The 51 checks a passive scan runs, each with its own page

Checks whether your robots.txt blocks, fully or partly, the AI crawlers and agents on our list.

Checks that you publish an llms.txt file at the root of your site with a title, at least 20 lines and links that work.

Checks that you publish an XML sitemap that lists product pages and says when they last changed.

Checks that your product pages carry Product structured data (JSON-LD) with name, identifier, price, currency and availability.

Checks that the price in your Product structured data is visible on the product page, and that stock wording does not contradict it.

Checks how much of your product pages' text is present in the HTML before any JavaScript runs.

Checks whether you publish an agent-commerce discovery document (UCP or ACP) or a Shopify MCP endpoint that AI shopping agents can find.

Checks that your site search works as a plain GET URL and returns product links in the HTML response.

Checks whether your home page returns a real Markdown version of itself when a client asks for Markdown instead of HTML.

Checks whether your home page's HTTP Link header points agents to machine-readable descriptions of your shop.

Checks whether your shop publishes an RFC 9727 API catalogue at /.well-known/api-catalog.

Checks whether your shop publishes an MCP server card at a well-known path, telling agents about a Model Context Protocol server you run.

Checks whether your shop publishes an Agent2Agent (A2A) agent card at /.well-known/agent-card.json.

Checks whether your shop publishes an Agent Skills index listing written instructions that agents can load.

Checks whether your pages show signs of WebMCP, which lets an agent running in the browser call tools your page registers.

Checks whether your shop publishes an Agentic Resource Discovery (ARD) manifest listing its agent-facing resources.

Checks whether your domain publishes a DNS-AID record that tells agents where to find its agents.

Checks whether the UCP profile at /.well-known/ucp passes the official UCP schema for the release it declares.

Checks whether your UCP profile declares a published UCP release.

Checks whether your UCP profile declares at least one service an agent can reach, with a well-formed endpoint.

Checks whether your UCP profile declares the capabilities an agent needs to find products and buy them.

Checks whether the spec and schema links in your UCP profile still lead somewhere.

Checks whether your robots.txt lets the agents that shop for buyers read your UCP profile.

Checks whether your UCP profile answers on both your bare domain and its www host.

Checks whether your homepage has Organization structured data (JSON-LD) that names your business and says how to reach it.

Checks that your homepage has the four Open Graph properties ogp.me requires.

Checks that your homepage declares a viewport with width=device-width.

Checks that your homepage is served over HTTPS and that http:// redirects to https://.

Checks whether an AI agent can read what shipping costs, and on what terms, from your product pages or your shipping policy.

Checks whether an AI agent can read your return window and conditions from structured data or an HTML return policy.

Checks that every sampled product page carries a price an AI agent can read, in a currency it can identify.

Checks that product pages state stock availability in words or structured data an AI agent can read, per variant where there are variants.

Checks that size, colour and other variant choices are exposed as named controls an AI agent can read, not as unlabelled swatches.

Checks whether your checkout entry lets a shopper, or an agent acting for one, buy without creating an account or signing in.

Checks that no CAPTCHA a person has to solve stands on your cart or checkout entry before the payment step.

Checks whether the payment provider we detected on your shop documents a way to accept payments that an AI agent initiates with a token held for the shopper.

Checks whether your shop advertises an agent checkout through a UCP business profile or an ACP discovery document.

Checks whether an AI shopping agent has any way to complete a purchase on your site: a cart, a checkout, a payment provider or a recognised store platform.

Checks whether your shop answers with an x402 payment challenge, the HTTP 402 scheme some agents use to pay per request.

Checks whether your shop publishes Machine Payments Protocol (MPP) discovery, or answers with an MPP payment challenge.

Checks whether your shop publishes OAuth 2.0 or OpenID Connect authorization server metadata that an agent can read to sign a customer in.

Checks whether your shop publishes OAuth protected resource metadata, which tells an agent how to get permission to call your APIs.

Checks whether your shop publishes an auth.md file telling agents how to register or sign in on a customer's behalf.

Checks whether your UCP profile declares the payment handlers an agent can use at checkout.

Checks whether your UCP profile publishes public signing keys, and only public ones.

Checks whether the MCP server your UCP profile declares answers a tools/list request with the UCP tools.

Checks whether your shop publishes a support email address or phone number that an agent can read, rather than offering only a chat widget.

Asks whether your analytics can tell AI agents apart from human visitors; this is only measurable from your own logs, so the scan currently reports it as not measured.

Checks whether anything in front of your shop can tell automated clients apart from shoppers, so you can let verified agents in and keep scrapers out.

Checks whether your domain publishes a Web Bot Auth key directory: a set of Ed25519 public keys at /.well-known/http-message-signatures-directory.

Checks whether your cart and checkout are protected against automation more strictly than your product pages.

Checks whether your robots.txt or home page headers state how AI systems may use your content, using Content Signals or the IETF AIPREF vocabulary.

Checks whether a request that only claims to be a well-known AI agent, through a forged user-agent, gets the same content from your site as anyone else.

Would check whether your site treats a cryptographically signed agent request differently from an unsigned one. This probe is deferred and currently always skipped, so it never affects your score.

Checks whether your search endpoint ever rate-limits or challenges a rapid burst of automated queries, or serves them all unthrottled.

Checks whether sequential product IDs can be walked unthrottled, letting anyone scrape your whole catalogue just by counting upward.

Checks whether your checkout carries any anti-automation control: bot management, a captcha or turnstile widget, or a payment-provider anti-automation signal.

Checks whether an agent is treated more strictly at checkout than on the product page, so agents can browse while the money step stays guarded.

Informational only: notes whether your site advertises a price for crawling its content, via an HTTP 402 response or a crawl-pricing header. It never affects your score.