OARS — Open Agent Readiness Standard

An open standard for the agent web.

OARS describes what it means for a business to be useable by AI — reachable, discoverable, readable, actionable, transactable, and operable end-to-end. It's free to read, free to implement, and lives at Knov.ai — I wrote and maintain it.

Agents are becoming a new kind of visitor to your website. Most sites aren't ready for them — not because anyone did anything wrong, but because the question is new. OARS gives that question a vocabulary, a scale, and a sequence of concrete steps — the same way HTML and robots.txt did for the human web a generation ago.

The six levels

Each level requires full compliance with everything beneath it. The levels are written for engineers, but the work each one represents is mostly business work — decisions about what you'll let agents see, do, and transact on your behalf.

Level 0 · Reachable

An agent can operationally use your site at all.

The floor the rest of the ladder is built on. HTTPS with a valid certificate, real uptime, Core Web Vitals that don't time agents out, baseline security headers, and no CAPTCHAs or JavaScript challenges that block verified agents from a non-interactive path. Nothing here is agent-specific — it's the operational hygiene a modern site already needs, made explicit so the higher levels have something to stand on.

Roughly: a few hours of cleanup for most sites; sometimes already done.

Level 1 · Discoverable

An agent can locate and identify your business and its offerings.

Your site declares — in machine-readable terms — that it exists, who runs it, where you operate, what you sell, and which AI agents you're happy to receive. Most of this is small, one-time work on robots.txt, a sitemap, Schema.org markup, and an llms.txt file. No new infrastructure, no new logins.

Roughly: a couple of days for most small businesses, sometimes already partially done by a good SEO setup.

Level 2 · Readable

An agent can comprehend what you do, who it's for, and how it works.

Beyond "this business exists," agents need structured details — services, products, prices, hours, policies, the kinds of customers you serve, the kinds you don't. This is where Schema.org gets used in earnest, FAQs become machine-readable, and a knowledge declaration spells out what you can be trusted to speak on.

Roughly: one to three weeks of content and schema work, depending on catalog size.

Level 3 · Actionable

An agent can execute defined actions — booking, quoting, querying — against your systems.

This is the line where engineering shows up. A documented API contract (OpenAPI or GraphQL) with idempotency and structured errors, an MCP server with a server card and behavioral annotations on every tool, server-side authorization, and human-in-the-loop confirmation for anything destructive. The actions are scoped, observed, and reversible. It's the first level that makes someone responsible for an integration on your side.

Roughly: a real project — four to twelve weeks depending on how many actions you expose.

Level 4 · Transactable

An agent can complete commercial transactions end-to-end on a customer's behalf.

The agent doesn't just request a quote — it pays, books, ships, and gets a receipt. This needs a machine-readable catalog with real-time pricing and availability, a recognized agentic-commerce protocol (ACP, UCP, AP2, or x402), tamper-evident proof of authorization scoped to cart and amount, signed agent identity, no CAPTCHAs in the agent path, and audit trails an accountant would actually accept.

Roughly: a meaningful build — typically only worth doing once Levels 1–3 are stable and an agent-driven sales channel is real.

Level 5 · Operable

Agents can run internal workflows — not just customer-facing actions.

This is the inside view: at least one core workflow — intake, scheduling, quoting, triage, processing — is substantially operated by agents, with human oversight, documented handoff rules, and metrics that distinguish agent work from human work. Most businesses will live happily at Level 2 or 3 for years. Level 5 is for operators who want to compound.

Roughly: an ongoing program, not a project. It changes how the company is staffed.

Why a standard at all?

I kept hearing the same question from businesses, agencies, and engineers: how do we make a website actually work for AI agents? Every vendor had a partial answer. Nobody was drawing the whole map.

Standards are how the web absorbs shocks. HTML let any browser read any page. robots.txt let any site say "here are the rules for crawlers." Schema.org let search engines understand what a page was about without guessing. Each of those started messy and informal, and each eventually became invisible infrastructure. Nobody at a small business has to think about which sitemap format to use anymore; the question is settled.

The agent web needs the same kind of settling. OARS is an attempt to draw the lines clearly enough that the conversation can stop being "should we do something about AI agents?" and start being "where on the scale do we want to be, and by when?"

What lives at Knov.ai

This page is the consultant's overview. The standard itself, the tooling, and the verified directory all live at Knov.ai, where they'll stay free and open.

The full standard

The full specification, with the exact requirements for each level, the verification rules, the appeals process, and the policy for regressions. The thing engineers actually read.

Read the spec

Free assessment

A no-signup scan that reads what an agent would see on your site and returns a quick Level 1–2 readout. Useful before any conversation about budgets or timelines.

Run an assessment

Schema & generator

The JSON Schema, example files, and a generator for oars.json — drop-in for your team to start from instead of writing it by hand.

See the schema

Verification & directory

Independent review against the standard, with a listed entry in the public directory once you pass. The directory is what an agent looks at to decide who it can trust.

How verification works

How OARS relates to SEO, schema, MCP, and the rest.

OARS is not a replacement for any of these — it's the scaffolding that connects them.

SEO is about humans finding your site through search engines. Level 1 of OARS overlaps with SEO substantially; if your SEO is good, you've already done meaningful work on discoverability.

Schema.org is the markup vocabulary OARS leans on heavily for Levels 1 and 2. It's the existing tool, used more deliberately and in more places.

MCP (Model Context Protocol) is the action layer — how an agent actually invokes something on your side. OARS specifies that you have an MCP server at Level 3, and what it must minimally do, but doesn't redefine MCP itself.

llms.txt and AGENTS.md are content-navigation conventions that emerged separately. OARS includes them where they belong and clarifies what each is actually for.

The point of a standard is that you can absorb new conventions as they appear, without having to re-architect from scratch each time.

oars sits across existing web standards like SEO schema and MCP

Common questions

Most of these come up in the first 15 minutes of any conversation about OARS, so they're collected here.

Is OARS something we have to comply with?

No. OARS is an open standard, not a law and not a platform requirement. Nobody can fine you for not implementing it. The point is that it gives you — and any agent visiting your site — a shared way of describing where you are, so you can decide which level is worth aiming for and stop there.

Do most businesses need to get to Level 5?

Almost none. Levels 1 and 2 are within reach for any small business and meaningfully improve how AI represents you. Level 3 starts paying off once a customer-facing action is worth automating. Levels 4 and 5 are for businesses where agent-driven commerce or operations are real strategic bets, not the norm.

How is this different from "SEO for AI"?

"SEO for AI" is mostly Level 1 and parts of Level 2 — getting found and described accurately by ChatGPT, Claude, Perplexity, and whatever comes next. OARS covers that, but also the parts SEO never touched: taking actions on your systems, completing transactions, and running internal workflows. The visibility piece is the entry point, not the destination.

Who decides if a business meets the standard?

Anyone can run the automated checks and see where they stand — those parts are deterministic. Formal verification (the kind that gets you into the public directory) is a hybrid: automated checks plus a human reviewer at Knov.ai. Level 3 and up include live demonstrations against the actual systems being claimed, not just paperwork.

Is the standard going to keep changing?

Yes, in roughly the same way HTML and Schema.org change — versioned, slowly, with backward compatibility taken seriously. Revisions add levels, refine the verification surface, and tighten requirements over time, with the current version always published at Knov.ai. The cadence is conservative on purpose; standards that move every quarter are useless to anyone actually running a business.

What's the connection between this page and Knov.ai?

I wrote OARS and maintain it. Knov.ai is where the standard, scanner, schema, and directory live — that's the open and free side of the project. This site is the consulting side: where I help businesses actually implement what the standard describes. The two are intentionally separate, so the open standard never depends on a single consultant being around.

Where do I start?

Run the free scanner. It takes seconds and gives a quick read on Levels 1–2 without any signup or sales call. If the results suggest meaningful work is needed and you'd rather not project-manage it yourself, the audit is the next step.

Where to from here

See where your site stands today.

Run the free scanner for a quick OARS Level 1–2 readout — takes seconds, no signup. Or if you'd rather have someone walk it through with you, the audit is a guided, fixed-price way to do that.

Run the free OARS scan Book an audit