Agent-ready WooCommerce

AI agents already read shops for people: they compare products, check stock and fill carts. Cloudflare's Agent Readiness scan grades how well a site serves them, from level 0 to 5, and a typical WooCommerce store gets level 1. NAVISTRI Agent Access is a plugin that takes a store to level 4. It also lets personal agents that speak the Personal Agent Protocol say who they are, and tell you what their person couldn't do in your store.

Check your store first

Put your store's address into isitagentready.com, Cloudflare's free scanner. If the store is on Cloudflare, the same Agent Readiness report is in the zone's dashboard. The levels add up: a store reaches a level only when it passes every level below it.

Level	What the scan wants	Typical WooCommerce	With the plugin
1 Basic web presence	two of three: robots.txt, a sitemap, Link headers	yes	yes
2 Bot-aware	Content Signals in robots.txt, and rules there that cover AI bots	rules yes, signals no	yes, you choose the signals
3 Agent-readable	pages as markdown for `Accept: text/markdown`	no	yes
4 Agent-integrated	one of four: an MCP server card, an A2A agent card, Agent Skills, an API catalog	no	yes, skills and a catalog
5 Agent-native	two of three: Web Bot Auth, all four from level 4, agent sign-in metadata (OAuth or auth.md)	no	not yet

Level 5 needs two of three things a store rarely has: its own MCP server and A2A agent on top of the skills and catalog, agent sign-in through OAuth or auth.md, or Web Bot Auth signatures on the requests its own bots send. The plugin doesn't add any of them yet.

Try it on the demo store

pap-shop.navistri.com is a WooCommerce store with WooCommerce's sample products and the plugin, behind Cloudflare. Nothing there is for sale. It runs on a home server in Kyiv, so in long power cuts it goes offline and comes back on its own.

Cloudflare's scan of the demo store on 8 November 2026: level 4, Agent-Integrated.

curl -H "Accept: text/markdown" https://pap-shop.navistri.com/product/hoodie/
curl https://pap-shop.navistri.com/robots.txt
curl https://pap-shop.navistri.com/.well-known/api-catalog
curl https://pap-shop.navistri.com/.well-known/poppy.json

An agent with a PAP session can also look up the store's one test order: number 57, email buyer@example.com.

The second layer: personal agents

The Personal Agent Protocol is an open draft for agents that act for one person. The agent signs a short-lived session with its own key, so the store knows which agent is calling without a login, and the agent can report tasks it couldn't finish.

No consumer agent uses it in production yet (November 2026); the protocol's own demos run with test agents. The drafts move fast: 0.3 came out on 4 November and 0.4 is in the works. The plugin serves both.

What the plugin does with it:

checks each agent's session and signature, and keeps a log of which agents came and what they did, with no personal data in it;
answers a task an agent couldn't do with another way to do it, and lists the tasks the store doesn't offer;
lets an agent bring its person's browser into the session, so pages open with the same context;
serves the catalog, store details and, if you switch it on, order lookup by number and email.

The official PAP validator passes it with 62 checks and no failures, on PHP 7.4 to 8.4, under Apache and nginx.

Cloudflare's scanner checks PAP too, for information only: the check doesn't count toward the level. It was written for draft 0.2 and marks correct 0.3 sites as invalid, the protocol's own demo among them, so it shows "invalid" for this store as well.

What agents did here

These are live counts for the last 30 days from the demo store and the gateway demo. Our own test runs are in them too: the official validator and a test agent.

…agents verified
…agent sessions
…tasks agents couldn't do
…pages read as markdown

Loading the counters. The same numbers are at /api/stats.

Not on WooCommerce?

The same features run as a small gateway in front of any website, without touching the site. pap-gw.navistri.com is a made-up bike workshop: a plain HTML site with the gateway in front of it, at level 4 as well.

Agent-ready WooCommerce, set up for you

The plugin isn't in the WordPress directory yet. For now it comes with the setup.

One store

€990

Set up and tested.

Agencies

€650 per store

White-label, for your clients' stores.

After three months

€49 a month

Updates and checks.

The setup covers the plugin installed and configured, your hosting fixed where it blocks agents (/.well-known paths, page cache, firewall rules, the Authorization header), a report from the official validator, a field test with a real agent behind your CDN, and three months of updates as the drafts change.

Write to Max

write to max

Write about the store and what you want from it, and Max replies within two working days. The form sends your message to Max's own server. If that fails, the page says so and gives you the text to email instead.

Or write to max@sushch.uk.

---
title:    Agent-ready WooCommerce · NAVISTRI
site:     https://pap.navistri.com/
demo:     https://pap-shop.navistri.com/ (store), https://pap-gw.navistri.com/ (gateway)
counters: https://pap.navistri.com/api/stats
---

# Agent-ready WooCommerce

AI agents already read shops for people: they compare products, check stock and fill carts.
Cloudflare's Agent Readiness scan grades how well a site serves them, from level 0 to 5, and
a typical WooCommerce store gets level 1. NAVISTRI Agent Access is a plugin that takes a
store to level 4. It also lets personal agents that speak the Personal Agent Protocol say
who they are, and tell you what their person couldn't do in your store.

<!-- A bell on the counter: an agent rings, the shop answers, the owner sees who rang. -->

## Check your store first

Put your store's address into [isitagentready.com](https://isitagentready.com/),
Cloudflare's free scanner. If the store is on Cloudflare, the same Agent Readiness report is
in the zone's dashboard. The levels add up: a store reaches a level only when it passes
every level below it.

| Level | What the scan wants | Typical WooCommerce | With the plugin |
|---|---|---|---|
| 1 Basic web presence | two of three: robots.txt, a sitemap, Link headers | yes | yes |
| 2 Bot-aware | Content Signals in robots.txt, and rules there that cover AI bots | rules yes, signals no | yes, you choose the signals |
| 3 Agent-readable | pages as markdown for `Accept: text/markdown` | no | yes |
| 4 Agent-integrated | one of four: an MCP server card, an A2A agent card, Agent Skills, an API catalog | no | yes, skills and a catalog |
| 5 Agent-native | two of three: Web Bot Auth, all four from level 4, agent sign-in metadata (OAuth or auth.md) | no | not yet |

Level 5 needs two of three things a store rarely has: its own MCP server and A2A agent on
top of the skills and catalog, agent sign-in through OAuth or auth.md, or Web Bot Auth
signatures on the requests its own bots send. The plugin doesn't add any of them yet.

## Try it on the demo store

[pap-shop.navistri.com](https://pap-shop.navistri.com/) is a WooCommerce store with
WooCommerce's sample products and the plugin, behind Cloudflare. Nothing there is for sale.
It runs on a home server in Kyiv, so in long power cuts it goes offline and comes back on
its own; [/api/stats](https://pap.navistri.com/api/stats) says whether it is up.

Cloudflare's scan of the demo store on 8 November 2026: level 4, Agent-Integrated.

```
curl -H "Accept: text/markdown" https://pap-shop.navistri.com/product/hoodie/
curl https://pap-shop.navistri.com/robots.txt
curl https://pap-shop.navistri.com/.well-known/api-catalog
curl https://pap-shop.navistri.com/.well-known/poppy.json
```

An agent with a PAP session can also look up the store's one test order: number
57, email buyer@example.com.

## The second layer: personal agents

The Personal Agent Protocol is an open draft for agents that act for one person. The agent
signs a short-lived session with its own key, so the store knows which agent is calling
without a login, and the agent can report tasks it couldn't finish.

No consumer agent uses it in production yet (November 2026); the protocol's own demos run
with test agents. The drafts move fast: 0.3 came out on 4 November and 0.4 is in the works.
The plugin serves both.

What the plugin does with it:

- checks each agent's session and signature, and keeps a log of which agents came and what
  they did, with no personal data in it;
- answers a task an agent couldn't do with another way to do it, and lists the tasks the
  store doesn't offer;
- lets an agent bring its person's browser into the session, so pages open with the same
  context;
- serves the catalog, store details and, if you switch it on, order lookup by number and
  email.

The official PAP validator passes it with 62 checks and no failures, on PHP 7.4 to 8.4,
under Apache and nginx.

Cloudflare's scanner checks PAP too, for information only: the check doesn't count toward
the level. It was written for draft 0.2 and marks correct 0.3 sites as invalid, the
protocol's own demo among them, so it shows "invalid" for this store as well.

## What agents did here

These are live counts for the last 30 days from the demo store and the gateway demo, also as
JSON at [/api/stats](https://pap.navistri.com/api/stats). Our own test runs are in them too:
the official validator and a test agent.

## Not on WooCommerce?

The same features run as a small gateway in front of any website, without touching the
site. [pap-gw.navistri.com](https://pap-gw.navistri.com/) is a made-up bike workshop: a
plain HTML site with the gateway in front of it, at level 4 as well.

## Agent-ready WooCommerce, set up for you

The plugin isn't in the WordPress directory yet. For now it comes with the setup.

| What | Price |
|---|---|
| One store, set up and tested | €990 |
| Agencies: a client's store, white-label | €650 per store |
| Updates and checks after the first three months | €49 a month |

The setup covers the plugin installed and configured, your hosting fixed where it blocks
agents (`/.well-known` paths, page cache, firewall rules, the `Authorization` header), a
report from the official validator, a field test with a real agent behind your CDN, and
three months of updates as the drafts change.

## Write to Max

Write about the store and what you want from it, and Max replies within two working days.
The form sends your message to Max's own server. If that fails, the page says so and gives
you the text to email instead. Or write to [max@sushch.uk](mailto:max@sushch.uk).

By [Maksym Sushchuk](https://sushch.uk/), AI engineer, for
[NAVISTRI](https://navistri.com/). NAVISTRI isn't affiliated with the Personal Agent
Protocol project, Cloudflare or WooCommerce. The protocol is named only to say what the
plugin implements.