Two Paths Diverging on the Agentic Web
Most websites have placed a strategic bet they don't even know about yet.
Here's the reality of the web right now: your human visitors are slowly becoming the minority. Cloudflare's Chief Executive Matthew Prince shared data in June 2026 showing that automated traffic crossed the tipping point. 57.3% of requests hitting webpages are now automated bots, leaving humans at just 42.7%. This crossover arrived a full year earlier than predicted.
When these autonomous agents land on your site to do work for their users, the protocol layer splits. You get two options. Either you define who you are with a text file called llms.txt, or you give agents tools they can actually run using a browser standard called WebMCP.
They sound like the same thing. They aren't. One is a passive brochure waiting to be read. The other is a cash register waiting to be pulled. Most platforms are auto-enabling the brochure, while the cash register gets ignored. That's a mistake. If security isn't managed at the entry point of your system, your digital infrastructure is left completely exposed. (See our guide on autonomous agent identity security). If an agent can't execute an action, it'll just leave, or scrape you to pieces.
The Identity Trap of llms-txt
Inside the first camp, we find llms.txt.
This is a markdown file that sits at the root of your domain. Proposed by Jeremy Howard, co-founder of Answer.AI, on September 3, 2024, it gives language models a clean, curated summary of your site's content. The idea is to avoid having models crawl messy HTML filled with navigation bars and script tags.
But the evidence that it actually does anything is remarkably thin. In June 2026, Google Search advocate John Mueller stated on Reddit that the file remains purely speculative, noting that no major AI system is confirmed to use it.
Yet, CMS plugins are forcing this bet. All in One SEO (AIOSEO), which runs on over 3 million WordPress sites, now generates an llms.txt file automatically. You probably have one active right now without realizing it. That means you're publishing a description of your business that you've never audit-tested. It gets worse: the moment you deploy a new path or deprecate an API endpoint, that static file drifts. Stale data is worse than no data. It leads LLMs to hallucinate page targets, causing visitors to end up on 404 pages. Treat llms.txt as a cheap hedge, not a primary strategy.
Exposing Capabilities with WebMCP
If you want an agent to actually do things, you need the second bet: WebMCP.
WebMCP stands for Web Model Context Protocol. It's an emerging browser standard drafted by the W3C Web Machine Learning Community Group. The protocol exposes callable tools to the browser's agent through the navigator.modelContext API. Instead of an agent taking screenshots of your page or reverse-engineering your DOM structure, the browser tells it: here are the actions I support, here are the parameters each one needs, and here's the format you'll get back.
This changes the dynamic. The website declares its interface explicitly. When an agent lands on a page, it doesn't have to scrape and guess. It calls a function.
This isn't developer-only vaporware. The standard was published as a draft on February 10, 2026, and is running in a public Chrome origin trial from Chrome 149 through Chrome 156. The agent consuming these tools right now in Chrome is Gemini. If your site processes transactions, bookings, or searches, WebMCP lets you control the interaction. Agents can complete tasks deterministically, without feeding raw HTML to their context windows.
Actionable Strategies for Site Owners
Don't treat these two protocols as interchangeable. They address different needs.
First, check your business pattern. If your site is a simple blog or a marketing brochure, capability tools aren't necessary. You don't have actions to complete. For a deep look at how agents read static sites, check out how accessibility trees affect machine reading. If you only want bots to digest your prose, skip the browser APIs and focus on clean semantic markup.
But if you run an e-commerce platform, a SaaS product, or a registry service, you're in the capability business. You need checkouts, search queries, and inventory checks to work. Relying on an llms.txt file to explain your checkout flow is useless. You need WebMCP tools defined in your frontend code. It protects your infrastructure from aggressive screen scraping. The agent gets structured, lightweight JSON instead of pulling massive screenshots or scraping thousands of DOM nodes.
Real Deployment and Verification
As a deployment specialist, I hate configuration drift. The main issue with llms.txt is that it's another asset to maintain.
If you use a plugin, turn off the auto-generation. Write a simple CI/CD hook that updates your /llms.txt using the actual page index from your database. If you change a URL, your build script should rebuild the text file. Never let a plugin write details about your site that you haven't approved. If you don't keep it updated, it will lie to the crawlers.
For WebMCP, the integration is cleaner because it links directly to your existing application state. When I set this up on my own project, I exposed tools that fetch glossary terms and product lists. The API calls pull data directly from the active database. There's no secondary file to sync.
Just remember that WebMCP is still in draft format. Microsoft co-authored the spec, but as of Edge version 147, the browser doesn't list the API in its release notes. Support is currently focused on Chrome. That's fine. Set up the origin trial token and collect the telemetry. Monitor whether Google's Gemini agent uses the exposed tools. It will show you exactly how many automated actions are running on your real visitor traffic.