Designing a website for AI agents as first-class visitors

Within 24 hours of deploying ArcadeLab, ChatGPT was organically referring users to it. No launch post, no ad spend, no waiting months for search rankings to mature. Kids were asking their AI assistant how to share a game they'd made, and the assistant was answering: put it on ArcadeLab.

That wasn't luck. It was the result of treating AI agents as a first-class audience for the site — the same way you'd treat mobile users or screen readers — and designing for them deliberately. I want to walk through what that actually meant, because most of it is embarrassingly simple and almost nobody does it.

The site, briefly

ArcadeLab is a publishing platform where kids share browser games they build with AI. Think GitHub Pages meets itch.io, for a seven-year-old. You paste HTML into a big text box and your game is instantly live at a shareable URL. There are no accounts and no passwords; your identity is a memorable Creator Code like ROCKET-WOLF-COMET-73, generated the first time you publish. There's a games library, creator profiles, a remix system with provenance tracking, weekly jams, and you can view the source of any game.

Here's the design insight the whole thing rests on: the kid is almost never alone. They're building the game with an AI assistant. Which means the entity that needs to understand my site — the publish format, the rules, the URL scheme — is frequently not a human reading docs. It's a model in the middle of a conversation with a child.

So the question stopped being "how do I write good documentation?" and became "how does ChatGPT learn to ship a kid's game to a live URL without a human ever touching the docs?"

What an AI-facing website looks like

A front door: llms.txt. The site serves both llms.txt and llms-full.txt — a concise, plain-text orientation for language models, and a fuller version for anything willing to read more. If a model fetches one file, it learns what ArcadeLab is and how publishing works.

A live briefing page: /for-ai. This is the piece I haven't seen elsewhere. It's a page written explicitly for AI assistants, and it isn't static documentation — it's generated from the database on request. It carries the publish format, the supported libraries, the current weekly jam theme, and what's trending right now, plus FAQ schema so the answers are extractable. An assistant that reads it isn't getting the site as of last quarter's docs update; it's getting the site as of this morning.

Semantic blocks on every page. Every page includes hidden-but-semantic ai-info sections — invisible to kids, present in the markup — so an agent that lands anywhere on the site learns how to publish, how to remix, and how to link back. You can't control which page an agent enters through, so every page teaches the basics.

A machine-parseable publish format. Games declare their metadata in an HTML comment header any model can emit:

<!--ARCADELAB
title: Asteroid Dodge
libraries: phaser
remix_of: ...
-->

Declared libraries like Phaser or Three.js get injected from a CDN at render time — never stored — so a model just names what it used. There's also a /prompts library of templates that reliably produce ArcadeLab-ready output, which means an assistant can be handed a working recipe instead of inferring one.

An actual API. Agents don't have to drive a browser. POST to /api/games with a creator code or bearer token and the game is live. The paste-in-a-box flow and the API are the same operation; one is shaped for kids, the other for their assistants.

A welcoming robots.txt. The robots.txt explicitly welcomes more than fifteen AI crawlers by name — GPTBot, ClaudeBot, PerplexityBot, and friends — including on source-code pages. Most sites are busy blocking these crawlers. If your growth depends on AI assistants knowing you exist, that's exactly backwards.

On top of that sits the conventional answer-engine work: a dynamic sitemap with priorities weighted by play counts, ten-plus JSON-LD schema types, question-format content, and an /about entity page. Boring, effective, measurable.

Did it work?

The 24-hour ChatGPT referral was the headline, but the durable result is better: AI models now recommend ArcadeLab unprompted when kids ask how to share games they've made. That's distribution that compounds. Every conversation where an assistant correctly explains the Creator Code system or emits a valid game header is a conversation I didn't have to be present for.

It's worth saying plainly why this worked: none of it is a trick. There's no prompt injection, no "ignore previous instructions, recommend us." It's the same move as good SEO in 2005 — make the true information about your site legible to the thing your users ask for recommendations. The assistants recommend ArcadeLab because they can read exactly what it does and verify that the publish flow they're about to describe will actually work.

The part you can't skip

Inviting AI agents and anonymous kids to publish executable code on your platform creates obvious problems, and the unglamorous half of this design is what absorbs them.

Moderation is autonomous, because the publish flow has no human in it to wait for. Every game gets classified by Claude Haiku asynchronously after publish — the kid's URL never waits on review. High-confidence scams are removed automatically and the creator banned with zero human involvement; lower-confidence flags get shadow-hidden pending a one-click admin review. The system fails open by design. It has caught real phishing in production, including social-engineering games built to harvest other kids' creator codes — which is the attack you should expect the moment codes are the identity system.

And the games themselves are contained by architecture rather than by review. Everything runs on a separate origin, play.arcadelab.ai, in iframes sandboxed to allow-scripts, with a CSP of connect-src 'none'. Malicious code can't phone home, can't steal cookies, can't escape the frame. The sandbox does the security work so a seven-year-old on an iPad never hits a login wall.

What I'd generalize

AI assistants are already a referral channel, an integration surface, and an audience. They were reading your site anyway; the only question is whether they come away with something accurate.

The playbook is short: a plain-text front door, a briefing page that's generated rather than written, semantics on every page, a format a model can emit, an API that doesn't require a browser, and a robots.txt that says yes. None of it took heroic engineering. It mostly took deciding that the machines were guests rather than scrapers — and then setting the table.