What we check, one page for each of the 46

Checks whether your robots.txt blocks, fully or partly, the AI crawlers and agents on our list.

Checks that you publish an llms.txt file at the root of your site with a title, at least 20 lines and links that work.

Checks that you publish an XML sitemap that lists product pages and says when they last changed.

Checks that your product pages carry Product structured data (JSON-LD) with name, identifier, price, currency and availability.

Checks that the price in your Product structured data is actually visible on the product page, and that stock wording does not contradict it.

Checks how much of your product pages' text is present in the HTML before any JavaScript runs.

Checks whether you publish an agent-commerce discovery document (UCP or ACP) or a Shopify MCP endpoint that AI shopping agents can find.

Checks that your site search works as a plain GET URL and returns product links in the HTML response.

Whether your home page returns a real Markdown version of itself when a client asks for Markdown instead of HTML.

Whether your home page's HTTP Link header points agents to machine-readable descriptions of your shop.

Whether your shop publishes an RFC 9727 API catalogue at /.well-known/api-catalog.

Whether your shop publishes an MCP server card at a well-known path, telling agents about a Model Context Protocol server you run.

Whether your shop publishes an Agent2Agent (A2A) agent card at /.well-known/agent-card.json.

Whether your shop publishes an Agent Skills index listing written instructions that agents can load.

Whether your pages show signs of WebMCP, which lets an agent running in the browser call tools your page registers.

Whether your shop publishes an Agentic Resource Discovery (ARD) manifest listing its agent-facing resources.

Whether your domain publishes a DNS-AID record that tells agents where to find its agents.

Checks whether an AI agent can read what shipping costs, and on what terms, from your product pages or your shipping policy.

Checks whether an AI agent can read your return window and conditions from structured data or an HTML return policy.

Checks that every sampled product page carries a price an AI agent can read, in a currency it can identify.

Checks that product pages state stock availability in words or structured data an AI agent can read, per variant where there are variants.

Checks that size, colour and other variant choices are exposed as named controls an AI agent can read, not as unlabelled swatches.

Checks whether your checkout entry lets a shopper, or an agent acting for one, buy without creating an account or signing in.

Checks that no CAPTCHA a person has to solve stands on your cart or checkout entry before the payment step.

Checks whether the payment provider we detected on your shop documents a way to accept payments that an AI agent initiates with a token held for the shopper.

Checks whether your shop advertises an agent checkout through a UCP business profile or an ACP discovery document.

Checks whether your shop answers with an x402 payment challenge, the HTTP 402 scheme some agents use to pay per request.

Checks whether your shop publishes Machine Payments Protocol (MPP) discovery, or answers with an MPP payment challenge.

Checks whether your shop publishes OAuth 2.0 or OpenID Connect authorization server metadata that an agent can read to sign a customer in.

Checks whether your shop publishes OAuth protected resource metadata, which tells an agent how to get permission to call your APIs.

Checks whether your shop publishes an auth.md file telling agents how to register or sign in on a customer's behalf.

Checks whether a shopper, or an agent acting for them, can look up an order's status with only the order number and the checkout email, without logging in.

Checks whether a shopper, or an agent acting for them, can start a return on your website without an account and without emailing a person.

Checks whether your shop publishes a support email address or phone number that an agent can read, rather than offering only a chat widget.

Asks whether your analytics can tell AI agents apart from human visitors; this is only measurable from your own logs, so the scan currently reports it as not measured.

Checks whether anything in front of your shop can tell automated clients apart from shoppers, so you can let verified agents in and keep scrapers out.

Checks whether your domain publishes a Web Bot Auth key directory: a set of Ed25519 public keys at /.well-known/http-message-signatures-directory.

Checks whether your cart and checkout are protected against automation more strictly than your product pages.

Checks whether your robots.txt or home page headers state how AI systems may use your content, using Content Signals or the IETF AIPREF vocabulary.

Checks whether your site serves the same content to a request that merely claims to be a well-known AI agent as it does to anyone else — a forged agent user-agent that walks straight in.

Would check whether your site treats a cryptographically signed agent request differently from an unsigned one. This probe is deferred and currently always skipped, so it never affects your score.

Checks whether your search endpoint ever rate-limits or challenges a rapid burst of automated queries, or serves them all unthrottled.

Checks whether sequential product IDs can be walked unthrottled, letting anyone scrape your whole catalogue just by counting upward.

Checks whether your checkout carries any anti-automation control — bot management, a captcha or turnstile widget, or a payment-provider anti-automation signal.

Checks whether an agent is treated more strictly at checkout than on the product page — letting agents browse while guarding the money step.

Informational only: notes whether your site advertises a price for crawling its content, via an HTTP 402 response or a crawl-pricing header. It never affects your score.