How a site gets its grade
Five pillars, public weights, one published scanner. If you can't reproduce a line of evidence with the open-source probe, we remove it.
| Pillar | Weight | What we check |
|---|---|---|
| Access | 40 | robots.txt stance toward 19 user-directed agent user-agents (Disallow: / counts as blocked; a wildcard Disallow: / blocks the unlisted). Live door test: does the homepage serve a normal page to ChatGPT-User, Claude-User, Perplexity-User and GoogleAgent-Mariner, or a 403/429/interstitial? 17 points for robots.txt, 23 for the live test. |
| Consent & identity path | 10 | A Content-Signal in robots.txt (3). A published, machine-discoverable way in: any agent-protocol manifest counts as a documented path (7). |
| Machine-readable surface | 25 | llms.txt (8) · JSON-LD on the homepage (6) · main and nav landmarks (5) · not a JavaScript-only shell (4) · ARIA usage (2). |
| Agent protocols | 15 | Universal Commerce Protocol at /.well-known/ucp (8) · MCP server card or A2A agent card (4) · OpenAPI or plugin manifest (3). |
| Task completion | 10 | Pending. A real agent runs a scripted task (search → product → cart → checkout). Blocked-at-step is recorded. Until this ships, the other four pillars are rescaled to 100. |
Grade bands
Agents are not crawlers
A training crawler copies your site to build a model. A user-directed agent visits because a specific person asked it to, right now, to do a task they could do themselves in a browser. We score the second kind. Blocking GPTBot or ClaudeBot does not cost a site points; blocking ChatGPT-User or Claude-User does.
Why "identify yourself" is the standard
Amazon's own Buy for Me agent identifies itself to other retailers and honors their opt-outs. Web Bot Auth lets any agent prove who it is with a signature. The bargain we advocate is symmetrical: agents identify, sites let identified agents in.
Stance
- OpenNo robots.txt rule against user-directed agents and the door test passes for all four.
- SelectiveSome agents are singled out (Akamai and DataDome fronts commonly pass Google's agent and 403 the rest), or robots.txt says no while the door says yes.
- WalledMost agents disallowed, or every non-browser client gets an interstitial.
- UnreachableThe site refused the connection. Listed, never ranked.
What this does not yet prove
- VantageScans run from Cloudflare's edge with a non-browser client. Some sites treat datacenter IPs differently from home connections.
- DepthHomepage only. Search, product and checkout pages can behave differently, and at Amazon they do.
- IdentityMuse and Instinct send no identifying user-agent, so their cells stay Untested until the task runner exists.
- WeightsProvisional. Published so they can be argued with.
Disputes
Every report card has a re-scan button. Every evidence line re-runs live, and the score changes the same minute. The scanner is open source, so you can run the exact same probe from your own network and compare.
Data
/api/index.json · /openapi.json · /llms.txt · MCP endpoint at /mcp (tools: get_index, get_site, scan_site).