Agent optimization briefing: MCP Server Cards, Cloudflare crawler rules and a new agent protocol
Three things changed for site owners preparing for agents. The Model Context Protocol (MCP) project finalised MCP Server Cards as an optional discovery extension, Cloudflare changed what its Block settings do to crawlers that serve both search and AI, and Sierra and Meta proposed a new protocol for how personal agents deal with businesses. The IETF’s AI preferences vocabulary is still a draft.
Window checked: 23 September to 23 October 2026. Labels: Proven means the primary source we opened states it. Practice means it comes from secondary reporting or an author’s own data. Experimental means a proposal or draft. We list at the end what we could not verify.
MCP Server Cards reach Final status
- Proven SEP-2127, “MCP Server Cards”, has Final status as an Extensions Track proposal. A Server Card is a static document that describes a remote MCP server so clients can discover its transports and protocol versions before connecting.
- Proven Cards can be hosted at any unreserved URI, with
<streamable-http-url>/server-cardas the recommended location. An AI Catalog published at/.well-known/ai-catalog.jsoncan link to or embed cards for domain-level discovery. - Proven Cards deliberately leave out tools, resources and prompts, and the extension is optional: servers without a card keep working. The detailed format lives in a separate extension repository, not in the SEP.
Cloudflare changes how Block treats mixed-use crawlers
- Proven Cloudflare’s post of 15 September introduces “Disallow AI Training”, a setting that publishes a no-training preference in robots.txt while accountable mixed-use crawlers stay allowed for search. It applies to Training only, not Search or Agent.
- Proven Block and “Block on pages with ads” now apply to mixed-use crawlers such as Applebot, Bingbot and Googlebot, so they affect search as well as training. Cloudflare says to use Disallow AI Training if you want to stop training but keep search.
- Proven Cloudflare calls operators “Accountable” if they offer, or commit to offering, a training opt-out, an AI summaries opt-out, URL-level visibility and assurance that opting out will not affect search. It names Apple, Google and Microsoft as meeting the requirements, with some capabilities still in development, and treats the relevant crawlers from Amazon, Anthropic, Meta and OpenAI as Accountable because they separate search and training crawlers.
Personal Agent Protocol: a proposal from Sierra and Meta
- Practice AI Weekly reports that Sierra and Meta announced the Personal Agent Protocol on 6 October 2026 as a proposed open standard for how personal AI agents authenticate with businesses and what the businesses let them do. Founding partners are Walmart, Shopify, Stripe, Rocket, Genesys and Instinct.
- Practice The design is OAuth-based. Agents can act as guests, and signed-in customers decide whether an agent gets read-only or write access. A business chooses whether agents work through its website, through APIs (the page mentions MCP and OpenAPI) or through its own agent. Payments are described as a future extension.
- Experimental It is a proposal. A v0.1 specification is due later in October, Constellation Research calls the spec “really early”, and the page notes that Amazon, OpenAI and Anthropic are not founding partners. We could not open Sierra’s or Meta’s own announcement.
Context: the IETF AI preferences vocabulary is still a draft
- Proven The latest revision of “A Vocabulary For Expressing AI Usage Preferences” (draft-ietf-aipref-vocab-08) is dated 13 September, just before this window. It defines usage categories for AI Training, AI Use and Search, with an example serialization.
- Proven Its Note to Readers says the contents do not reflect Working Group consensus, so it is not a finished standard.
What we could not verify
Reports of Shopify opening checkout to browser agents through WebMCP, of Amazon blocking Meta’s Muse agent from buying, and of new always-on cloud agents from OpenAI and Anthropic each rested on a single secondary article we could read, and none of the primary announcements were reachable. We are not reporting details until they are corroborated.