Guides
Long-form guides on making a website work for AI agents: visibility, access control, formats and monetization. Each guide is a pillar article plus in-depth sub-articles.
The agent-ready web
How to make a website readable, citable, controllable and payable for AI agents and AI crawlers — the operator side of the machine-first web.
- The Agent-Ready Website: A Complete Guide to AI Visibility, Access Control and Monetization The full operator playbook for making a website work for AI agents and AI crawlers: be fetchable, be readable, be controllable, be payable — with a 30-day implementation plan.
- llms.txt vs robots.txt vs sitemap.xml: Which File Does What The three root-level files every agent-ready site publishes, what each one is actually for, and why publishing one does not substitute for the others.
- How to Write an llms.txt File (Format, Template, and Maintenance) A step-by-step guide to writing a useful llms.txt: the exact format, a copy-paste template, what to put under ## Optional, how to validate it, and how to keep it from rotting.
- Serving Markdown Variants to AI Agents: The Cheapest Win in AI Visibility How to publish a .md twin of every page — URL patterns, content negotiation, discovery headers, generation pitfalls — and why it cuts what an agent pays to read you.
- How AI Search Engines Choose Sources (And What You Can Actually Influence) What is known, what is claimed and what is speculation about how ChatGPT, Perplexity and AI Overviews pick the pages they cite — and the short list of things a site owner can actually control.
- Should You Block AI Crawlers? A Decision Framework by Business Model Blocking AI crawlers is four separate decisions, not one. A framework that maps each crawler class to what it costs and earns you, by business model, with the exact robots.txt for each answer.
- What to Charge AI Crawlers: Pricing Models for Machine Buyers Per-crawl, per-resource, corpus licence or subscription key — the four ways to price AI access, the arithmetic behind each, and why pricing before you have demand data is the standard mistake.
- Implementing an HTTP 402 Paywall an Agent Can Actually Pay A working implementation guide for machine-payable content: the 402 response body, Link headers, key issuance and validation, caching rules, and the mistakes that make a 402 gate unpayable.
- Structured Data for AI Agents: Which Schema.org Types Earn Their Keep Most schema.org markup is invisible to machine readers. The types that are worth the effort for AI agents, how to emit them without drift, and what to build instead of more markup.
- JSON API Design for AI Agents: Endpoints They Prefer Over Scraping How to publish read-only JSON endpoints that agents choose over scraping your HTML: discovery index, stable shapes, freshness signals, bulk exports, and errors a machine can act on.
- Measuring AI Agent Traffic: Server-Side Telemetry That Answers Real Questions Why client-side analytics miss AI agents entirely, the minimum row schema to log, the five queries worth running, and how to tell a real crawler from a spoofed user agent.
- Licensing Content for AI Training: RSL, Terms, and Provenance How to publish machine-readable licence terms for AI use — what RSL is, what it does and does not do, how it differs from robots.txt and Content Signals, and where provenance standards fit.
- Running an MCP Server as a Distribution Channel for Your Content Why a content site should expose an MCP server, which tools to ship, how discovery and authentication work, how to gate paid tools, and the honest limits of the channel.
- Why AI Agents Can't Read Your Site: Twelve Failure Modes and How to Find Them A diagnostic catalogue of the twelve reasons AI agents and crawlers fail on real sites — from silent WAF blocks to JS-only rendering — each with the command that detects it and the fix.
Selling to AI agents
How to sell content, APIs and tools to buyers that are software — discovery, machine-readable offers, spend ceilings, payment rails, and what breaks.
- How to Sell to AI Agents: The Complete Guide to Machine Buyers The operator playbook for selling content, APIs and tools to buyers that are software: how agents discover, evaluate, authorize and pay — and the four rails you can charge them on today.
- Agent Checkout vs. Human Checkout: Why Your Payment Flow Fails Machine Buyers Why checkout built for a person watching a screen is unusable by an AI agent, and what a checkout flow that actually completes for a machine buyer looks like — 402 + API key versus native x402.
- Machine-Readable Pricing Pages: How to Let an Agent Evaluate Your Offer Before It Pays Why a prose pricing page cannot be evaluated by an AI agent, what fields a machine-readable offer catalog needs, and how to keep it in lockstep with your human pricing page and your 402 body.
- ACP vs. AP2 vs. x402: Which Agent Payment Rail Should You Implement? A decision framework for choosing between ACP, AP2, and x402 (plus the self-hosted 402 gate) — sorted by who your buyer actually is, what you are selling, and what is live versus waitlisted today.
- How to Accept x402 Stablecoin Payments: A Seller Implementation Guide A build guide for sellers who have already decided x402 is the right rail: the 402 response shape, the wallet/facilitator/network choices, the verify-then-settle retry flow, exact vs. upto pricing, and how to ship it dormant until you are ready to go live.
- Issuing API Keys to AI Agents Automatically: A Build Guide How to design a system that mints and delivers API keys to agent and software buyers with minimal human friction: trigger models, storage, delivery, key format, tiering, rotation and revocation — illustrated with ChangeGamer's own Stripe-webhook mechanism.
- Pricing Tiers for API and Corpus Access: What Actually Varies Between Them The axes that actually distinguish one pricing tier from another for a machine buyer — rate limits, content scope, deliverables and license grant — and how ChangeGamer structures its own four tiers around deliverable and license, not gated content.
- Agent Spend Limits and Trust: What a Seller Should Verify Before Granting Access The seller-side counterpart to agent spend controls — how an API operator reads an inbound agent's spend ceiling before granting access, which payment protocols actually prove that ceiling, how to revoke access, and what "trust" operationally means for a seller when no portable agent-reputation standard exists yet.
- Refunds and Disputes with Agent Buyers: What a Seller Actually Does What happens on the seller side when an autonomous agent's purchase needs to be reversed or is disputed — API-key refund mechanics, why x402 settlement cannot be undone, what card-token revocation does and does not prove, and what to log before you reverse anything.
- Packaging a Corpus as a Product: Format, Schema, Versioning and Delivery The packaging decisions behind selling a content corpus as a dataset product — export format, the free-sample/gated-full split, a per-record metadata schema, a corpus version number, and which of three delivery mechanisms to use — grounded in ChangeGamer's own three real export formats.
- How Do AI Agents Discover Paid APIs? A Guide to Every Surface How an AI agent finds out a paid API or resource exists before it ever reads a price: llms.txt, the JSON API index, MCP registries, incidental 402 discovery, x402 auto-listing, and what .well-known does and does not cover.
- Fraud and Abuse from AI Agent Traffic: What a Seller Should Detect How a seller of APIs, content, or tools to AI agents spots and mitigates abuse once access is already granted — key sharing, over-scope scraping, spend-ceiling circumvention, spoofed identity, and rate-limit evasion patterns specific to autonomous agents.
- Measuring Revenue from AI Agent Traffic: Beyond the Traffic Log The revenue-layer fields and queries a seller adds on top of a general traffic log — authorized-vs-settled, revenue per rail, revenue per tier, and how to avoid double-counting a webhook retry as two sales.
MCP in practice
How to build, ship and run an MCP server in production — transport, auth, tool design, versioning, testing, distribution, observability, cost and failure modes.
- MCP Server in Production: How to Build, Ship and Run One The operator playbook for taking an MCP server past the quickstart: transport choice, OAuth 2.1 auth, tool design, versioning against a moving spec, testing across clients, distribution, observability, cost and the failure modes that show up once real clients connect.
- stdio vs. Streamable HTTP for MCP Servers: A Decision Framework Which MCP transport to build against and why: the single-client-vs-shared decision rule, how state works without a session handshake under the 2026-07-28 spec, the auth-model switching cost, and what actually breaks migrating off HTTP+SSE.
- How to Implement OAuth 2.1 for an MCP Server A wire-level implementation walkthrough for OAuth 2.1 on a remote MCP server: what the discovery documents actually contain, CIMD vs. Dynamic Client Registration in your server code, per-SEP detail from the 2026-07-28 hardening set, and token-validation mechanics.
- Defending MCP Clients Against Tool Description and Output Injection Two distinct MCP injection surfaces — a tool description at connect-time and a tool's return value at call-time — and the client-side architectural patterns (Dual LLM, Action-Selector, Context-Minimization) that contain each one.
- How to Test an MCP Server in CI The implementation mechanics below the three-layer test pyramid: what a mocked MCP transport actually replaces, what a Streamable HTTP cassette contains, a concrete CI job/trigger shape, and how to catch spec-version drift before it reaches production.
- MCP Server Versioning and Spec Migration: An Operator Playbook A migration runbook for MCP server operators: feature-detecting via capabilities instead of hard protocolVersion branching, a dual-version fleet rollout with rollback triggers, a compatibility shim for legacy clients still sending initialize, and a deprecation calendar built off the 12-month SEP-2577 floor.
- MCP Server Observability with OpenTelemetry: Spans, Metrics, and Trace Correlation Instrumenting an MCP server past the pillar's baseline: what to put on a tool-call span beyond gen_ai.tool.name, what replaces the deprecated Logging primitive in practice, per-tool-name latency and error-rate metrics, and how a trace ID actually survives the agent-to-upstream-API hop.
- How to Publish an MCP Server to the Official Registry A step-by-step walkthrough of the mcp-publisher CLI and the server.json manifest for publishing an MCP server to registry.modelcontextprotocol.io, how to republish after a version bump, and how the registry relates to aggregators, marketplaces, and direct distribution.
- MCP Server Cost Optimization: Toolset Size, Caching Hints, and Fan-Out How the token cost of an MCP server's tool list, the 2026-07-28 spec's ttlMs/cacheScope caching hints, fan-out from callers you do not control, and per-tool-name cost visibility each shape what a production MCP server actually costs to run.
- Common MCP Server Failure Modes and How to Fix Them A runtime playbook for the two MCP server failure modes with no dedicated deep-dive elsewhere: unrecoverable state after a mid-call crash, and malformed or hallucinated tool calls that reach the handler despite upstream validation.
- MCP Tools vs Resources vs Prompts: How to Choose the Right Primitive A decision procedure for MCP's three server-side primitives — who controls each one, a worked example of what it costs to expose a Resource as a Tool by mistake, and how Sampling and Elicitation fit as the client-side counterparts.
- The MCP Server Production Launch Checklist A phase-by-phase go/no-go checklist for launching an MCP server: checkable gate conditions for transport and auth, tool design, cross-client testing, publish readiness, observability, and ongoing operation — with links to the mechanics each gate depends on.
- Zero-Touch Enterprise Authorization for MCP Servers: ID-JAG and SEP-990 How Enterprise-Managed Authorization (SEP-990) removes the per-server OAuth consent screen for MCP servers: the ID-JAG grant mechanism, its RFC 8693/7523 building blocks, named launch adopters as of August 2026, and how it layers on top of standard OAuth 2.1 rather than replacing it.