--- title: Agent-ready WooCommerce · NAVISTRI site: https://pap.navistri.com/ demo: https://pap-shop.navistri.com/ (store), https://pap-gw.navistri.com/ (gateway) counters: https://pap.navistri.com/api/stats --- # Agent-ready WooCommerce AI agents already read shops for people: they compare products, check stock and fill carts. Cloudflare's Agent Readiness scan grades how well a site serves them, from level 0 to 5, and a typical WooCommerce store gets level 1. NAVISTRI Agent Access is a plugin that takes a store to level 4. It also lets personal agents that speak the Personal Agent Protocol say who they are, and tell you what their person couldn't do in your store. ## Check your store first Put your store's address into [isitagentready.com](https://isitagentready.com/), Cloudflare's free scanner. If the store is on Cloudflare, the same Agent Readiness report is in the zone's dashboard. The levels add up: a store reaches a level only when it passes every level below it. | Level | What the scan wants | Typical WooCommerce | With the plugin | |---|---|---|---| | 1 Basic web presence | two of three: robots.txt, a sitemap, Link headers | yes | yes | | 2 Bot-aware | Content Signals in robots.txt, and rules there that cover AI bots | rules yes, signals no | yes, you choose the signals | | 3 Agent-readable | pages as markdown for `Accept: text/markdown` | no | yes | | 4 Agent-integrated | one of four: an MCP server card, an A2A agent card, Agent Skills, an API catalog | no | yes, skills and a catalog | | 5 Agent-native | two of three: Web Bot Auth, all four from level 4, agent sign-in metadata (OAuth or auth.md) | no | not yet | Level 5 needs two of three things a store rarely has: its own MCP server and A2A agent on top of the skills and catalog, agent sign-in through OAuth or auth.md, or Web Bot Auth signatures on the requests its own bots send. The plugin doesn't add any of them yet. ## Try it on the demo store [pap-shop.navistri.com](https://pap-shop.navistri.com/) is a WooCommerce store with WooCommerce's sample products and the plugin, behind Cloudflare. Nothing there is for sale. It runs on a home server in Kyiv, so in long power cuts it goes offline and comes back on its own; [/api/stats](https://pap.navistri.com/api/stats) says whether it is up. Cloudflare's scan of the demo store on 8 November 2026: level 4, Agent-Integrated. ``` curl -H "Accept: text/markdown" https://pap-shop.navistri.com/product/hoodie/ curl https://pap-shop.navistri.com/robots.txt curl https://pap-shop.navistri.com/.well-known/api-catalog curl https://pap-shop.navistri.com/.well-known/poppy.json ``` An agent with a PAP session can also look up the store's one test order: number 57, email buyer@example.com. ## The second layer: personal agents The Personal Agent Protocol is an open draft for agents that act for one person. The agent signs a short-lived session with its own key, so the store knows which agent is calling without a login, and the agent can report tasks it couldn't finish. No consumer agent uses it in production yet (November 2026); the protocol's own demos run with test agents. The drafts move fast: 0.3 came out on 4 November and 0.4 is in the works. The plugin serves both. What the plugin does with it: - checks each agent's session and signature, and keeps a log of which agents came and what they did, with no personal data in it; - answers a task an agent couldn't do with another way to do it, and lists the tasks the store doesn't offer; - lets an agent bring its person's browser into the session, so pages open with the same context; - serves the catalog, store details and, if you switch it on, order lookup by number and email. The official PAP validator passes it with 62 checks and no failures, on PHP 7.4 to 8.4, under Apache and nginx. Cloudflare's scanner checks PAP too, for information only: the check doesn't count toward the level. It was written for draft 0.2 and marks correct 0.3 sites as invalid, the protocol's own demo among them, so it shows "invalid" for this store as well. ## What agents did here These are live counts for the last 30 days from the demo store and the gateway demo, also as JSON at [/api/stats](https://pap.navistri.com/api/stats). Our own test runs are in them too: the official validator and a test agent. ## Not on WooCommerce? The same features run as a small gateway in front of any website, without touching the site. [pap-gw.navistri.com](https://pap-gw.navistri.com/) is a made-up bike workshop: a plain HTML site with the gateway in front of it, at level 4 as well. ## Agent-ready WooCommerce, set up for you The plugin isn't in the WordPress directory yet. For now it comes with the setup. | What | Price | |---|---| | One store, set up and tested | €990 | | Agencies: a client's store, white-label | €650 per store | | Updates and checks after the first three months | €49 a month | The setup covers the plugin installed and configured, your hosting fixed where it blocks agents (`/.well-known` paths, page cache, firewall rules, the `Authorization` header), a report from the official validator, a field test with a real agent behind your CDN, and three months of updates as the drafts change. ## Write to Max Write about the store and what you want from it, and Max replies within two working days. The form sends your message to Max's own server. If that fails, the page says so and gives you the text to email instead. Or write to [max@sushch.uk](mailto:max@sushch.uk). By [Maksym Sushchuk](https://sushch.uk/), AI engineer, for [NAVISTRI](https://navistri.com/). NAVISTRI isn't affiliated with the Personal Agent Protocol project, Cloudflare or WooCommerce. The protocol is named only to say what the plugin implements.