Could an AI shopping agent buy from your store?
Paste your address. In about five minutes we walk the path an agent takes — find, compare, buy, after — and show you the step where one would stop.
The path an agent takes
Find, compare, buy, after the order. Each stop is something the scan reads or reports, in the order an agent would need it, and every figure under it is the crawler’s own limit. The one branch, in red, is what happens when a shop tells us not to come in.
First, we ask permission
robots.txt…, in progress
read first, and obeyed
If robots.txt refuses us, we fetch your home page once, so the report can say “blocked” rather than “saw nothing”, and the scan stops.
Rate limit, not yet
2 a second, 75 pages at most
Find
Home page, not yet
fetched, then rendered
Sitemap, not yet
product addresses, if published
Search, not yet
tried with a real product name
Compare
Product pages, not yet
price, stock, variants
Policies, not yet
shipping, returns, terms
Buy
Cart, not yet
and the checkout it links to
Checkout, not yet
the usual addresses, read only
After the order
Order and returns, not yet
status, returns, support
What comes back
Where it would stop, not yet
the first step it cannot pass
Ready score, not yet
out of 100, by step
What you see, and what an agent reads
Two of our own test stores at the compare step, captured by the same browser that runs a scan. They look almost the same: one publishes its price as text, the other a picture of a price, and only the right-hand column can tell you which.
Trail Grip Pro
€119.00Price in EUR incl. VAT, excl. shipping
In stock — ships in 1–2 days
What an agent reads
- Price
- read as text
- Currency
- read as text
- Availability
- read as text
- Sizes
- read as text
Trail Grip Pro
no currency given anywhere in the page text
Availability: ask in chat
What an agent reads
- Price
- an SVG image with no alt text
- Currency
- nowhere in the page text
- Availability
- “ask in chat”
- Sizes
- an unlabelled colour swatch
46 checks along 4 steps, every id published
What we check
All 46 of them, grouped by the step of an agent’s path they read, with the ids you will see beside every finding in a report. The last group sits beside the path: it does not stop a purchase, but it decides how agents are treated and whether you can see them.
- OpenAI4 agents
- Anthropic3 agents
- Perplexity2 agents
- Google3 agents
- Amazon3 agents
- Meta2 agents
- Apple2 agents
- Microsoft1 agent
- ByteDance1 agent
- Common Crawl1 agent
- trains a model
- indexes for search
- browsing for a person
- trying to buy
10 vendors, 22 named agents between them — every one read from the same list the check reads. Whether your shop lets any of them in is a finding, not a picture; it comes back with your report.
Find
An agent has to find your shop and your products without a person pointing the way.
- robots.txt allows AI agents
- llms.txt present and non-trivial
- Sitemap with product URLs
- Product structured data
- Structured data matches rendered page
- Content available without JavaScript
- Agent commerce discovery documents
- Search endpoint usable by GET
- Pages served as Markdown on request
- Agent discovery Link headers on the home page
- API catalog published
- MCP server card published
- A2A agent card published
- Agent Skills index published
- WebMCP tools exposed to browser agents
- Agent resource catalog (ARD) published
- DNS-AID agent discovery record published
Compare
It has to read price, stock, delivery and returns as text it can trust.
Buy
It has to reach the payment step as a guest, with nothing in the way.
- Guest checkout available
- No CAPTCHA before the payment step
- PSP supports agent payment tokens
- Agent checkout endpoint present
- x402 payment challenge offered
- Machine Payments Protocol (MPP) discovery published
- OAuth / OpenID authorization server metadata published
- OAuth protected resource metadata published
- auth.md agent registration guide published
After the order
It has to track the order, start a return and reach support.
Beside the path
Checks that do not block a purchase, but decide how agents are treated and seen.
- Analytics distinguishes AI agents from humans
- Bot management present
- Web Bot Auth key directory published
- Checkout has stricter controls than the product page
- Content Signals / AI usage preferences declared
- Spoofed agent UA accepted
- Signed vs unsigned differentiation
- Search/catalog rate limiting
- Catalog enumeration
- Checkout automation controls
- Intent segmentation
- Pay-per-crawl / content access policy · not scored
What comes back
01
Where an agent would stop
The first step on the path — find, compare, buy, after — that an agent could not pass on your shop, and what it read there.
02
Ready score
Could an agent find your products, read prices and stock, and check out as a guest? Read from your own pages, scored out of 100, with the step it lost each point in.
03
What each check read
What each check read on your shop: the page, the markup, the thing it could not find. It is the part people forward to the team that can fix it.
04
The fix list
Each finding says who fixes it, how much effort it is, and which check produced the evidence — so it can be assigned rather than discussed.
A second score, Safe, reads whether you can tell a real agent from a spoofed one. It needs you to verify your domain first, because it reads things a stranger should not.
The limits we keep
We scan shops whose owners did not ask us to. That is only defensible with limits that are written down, enforced in the code rather than in a policy, and easy to refuse. Part of what we report to a merchant is which AI crawlers their own robots.txt blocks — a product that does that owes a plain account of how to block it.
75
pages, at most
A hard ceiling for the whole scan, held in the one HTTP client every fetch goes through. Past it, calls are refused before they reach the network.
2
requests a second
Per host, paced by a token bucket. A scan of your shop is quieter than one person browsing it.
Both
count a rendered page
When we open a page in a real browser, that navigation is charged against the page budget and the rate limiter exactly like a plain fetch. Renders used to go around both.
First
we read robots.txt
Every scan, before anything else. If it refuses our crawler we fetch your home page once — so the report can say “blocked” rather than “saw nothing” — and stop.
30
days, then deleted
Screenshots and captured page data expire on a storage lifecycle rule rather than on someone remembering.
One
user agent, never disguised
The same name on plain requests and on the pages we render. We do not rotate it and we do not dress the crawler up as an ordinary browser to get past a rule you set for it.
What we cannot tell you
no score
When the evidence is thin, there is no score.
A withheld score is printed at the size a score would have been, in the place a score would have been, with the reason it was withheld. We would rather show you nothing than a number we cannot stand behind.
skipped
A check that could not run says so.
When bot management answers instead of the shop, or a page never loads, the check is skipped with its reason attached. It is never guessed and never averaged away.
no logos
We have no customers to show you.
This is new. Everything on this page is either our own test store or a real scan of a real shop, and there is nothing else we could honestly put here yet.
Want help fixing what the scan finds?
Every full report comes with a free consultation: we go through what the scan found with you and tell you what to fix first. Ask for it with one click on your report, and we'll email you within one business day.
See the step where an agent would stop in your store.
One address, one scan, no account. You get the score step by step, the findings and the list of who fixes what — and your robots.txt can refuse us at any point without asking.