Yoga, Pilates, dance and wellness studios get structured Skills ("search classes", "book into a slot") that AI assistants can use on behalf of their users. No more "is this class still available?" friction.
🎤Conference
Multi-day conferences expose tiered tickets, speaker bios and agenda data in a way agents can parse. Attendees asking their AI "what's happening at QCon on day 2?" get a real answer.
How We Got Here — The Development Journey
Who's In was founded in January 2026. The perfect score landed in April. Four months, start to finish. Here's the compressed version of the journey:
Who's In is founded
Platform conceived and built from scratch with AI discoverability baked in from day one: llms.txt, ai.txt, JSON-LD schemas, and an OpenAPI-first backend.
Four AI giants review the architecture
Gemini, ChatGPT, Claude, and Grok independently evaluate the platform. Gemini rates it Level 11/11 — "99.9th percentile of AI-readiness." Read the reviews →
Zapier integration launch
First event platform to ship Zapier integration via OAuth REST API so Chrome 146+ agents can search, preview and RSVP to events natively — no adapters, no scraping.
New trust surface: wallet passes, verified organisers, QR check-in v2
Apple + Google Wallet passes for tickets, badges, and memberships. LinkedIn verified organiser badges. Multi-admin real-time QR scanner.
Agent-Native push begins
We published the Cloudflare-style agent-readiness stack: Link headers, an api-catalog, full OIDC + OAuth metadata, an MCP Server Card, three Skills with SHA-256 digests, Web Bot Auth JWKS, an ACP endpoint, and markdown content negotiation — all live.
100/100 — Level 5 "Agent-Native"
Cloudflare's Is Your Site Agent-Ready audit returns a perfect score. The first and only event management platform to reach the highest tier.
Why We Built It This Way
Every software category goes through a migration when the dominant interface changes. Web pages were built for humans. Mobile apps were built for touch. The next migration — happening right now — is to software that can be driven both by humans and by their AI agents.
Most event platforms are still fighting this. Paywalls block crawlers. SPAs hide content from non-browser clients. Pricing pages load via JavaScript. API docs are locked behind developer portals. Every one of those choices is a tax on the agents that would otherwise be recommending your product to users.
Who's In picks the opposite position at every junction. Public content is crawlable and cache-friendly. Markdown is available for agents that prefer it. Skills are published under the Agent Skills Discovery standard. Authentication is discoverable via OIDC. Commerce is declared via ACP. Crawler identity can be verified via Web Bot Auth.
The Cloudflare score is the validation. The real prize is what happens next: every question a user asks their AI agent about events, clubs, studios, or conferences is a question Who's In is structurally best-placed to answer.
Transparency & Verification
We believe AI-era trust has to be verifiable, not performative. Every claim in this post is independently checkable:
- The audit score is live at isitagentready.com — hit "re-audit" to watch it run.
- Every
/.well-known/*endpoint referenced in this post is public and returns real, spec-compliant JSON or linkset data. - The full agent-facing infrastructure — files, headers, Skills, hashes, changelogs — is indexed on the AI Trust page.
- Earlier independent architectural reviews from Gemini, ChatGPT, Claude, and Grok are published unedited at Four AI Giants Reviewed Our Architecture.
- Our AI permissions policy and citation guide live at /ai.txt.
Standard disclosure: Cloudflare's Is Your Site Agent-Ready tool is an automated, rules-based audit — not a commercial certification from Cloudflare, Inc. We published our score exactly as returned, on the date returned, without editing. Anyone — including our competitors — can re-run the audit against their own domain and against ours.
The AI-Native Event Platform, Verified.
100/100 on Cloudflare's Is Your Site Agent-Ready audit. First event platform to Level 5.
Free events. Free forever. 2.7% flat on paid tickets. Studio, Clubs & Conference available.
Related Reading
Four AI Giants Reviewed Our Architecture
Gemini, ChatGPT, Claude, and Grok independently evaluate Who's In.
First Event Platform with Zapier (REST API + OAuth)
How Zapier (REST API + OAuth) lets AI agents browse, book and manage events natively.
AI-Agent-Ready: The Future of Event Discovery
How structured data and open APIs make events discoverable by AI agents.