On 25 and 26 October 2026 we asked 5,013 live websites a question most audits skip: can an AI agent call this site, or only read it? A site that only publishes pages gets summarised. A site that answers the Model Context Protocol lets the agent search its catalogue, book a slot or start a checkout on the user's behalf. We knocked on every door an agent would try and counted who answered. The short version: very few businesses have built a door themselves, most of those who did are missing from the registry agents use to find them, and the biggest store platforms quietly built doors for millions of merchants.
Key numbers
Of 5,013 live websites probed on 25 and 26 October 2026, 186 (3.7%) answered at least one MCP door.
For 160 of the 186 websites with an MCP door (86%), the official MCP registry listed no server for the domain on 26 October 2026.
Among the global top sites, 154 of 3,153 (4.9%) answered an MCP door; among sites in Brazil, Argentina, Chile and Mexico, 25 of 1,565 (1.6%); in Spain, 7 of 295 (2.4%).
Of 186 MCP doors that businesses built themselves, 152 (82%) asked for a sign-in with OAuth and 34 answered anyone.
132 of those 186 doors (71%) lived on an mcp. subdomain, 29 at /mcp and 18 at /api/mcp on the main site.
Every Shopify store in the probe (6 of 6) published a Universal Commerce Protocol profile, version 2026-08-25, with catalog search, cart, checkout and order tracking.
Every Wix-built website in the probe (7 of 7) answered MCP at /_api/mcp without a sign-in.
Of 31 MCP servers that answered without a sign-in, 12 offered tools that change data to anyone who connects.
Graded by the INITE Atlas's rules for tool definitions, 17 of those 31 open servers scored A, 13 scored B and 1 scored C; the median server offered 6 tools costing about 1,400 tokens of an agent's context.
542 of 5,013 homepages (10.8%) sent fewer than 80 words in their server HTML, against 1.0% of WordPress sites and 15.5% of sites on a stack we could not identify.
How we counted
We took the 5,000 most linked domains in the Majestic Million plus 600 from each of the .br, .ar, .cl, .mx and .es zones, 8,000 in all, and read each homepage once. 5,013 answered with a page. For each of them our analyzer asked the places an agent asks: an MCP initialize at /mcp, /api/mcp, /_api/mcp and mcp. plus the domain, the commerce profile at /.well-known/ucp, and the booking services the homepage links to. A path counts as a door only when it answers the way MCP does: a JSON-RPC reply, or a 401 with the Bearer challenge MCP authorization prescribes. A firewall that refuses every request is not a door. No language model took part in the count. We then matched every site against our copy of the official MCP registry, 50,130 entries read on 26 October 2026.
The sample leans towards large sites, because that is what a ranked list of links contains. Small stores and local businesses are under-represented, so read the platform findings below as how each platform behaves, checked on a handful of sites each, not as market shares.
How many websites can an AI agent call?
What we found. 186 of 5,013 sites, 3.7%. The global top sites do better (4.9%) than sites in Latin America (1.6%) or Spain (2.4%). The doors that exist are mostly on software companies' sites: Dropbox, ClickUp, Vimeo, Mixpanel, DigitalOcean, GitBook, Basecamp and Shopify all answered. A few names were less expected, such as Gallup and Criteo.
So what. Agents can read almost every site and operate almost none of them. For a SaaS product that is a gap a competitor can close first. For a newspaper or a local shop it is not a gap at all, which is why our analyzer scores the door only for the kinds of business an agent would actually act on.
Now what. If your product has an API, the cheapest path to a door is a remote MCP server over it; our 90-day plan for a SaaS MCP server covers the order of work.
Why are most doors missing from the registry?
What we found. For 160 of the 186 sites with a door, the official MCP registry lists nothing for the domain. The official servers of Dropbox, ClickUp, Vimeo and Mixpanel are not there, while wrappers of the same products, published by third parties such as Pipeworx, UsefulAPI and Smithery, are.
So what. The registry is where clients, directories and catalogues look first, our own Atlas included. A vendor that ships a server and never registers it leaves the first impression to whoever wrapped its API, with that wrapper's permissions, uptime and tool descriptions.
Now what. Publish your server under your own domain's namespace. The registry proves ownership with a key served at /.well-known/mcp-registry-auth, and our analyzer prints the namespace your domain would claim.
Who can call the doors that exist?
What we found. 152 of the 186 doors businesses built themselves (82%) ask for a sign-in, through OAuth that the server describes at a protected-resource address (RFC 9728). 132 of them (71%) live on a separate mcp. subdomain. Of the 31 servers that answer anyone, 12 offer tools that change data. 7 leave a tool that deletes, sends or pays without annotations, which the MCP spec then treats as destructive by default. The definitions themselves are good: 17 of the 31 grade A by the Atlas's rules, and the median server offers 6 tools for about 1,400 tokens.
So what. A sign-in is the right posture for tools that act on an account. An open server with write tools is the risky one: any agent with the address can call them. A missing annotation matters less than it looks: the spec defaults an unannotated tool to destructive, so a careful client asks first. The real hazard is a delete tool marked destructiveHint: false or readOnlyHint: true.
Now what. Put write tools behind OAuth and annotate every tool honestly: readOnlyHint: true on the ones that only read, so a client can run them without asking, and never destructiveHint: false on one that deletes, sends or pays. The INITE Atlas shows how other vendors' servers grade on the same rules.
Which platforms open the door for you?
What we found. Shopify and Wix did it for their customers. Every Shopify store we read published a Universal Commerce Protocol profile at /.well-known/ucp, version 2026-08-25, naming an MCP endpoint on the store's myshopify.com address with catalog search, cart, checkout and order tracking. The older /api/mcp on each store now offers only a search of policies and FAQs; Shopify moved the catalogue behind UCP on 31 August 2026. Every Wix-built site answered MCP at /_api/mcp without a sign-in, and published a UCP profile too. Tiendanube stores answer at /api/mcp with eight commerce tools, from product search to order tracking, though none of them appeared in this top-sites sample.
So what. On these platforms "do we have an MCP server" is already answered, and the answer is the platform's. What the merchant controls is what the door contains: a catalogue an agent can search, shipping and payment methods it can quote, policies it can cite. Whether an agent can complete the purchase depends on more than the profile; we went through the checkout side in the AI checkout got cancelled, the AI customer did not.
Now what. If you sell on Shopify or Wix, do not commission a second MCP server. Check what your platform's door exposes, and fill the data it reads.
What can an agent read without running JavaScript?
What we found. 542 homepages (10.8%) send fewer than 80 words in the HTML the server returns. WordPress sites almost never do (1.0%); sites on a stack our fingerprints could not name, mostly single-page apps, do it 15.5% of the time.
So what. ChatGPT, Claude and Perplexity fetch pages without running scripts. A homepage that only exists after hydration is close to empty for them, whatever the browser shows.
Now what. Render the text of your key pages on the server. The bots themselves also need to be let in; our AI crawler allowlist for 2026 lists which user agent does which job.
Does a door make you more visible in AI answers?
Not yet, as far as anyone has measured. Studies of AI citations through October 2026 tie visibility to ranking in classic search and to mentions on other people's pages, not to MCP. A door matters for a different reason: it decides whether an assistant that already chose you can act for the user, or has to send them to your website to finish. For a product that is used through an API, or a store that wants to be bought from inside an assistant, that is the step after visibility. For a site that is read rather than used, it can wait.
Check your own site
The INITE analyzer now runs this probe on any site you give it: which platform you are on, every door an agent can knock on, whether the registry lists you, and for an open door, the same grade the Atlas gives the servers it tracks. It is free. For a browser agent working through your interface rather than an API, see making a SaaS usable by Operator and Claude.
Data and method
The domain sample is from the Majestic Million (CC BY 3.0), read on 26 October 2026: the top 5,000 domains plus 600 per zone for .br, .ar, .cl, .mx and .es. Each homepage was read once on 25 or 26 October 2026; 5,013 answered with a page. Doors were asked with MCP initialize at four usual addresses and through the UCP profile; registry matching used a copy of the official MCP registry with 50,130 entries read on 26 October 2026, matching a server to a domain by its namespace, its website or its remote address. Open servers were graded with the INITE Atlas's definition rules. Platforms were identified by their runtime, such as window.Shopify, not by files a site may embed. Download the counts: agent-rails-census-2026-10.csv by region and agent-rails-by-platform-2026-10.csv by platform, both CC BY 4.0. The same census now runs every month; the numbers in AI tools statistics cover what AI vendors' own sites publish.
Top comments (0)