Where this started
I have been thinking about the next web for years. For a long time I assumed it would be an app, or something more cinematic, a game like world we would all live inside. Instead the AI era arrived, and it arrived fast. What we got was not a metaverse. It was chatbots and agents. For the first time you are not lost in the web on your own. You have an assistant that can guide you through it.
A week ago I wrote down why that matters and introduced AI2Web. The idea fits in one sentence: describe your website once, and AI2Web makes it understandable to every AI.
This post is the fuller story. Where it started, what has actually been built, how the safety works, and the moment this week when it stopped being a claim and became something you can watch an AI agent do.
The problem, said plainly
Right now AI agents use a web that was designed for human eyes. They scrape HTML. They guess at forms. They render entire pages just to find one price or one button. It works, barely, and it recreates the same fragmentation and waste that made the web so heavy in the first place.
There is a second problem underneath that one, and it is the one I keep coming back to. Discovery on the web is pay to win. A local shop cannot outrank a Fortune 500 on Google, no matter how good it is. You compete on ad budget, not on merit.
Now imagine we carry that into the agent era. Everyone pictures a future where every business opens a Claude account, and a ChatGPT account, and a Grok account, and manages a presence inside each one. That is not the end of the web. It is the biggest walled garden ever built, and only the giants can keep up. Small businesses get shut out all over again.
I do not want to watch that happen. The web should not need permission from a single company, and being found should not be reserved for whoever spends the most.
The idea in one line
Describe your business once, in one open file any agent can read, and any AI can discover it and safely act on it.
That file is a capability manifest, published at a predictable place on your own domain: /ai2w. It describes your identity, your content, your products, the actions an agent can take, and the rules around them. From that one description, AI2Web speaks whichever protocol an assistant understands, MCP, ACP, REST, GraphQL, feeds and more. You do not rebuild for each assistant. You describe once, and it works across all of them.
No HTML to scrape. No SEO game to play. No separate account per vendor. One open file, and the agent that reads it can be Grok, Claude, ChatGPT, or something that does not exist yet.
What has actually been built
I could have kept this as a product. I did not, because a standard only works if it belongs to everyone. So the whole thing lives in the open, under github.com/ai2web-foundation, MIT licensed.
Here is what exists today:
- The specification and a growing set of RFCs. The capability model, discovery, the action and event schema, authentication and consent, governance, agent identity, and interoperability, all versioned in the open so people can challenge and shape them.
- Reference implementations in five languages. JavaScript and TypeScript, Python, PHP, Go, and .NET, plus React helpers. Each one can build a manifest, validate it, negotiate capabilities, and serve every AI2Web route from one call. They share the same tests so they cannot quietly drift apart.
- A validator and an AI Readiness Score. Point it at any site and it scores how ready you are for agents, out of 100, with a clear tier. You can run it in the browser or from the command line.
- A discovery directory, so agents can find capable sites instead of guessing.
- Plugins and apps for the platforms real businesses use. A WordPress plugin that turns a site AI ready on activation, an early Shopify app that generates a store’s manifest from its own data, and a browser extension.
- A live demo store at store.ai2web.dev, so none of this is theoretical.
The pieces I built this week went deeper into the parts that decide whether this is trustworthy: a governance layer for rate limits and consent, agent identity, an interoperability layer that can also emit llms.txt and a generic agent.json from the same manifest, and the beginnings of a signals and reputation model. Everything additive, so a simple manifest stays simple.
Safe by design
The most important part is not what an agent can do. It is what it cannot do without asking.
The rule is simple: make safe things easy and dangerous things explicit. Reading a manifest never changes anything. Checking stock, searching a catalog, tracking your own order, those just work. But anything that moves money or data, a payment, a refund, a return, always stops and asks the user to approve first. Even if a manifest tries to under declare the risk, the executor still previews high risk actions before running them, so a careless or hostile description cannot slip a destructive action through.
There is more underneath. Refunds and returns are request only, which means an agent can file a request for a human to review but can never issue the money itself. Looking up a private order needs proof of ownership, your own email, and a wrong email is indistinguishable from an order that does not exist, so nothing can be enumerated. Credentials stay with the origin that issued them and never appear in a URL. High risk actions leave an audit trail.
None of that is exciting to write. All of it is the difference between an agent web people can trust and one they cannot.
The moment it became real
This week I stopped describing it and asked an AI to test it.
I pointed Grok at the live demo store and asked it to fetch store.ai2web.dev/ai2w and tell everyone what the store lets an agent do, and what it has to ask permission for first. No hint, no setup, just the link.
It fetched the file and reported back on its own. It listed the actions: check stock without permission, track orders, report issues, use the agent service for questions and handoffs. It correctly flagged the actions that require explicit consent first: purchases, payments, refunds, returns, cancellations. And then it said the thing I have been trying to say for a week, in its own words:
One open file per business with consent gates. Any agent can discover it, understand capabilities, and act safely. No separate accounts, no walled gardens, no pay to win discovery. Small local shops could finally compete on merit instead of ad budgets.
That is the whole thesis, confirmed by an AI that had never seen the project, reading a real file live in front of everyone. Not a mockup, not a promise. An endpoint that works with Claude, ChatGPT and Grok today, over MCP.
Why this could actually help, beyond the tech
Two things keep me building this.
The first is fairness. If discovery becomes about the best fit for what someone needs, instead of the biggest ad budget, a corner shop is as reachable to an agent as a global brand. That is a small change in how a file is read and a large change in who gets found. Scale it across every business and it quietly reopens the economy to the people the current web left behind.
The second is waste. AI already consumes an enormous amount of compute and energy. Making every model scrape and render a full web page, over and over, is one of the most wasteful things we could design. A shared, structured layer sends a few kilobytes of meaning instead of megabytes of markup. Less parsing, less bandwidth, less energy. It is the green argument, applied to AI.
Simple, shared, light, fair. Those are the only reasons a layer like this is worth building at all.
Where it needs help
A standard is not something one person ships. It is something a community adopts and hardens.
If you build websites, AI agents, or the tools in between, I would genuinely love your eyes on it. There is real work to do across all five languages: SDKs, plugins, validators, examples, and the MCP and REST layers that connect them. It is all MIT open source, and the best thing you can do first is try to break the demo and tell me where it falls short.
Come and help define the standard the agent web runs on.
- The site and validator: ai2web.dev
- The live demo manifest: store.ai2web.dev/ai2w
- The code, spec and SDKs: github.com/ai2web-foundation
Closing
A week ago this was an argument. Today an AI can read a real store, understand what it offers, and know exactly what it must ask permission for, all from one open file.
The web does not have to die for the agent era to begin. It becomes the next web. Clearer for machines, fairer for the small guy, lighter on the planet.
Describe once. Works everywhere. That is still the whole idea. Now it is just a little harder to argue with.