Loading
Visa scores 51 out of 100 on the Agent Readiness Index
Visa reaches level 1, Tolerated. Web experience is the strongest area at 79 out of 100. Protocol access is the weakest at 36.
Visa was scanned on October 2, 2026. Its score is 51 out of 100, level 1, Tolerated. Pages load for an agent. Nothing is built for one. To reach level 2, Legible: Publish at least one machine readable layer: llms.txt, structured data or server rendered content.
Website: visa.com
Score by area
| Area | Score | What it asks |
|---|---|---|
| Discoverability | 60 out of 100, worth 15 points | Can an agent find and read your pages? |
| Protocol access | 36 out of 100, worth 20 points | Can an agent connect to you through MCP or an API? |
| Identity and delegation | 36 out of 100, worth 20 points | Can a customer give an agent limited access without sharing a password? |
| Web experience | 79 out of 100, worth 15 points | Does your site work when an agent uses it? |
| Voice and IVR | Not measured yet | What happens when an agent calls your phone line? |
| Policy and governance | 51 out of 100, worth 10 points | Do your terms allow agents that act for customers? |
What is holding Visa back
- MCP server, 8 points lost. No MCP server, server card or registry entry was found for this organization. Fix: Publish a remote MCP server with OAuth. Start with read only tools such as account status, orders or location search, and publish a server card at /.well known/mcp/server card.
- OAuth and OpenID metadata, 5 points lost. No OAuth or OpenID metadata was found on the 6 hosts that answered. 8 other hosts did not answer the scanner and could not be checked. Agents cannot discover where to send a customer to approve access. Fix: Publish /.well known/oauth authorization server and /.well known/oauth protected resource for the customer facing APIs.
- PKCE and client registration, 4 points lost. No authorization server metadata, so PKCE and client registration could not be confirmed. Fix: Require PKCE with S256 and support client ID metadata documents or dynamic client registration for approved agent clients.
- Sign in page loads for a declared agent in a browser, 4 points lost. The sign in address that was tried returned status 404, so the sign in page itself could not be confirmed. Fix: Serve the sign in page to verified agent browsers, and use signed agent identity to separate them from attackers.
What already works
- Robots policy for user triggered agents
- Home page for a declared agent
- Same behavior for a declared agent and a standard browser
How Visa compares
Ranked 11 of 17 on the Payments and fintech leaderboard. The average score for payments and fintech is 56.8 out of 100 across 39 organizations. The average across all 1,420 scored organizations is 42.2 out of 100.
Similar organizations
- Bread Financial, 55 out of 100
- Robinhood, 54 out of 100
- Venmo, 51 out of 100
- Green Dot, 50 out of 100
- Fiserv, 48 out of 100
- Intuit, 48 out of 100