The Act Layer Census
Of 7,548 top-10,000 domains probed on 4 November 2026, 208 publish OAuth server metadata, 21 an openapi.json and 19 an MCP discovery file. Valid files only: sites that answer every path with a web page are not counted. Ora's own leaderboard cohort publishes them more often.
The headline chart
| File | Top 10,000 | Ora leaderboard |
|---|---|---|
/.well-known/oauth-authorization-server | 208 of 7,468 (2.79%) | 253 of 3,375 (7.5%) |
/.well-known/agent-skills/index.json | 53 of 7,435 (0.71%) | 144 of 3,364 (4.28%) |
/.well-known/ai-catalog.json | 38 of 7,438 (0.51%) | 85 of 3,365 (2.53%) |
/openapi.json | 21 of 7,472 (0.28%) | 78 of 3,369 (2.32%) |
/.well-known/mcp.json | 19 of 7,470 (0.25%) | 66 of 3,366 (1.96%) |
/.well-known/agent-card.json | 10 of 7,470 (0.13%) | 48 of 3,368 (1.43%) |
Next to Ora's lab finding
In Ora's lab, agents reached openapi.json in 21 percent of traced runs on sites that ship one, and 97 percent of the openapi.json fetches arrived through a link, not a guessed path. That is a vendor-published finding from Ora's AgentReady launch post of 19 October 2026, read 4 November 2026. It counts agent runs on sites that already ship an OpenAPI file; the census counts how many sites ship one at all, so the two numbers answer different questions and should not be set against each other as rates.
Read together: a file is rare across the web (0.28% of probed top-10,000 domains publish a valid openapi.json), and where one exists agents reach it by following a link. Publishing the file is not enough; link it from the docs and from llms.txt.
Files by cohort
| File | Probed | Answered with JSON or YAML | Valid file | Share |
|---|---|---|---|---|
/.well-known/mcp.json | 7,470 | 27 | 19 | 0.25% |
/.well-known/agent.json | 7,461 | 12 | 6 | 0.08% |
/.well-known/agent-card.json | 7,470 | 17 | 10 | 0.13% |
/agents.json | 7,485 | 7 | 0 | 0% |
/openapi.json | 7,472 | 24 | 21 | 0.28% |
/openapi.yaml | 7,503 | 10 | 10 | 0.13% |
/.well-known/oauth-authorization-server | 7,468 | 214 | 208 | 2.79% |
/.well-known/ai-catalog.json | 7,438 | 39 | 38 | 0.51% |
/.well-known/agent-skills/index.json | 7,435 | 60 | 53 | 0.71% |
| File | Probed | Answered with JSON or YAML | Valid file | Share |
|---|---|---|---|---|
/.well-known/mcp.json | 3,366 | 82 | 66 | 1.96% |
/.well-known/agent.json | 3,366 | 17 | 14 | 0.42% |
/.well-known/agent-card.json | 3,368 | 48 | 48 | 1.43% |
/agents.json | 3,366 | 7 | 0 | 0% |
/openapi.json | 3,369 | 79 | 78 | 2.32% |
/openapi.yaml | 3,378 | 22 | 22 | 0.65% |
/.well-known/oauth-authorization-server | 3,375 | 253 | 253 | 7.5% |
/.well-known/ai-catalog.json | 3,365 | 85 | 85 | 2.53% |
/.well-known/agent-skills/index.json | 3,364 | 144 | 144 | 4.28% |
Edition page with the by-category chart, the directory split and the downloads: 4 November 2026 edition.
Method
- Source: the shared crawl of 4 November 2026, 13,071 domains, last request 2026-11-04 20:16 UTC. The crawl reads robots.txt first and skips what it disallows.
- Two cohorts: the Tranco top 10,000 list (9,999 domains, 7,548 reachable and probed) and the domains on Ora's public leaderboard (3,456 domains, 3,388 probed). A domain can sit in both.
- A domain is probed for a path when the crawl holds an HTTP status for it. Paths the crawl skipped for robots.txt or request budget are not probed and are not in the denominator.
- A file counts as found only when the answer is JSON (YAML for openapi.yaml) whose top-level keys match the file type. A web page that answers 200 does not count: on /.well-known/mcp.json that was 11.53% of the probed top-10,000 domains.
- The categories come from Ora's leaderboard, so only the leaderboard cohort has them.