robots.analysis
100.0% confidence- Allowed agent user count
- 3
- Allowed retrieval count
- 3
- Availability
- available
- Explicit agent user count
- 3
- Explicit ai crawler count
- 5
- Group count
- 4
- Known policy count
- 8
- Same origin schema map url count
- 0
Legacy site · Static audit
The static audit found gaps. Start with the fixes below.
Pass starts at 80 / 100. This scan does not prove that an agent can complete a purchase. Method and limits
35/ 100
NEEDS WORK
Readiness score
Scanned 2026-09-22 17:29:55 UTC
Start with these changes. Open a fix for the finding, example, and supporting evidence.
State whether access is public or needs credentials. Link the applicable authentication metadata.
# Authentication
Public report reads need no credentials.
Write requests require a bearer token.
Never put tokens in URLs.
Suggested location: /auth.md
Finding: The fixed discovery paths did not provide a usable OAuth authorization-server signal.
Change: Publish RFC 9728 protected-resource metadata and RFC 8414 authorization-server metadata.
Open this check and its evidenceFinding: The discovered OAuth metadata does not declare supported scopes.
Change: Publish scopes_supported in protected-resource or authorization-server metadata.
Open this check and its evidenceFinding: The scan did not find authorization-server metadata at the fixed well-known path.
Change: Publish RFC 8414 metadata at /.well-known/oauth-authorization-server.
Open this check and its evidenceFinding: The scan did not find /auth.md.
Change: Publish a stable agent authentication walkthrough at /auth.md.
Open this check and its evidenceFinding: The fixed discovery documents do not publish an agent_auth chain.
Change: Publish protected-resource metadata and an agent_auth block that points to /auth.md.
Open this check and its evidence# Authentication
Public report reads need no credentials.
Write requests require a bearer token.
Never put tokens in URLs.
Adapt this example to the service. Apply every relevant change listed above, then confirm it with a new scan.
Link public API instructions and a valid OpenAPI document. Show request and response examples.
Suggested location: /docs
Finding: No public API documentation link was found.
Change: Add a named link to the public API documentation.
Open this check and its evidenceFinding: No developer portal link was found.
Change: Add a named link to a public developer portal.
Open this check and its evidenceFinding: No MCP discovery signal was found at the bounded well-known paths.
Change: Publish /.well-known/mcp, a server card, or an MCP manifest.
Open this check and its evidenceFinding: The bounded static scan found no usable MCP endpoint, card, or manifest.
Change: Publish a server card or manifest and expose a Streamable HTTP MCP endpoint.
Open this check and its evidenceFinding: No MCP server card was found at /.well-known/mcp/server-card.json.
Change: Publish a server card with name, version, description, and a remote endpoint.
Open this check and its evidenceFinding: The official MCP Registry has an active name match, but the scan could not verify domain or repository ownership.
Change: Add the product domain or canonical public repository to the registry server metadata.
Open this check and its evidence{
"info": {
"title": "Example API",
"version": "1.0.0"
},
"openapi": "3.1.0",
"paths": {
"/status": {
"get": {
"responses": {
"200": {
"description": "Service status"
}
}
}
}
}
}
Adapt this example to the service. Apply every relevant change listed above, then confirm it with a new scan.
Describe the organization with valid JSON-LD. Use the real name and URL.
{
"@context": "https://schema.org",
"@type": "Organization",
"name": "Your product",
"url": "https://example.com/"
}
Suggested location: /
Finding: The page has no valid JSON-LD block.
Change: Publish valid JSON-LD that describes the site and its main products.
Open this check and its evidenceFinding: JSON-LD has no sameAs link.
Change: Add stable sameAs links for the organization or product entity.
Open this check and its evidenceFinding: No Organization JSON-LD entity was found.
Change: Add an Organization entity with stable identity and contact fields.
Open this check and its evidenceFinding: The page declares no valid JSON-LD type.
Change: Describe the organization, site, and main product with JSON-LD.
Open this check and its evidence{
"@context": "https://schema.org",
"@type": "Organization",
"name": "Your product",
"url": "https://example.com/"
}
Adapt this example to the service. Apply every relevant change listed above, then confirm it with a new scan.
Link only resources that the service provides. Use a Link header to identify the API description.
Link: </openapi.json>; rel="service-desc"; type="application/json"
Suggested location: Main page response headers
Finding: The final response has no HTTP Link header.
Change: Add HTTP Link relations for important machine-readable discovery resources.
Open this check and its evidenceLink: </openapi.json>; rel="service-desc"; type="application/json"
Adapt this example to the service. Apply every relevant change listed above, then confirm it with a new scan.
Use one documented error format. Match the HTTP status to the error.
HTTP/1.1 404 Not Found
Content-Type: application/problem+json
{"type":"about:blank","title":"Not found","status":404}
Suggested location: /api
Finding: The missing-path response is not a structured JSON error.
Change: Return application/problem+json or a stable JSON error object for API errors.
Open this check and its evidenceHTTP/1.1 404 Not Found
Content-Type: application/problem+json
{"type":"about:blank","title":"Not found","status":404}
Adapt this example to the service. Apply every relevant change listed above, then confirm it with a new scan.
Estimated gains use this report's model. All checks listed in a fix must pass to earn its full estimated gain.
10 checks passed. 44 need attention. 21 could not be verified. Checks that do not apply stay out of the score.
Results that need attention are listed first. Open a row for its reason and recommended change.
The product page does not advertise a public GitHub source repository.
Link the canonical public GitHub repository from the product page.
No Agent Skills index was found at the v0.2.0 discovery path.
Publish /.well-known/agent-skills/index.json with the v0.2.0 schema.
The fixed discovery documents do not publish an agent_auth chain.
Publish protected-resource metadata and an agent_auth block that points to /auth.md.
No Agent Skills index was found at /.well-known/agent-skills/index.json.
Publish an index with a non-empty skills array and a name and description for every skill.
The homepage agent-mode query did not return a dedicated view.
Serve ?mode=agent as JSON, Markdown, or plain text with capability and integration details.
The scan found fewer than two bounded onboarding signals.
Provide a visible developer entry point, public documentation, llms.txt, agent instructions, and an OpenAPI document.
The product page does not advertise a public GitHub source repository.
Link the canonical public GitHub repository from the product page.
The checked llms.txt and dedicated instruction paths do not explain when an agent should use the product.
Add a specific when-to-use section to llms.txt or a dedicated agent instruction document.
The missing-path probe does not return 404 or 410.
Return a real 404 or 410 instead of a 200 application shell for unknown paths.
No usable resource catalog was found at either bounded well-known path.
Publish /.well-known/ard.json or /.well-known/ai-catalog.json.
The product page does not provide a usable public CLI path.
Publish a CLI, a copyable install command, and a stable public documentation or package link.
No developer portal link was found.
Add a named link to a public developer portal.
The final response has no HTTP Link header.
Add HTTP Link relations for important machine-readable discovery resources.
The identified bot request received text/html, not Markdown.
Optionally serve a Markdown representation to the truthful AgentReadinessBot identity.
The missing-path response is not a structured JSON error.
Return application/problem+json or a stable JSON error object for API errors.
JSON-LD has no sameAs link.
Add stable sameAs links for the organization or product entity.
The page has no valid JSON-LD block.
Publish valid JSON-LD that describes the site and its main products.
No MCP server card was found at /.well-known/mcp/server-card.json.
Publish a server card with name, version, description, and a remote endpoint.
The bounded static scan found no usable MCP endpoint, card, or manifest.
Publish a server card or manifest and expose a Streamable HTTP MCP endpoint.
No MCP discovery signal was found at the bounded well-known paths.
Publish /.well-known/mcp, a server card, or an MCP manifest.
The scan did not find a Markdown homepage at /index.md.
Publish a text/markdown homepage at /index.md.
The canonical root did not return Markdown for a Markdown-preferred request.
Implement Accept: text/markdown negotiation or publish a stable Markdown route.
The page does not declare a Markdown alternate.
Add a link rel=alternate with type=text/markdown and a stable URL.
No scoped llms.txt file was found at the bounded docs, API, or developers paths.
Publish /docs/llms.txt, /api/llms.txt, or /developers/llms.txt with a focused resource index.
The product page has no reachable multi-language SDK evidence.
Link stable public SDK pages or package pages and identify their programming languages.
robots.txt does not publish a Schema Map directive.
Add schemamap: followed by the absolute URL of the structured feed map.
The product page does not link an NPM or PyPI SDK package.
Publish an SDK package and link its exact NPM or PyPI package page.
The fixed discovery paths did not provide a usable OAuth authorization-server signal.
Publish RFC 9728 protected-resource metadata and RFC 8414 authorization-server metadata.
The scan did not find authorization-server metadata at the fixed well-known path.
Publish RFC 8414 metadata at /.well-known/oauth-authorization-server.
No Organization JSON-LD entity was found.
Add an Organization entity with stable identity and contact fields.
No public API documentation link was found.
Add a named link to the public API documentation.
The page declares no valid JSON-LD type.
Describe the organization, site, and main product with JSON-LD.
The discovered OAuth metadata does not declare supported scopes.
Publish scopes_supported in protected-resource or authorization-server metadata.
The bounded Wikidata search found no entity with verified ownership of this domain.
Add the official website to the correct Wikidata entity, or link the correct Wikidata or Wikipedia page from structured data.
The product page exposes no direct skills.sh link or verifiable GitHub-owner association for a catalog lookup.
Link the official GitHub organization or exact skills.sh page from the product page or structured sameAs data.
No Web Bot Auth key directory was found at the well-known path.
Publish an Ed25519 JWK keys array with kid, x, nbf, and exp fields.
No server-rendered or inline-script WebMCP declaration was found.
Add declarative form tools or register tools through document.modelContext.
The scan did not find /auth.md.
Publish a stable agent authentication walkthrough at /auth.md.
The document has some semantic structure, but its landmarks or heading order are incomplete.
Use one main region, a navigation landmark, one clear H1, and sequential heading levels.
3 of 131 detected controls have no computed source name.
Add visible text, a label, aria-label, aria-labelledby, alt, or a suitable native value.
5 of 9 metadata fields are present.
Add the missing document and Open Graph metadata fields.
The source uses 1 custom role control(s), although each is keyboard reachable.
Replace custom role controls with native HTML controls where possible.
The official MCP Registry has an active name match, but the scan could not verify domain or repository ownership.
Add the product domain or canonical public repository to the registry server metadata.
The target uses 1 redirect(s), including 1 cross-origin redirect(s).
Use one stable canonical HTTPS URL and keep the chain on the intended origin.
The scan could not collect the required discovery evidence.
Run capture profile version 3 and confirm that robots and network access permit this request.
The scan could not collect the required discovery evidence.
Run capture profile version 3 and confirm that robots and network access permit this request.
The scan did not collect valid ranked web-search evidence for this query.
Configure the ranked search provider and run capture profile version 26 to collect new evidence.
The scan did not collect valid ranked web-search evidence for this query.
Configure the ranked search provider and run capture profile version 26 to collect new evidence.
The scan did not collect valid ranked web-search evidence for this query.
Configure the ranked search provider and run capture profile version 26 to collect new evidence.
The scan did not collect usable GraphQL introspection evidence.
Run capture profile version 17 and permit bounded public introspection.
The scan did not collect usable GraphQL introspection evidence.
Run capture profile version 17 and permit bounded public introspection.
The scan did not collect usable GraphQL introspection evidence.
Run capture profile version 17 and permit bounded public introspection.
The scan did not collect usable GraphQL introspection evidence.
Run capture profile version 17 and permit bounded public introspection.
The scan did not collect usable GraphQL introspection evidence.
Run capture profile version 17 and permit bounded public introspection.
The scan did not collect usable GraphQL introspection evidence.
Run capture profile version 17 and permit bounded public introspection.
The scan did not collect usable NLWeb inspection evidence.
Run capture profile version 16 to collect bounded NLWeb evidence.
The scan did not collect usable NLWeb inspection evidence.
Run capture profile version 16 to collect bounded NLWeb evidence.
The scan could not collect the required discovery evidence.
Run capture profile version 3 and confirm that robots and network access permit this request.
The scan could not collect the required discovery evidence.
Run capture profile version 3 and confirm that robots and network access permit this request.
The scan could not collect the required discovery evidence.
Run capture profile version 3 and confirm that robots and network access permit this request.
The scan could not collect the required discovery evidence.
Run capture profile version 3 and confirm that robots and network access permit this request.
The scan could not collect the required discovery evidence.
Run capture profile version 3 and confirm that robots and network access permit this request.
The scan could not collect the required discovery evidence.
Run capture profile version 3 and confirm that robots and network access permit this request.
The scan could not collect the required discovery evidence.
Run capture profile version 3 and confirm that robots and network access permit this request.
The scan could not collect the required discovery evidence.
Run capture profile version 3 and confirm that robots and network access permit this request.
No configured instruction-risk pattern was found in the evaluated hidden accessibility text.
robots policy permits all 3 evaluated retrieval crawlers at the root path.
The source HTML has 6150 visible text characters.
All 2 form fields have an explicit computed label.
The scanner received the target content without a bot block.
The estimated visible-text size is 1538 tokens.
Pricing is present in page text and in 1 link(s).
The page links to 5 trust-page categories.
robots.txt has explicit policies for 5 known AI crawler tokens.
robots.txt explicitly addresses 3 agent-user tokens and permits 3.
No inspectable public MCP HTTP endpoint was found.
No commerce or payment protocol signal was found.
No commerce or payment protocol signal was found.
The optional AI Catalog alias is not published. Its absence does not reduce the score.
No commerce or payment protocol signal was found.
No OpenAPI document was found at the bounded fixed paths, so this REST contract check does not apply to the stored evidence.
The primary public request did not return 401, so an authentication challenge hint was not required.
No identity, claim, or events endpoint was advertised.
No OpenAPI document was found at the bounded fixed paths, so this REST contract check does not apply to the stored evidence.
No OpenAPI document was found at the bounded fixed paths, so this REST contract check does not apply to the stored evidence.
No llms.txt content links were available for a bounded public-access sample.
No inspectable public MCP HTTP endpoint was found.
No inspectable public MCP HTTP endpoint was found.
No inspectable public MCP HTTP endpoint was found.
No inspectable public MCP HTTP endpoint was found.
No MCP server signal was found.
No MCP server signal was found.
No MCP server signal was found.
No inspectable MCP HTTP endpoint was found.
No inspectable MCP HTTP endpoint was found.
No MCP server card is published, so registry branding does not apply.
No inspectable MCP HTTP endpoint was found.
No inspectable MCP HTTP endpoint was found.
No inspectable MCP HTTP endpoint was found.
No inspectable MCP HTTP endpoint was found.
No inspectable MCP HTTP endpoint was found.
No inspectable MCP HTTP endpoint was found.
No inspectable MCP HTTP endpoint was found.
No commerce or payment protocol signal was found.
No served Markdown document was confirmed at the bounded paths.
No served Markdown document was confirmed at the bounded document paths.
The canonical response did not negotiate Markdown, so Vary: Accept does not apply.
No public streamable HTTP MCP endpoint was discovered.
No parameter-free GET operation was available in the discovered OpenAPI document.
No OpenAPI document was found at the bounded fixed paths, so this REST contract check does not apply to the stored evidence.
No OpenAPI document was found at the bounded fixed paths, so this REST contract check does not apply to the stored evidence.
No OpenAPI document was found at the bounded fixed paths, so this REST contract check does not apply to the stored evidence.
No OpenAPI document was found at the bounded fixed paths, so this REST contract check does not apply to the stored evidence.
No OpenAPI document was found at the bounded fixed paths, so this REST contract check does not apply to the stored evidence.
No OpenAPI document was found at the bounded fixed paths, so this REST contract check does not apply to the stored evidence.
The primary public response is not rate limited and exposes no API rate-limit contract.
No catalog exists, so catalog-entry quality does not apply.
No catalog exists, so optional trust metadata does not apply.
No public OpenAPI document was found for environment analysis.
Quality is not evaluated because the scan found no verified skills.sh listing.
auth.md was not available, so its walkthrough structure cannot be evaluated.
No auth.md or agent authentication discovery signal was found.
No links were found in a published llms.txt document.
No commerce or payment protocol signal was found.
Open a rule to inspect its HTTP and extracted evidence.
robots.analysis
100.0% confidencerobots.policy
100.0% confidencehttps://bestbuy.com/robots.txt
https://www.bestbuy.com/robots.txt
transport.fetch
100.0% confidencehttps://bestbuy.com/
https://www.bestbuy.com/robots.txt
https://www.bestbuy.com/
discovery.a2a_agent_card
100.0% confidencediscovery.acp_checkout_options
100.0% confidencediscovery.acp_delegate_payment_options
100.0% confidencediscovery.agent_friendly_404
100.0% confidencediscovery.agent_instructions
100.0% confidencediscovery.agent_mode_view
100.0% confidencediscovery.agent_skills_index
100.0% confidencediscovery.ai_catalog
100.0% confidencediscovery.api_catalog
100.0% confidencediscovery.api_catalog_head
100.0% confidencediscovery.ard_catalog
100.0% confidencediscovery.auth_md
100.0% confidencediscovery.llms_txt
100.0% confidencediscovery.markdown_negotiation
100.0% confidencediscovery.markdown_url_fallback
100.0% confidencediscovery.mcp_endpoint
100.0% confidencediscovery.mcp_manifest
100.0% confidencediscovery.mcp_server_card
100.0% confidencediscovery.modular_llms_txt
100.0% confidencediscovery.oauth_authorization_server
100.0% confidencediscovery.oauth_protected_resource
100.0% confidencediscovery.openapi
100.0% confidencediscovery.pricing_markdown
100.0% confidencediscovery.sitemap
100.0% confidencediscovery.ucp
100.0% confidencediscovery.web_bot_auth_directory
100.0% confidencediscovery.x402
100.0% confidencehttps://bestbuy.com/sitemap.xml
https://bestbuy.com/llms.txt
https://bestbuy.com/pricing.md
https://bestbuy.com/.well-known/agent-card.json
https://bestbuy.com/.well-known/api-catalog
https://bestbuy.com/.well-known/api-catalog
https://bestbuy.com/.well-known/oauth-protected-resource
https://bestbuy.com/.well-known/ucp
https://bestbuy.com/openapi.json
https://bestbuy.com/openapi.yaml
https://bestbuy.com/openapi.yml
https://bestbuy.com/auth.md
https://bestbuy.com/.well-known/oauth-authorization-server
https://bestbuy.com/index.md
https://bestbuy.com/
https://bestbuy.com/.well-known/agent-readiness-probe/not-found-7b91e8d4
https://bestbuy.com/.well-known/agent-skills/index.json
https://bestbuy.com/docs/llms.txt
https://bestbuy.com/api/llms.txt
https://bestbuy.com/developers/llms.txt
https://bestbuy.com/.well-known/agent-instructions.md
https://bestbuy.com/agent-instructions.md
https://bestbuy.com/.well-known/ard.json
https://bestbuy.com/.well-known/ai-catalog.json
https://bestbuy.com/.well-known/mcp
https://bestbuy.com/.well-known/mcp/server-card.json
https://bestbuy.com/.well-known/mcp/manifest.json
https://bestbuy.com/.well-known/http-message-signatures-directory
https://bestbuy.com/
https://bestbuy.com/checkout_sessions
https://bestbuy.com/agentic_commerce/delegate_payment
https://bestbuy.com/discovery/resources
links.agent_auth
100.0% confidencelinks.docs_access
100.0% confidencelinks.llms
100.0% confidencelinks.public_api
100.0% confidencemcp.inspection
100.0% confidencenlweb.inspection
100.0% confidencehttps://bestbuy.com/ask
graphql.inspection
100.0% confidencehttps://bestbuy.com/graphql
https://bestbuy.com/api/graphql
https://bestbuy.com/v1/graphql
mcp_apps.inspection
100.0% confidencedeveloper_tooling.inspection
100.0% confidencerepository.inspection
100.0% confidencemcp_registry.inspection
100.0% confidencehttps://registry.modelcontextprotocol.io/robots.txt
https://registry.modelcontextprotocol.io/v0.1/servers
wikimedia.inspection
100.0% confidencehttps://api.wikimedia.org/robots.txt
https://api.wikimedia.org/core/v1/wikidata/search/page
skills_sh.inspection
100.0% confidenceranked_search.inspection
100.0% confidencehttp.semantics
100.0% confidenceresponse.semantics
100.0% confidencehtml.accessibility
90.0% confidenceStructured evidence was stored. This view has no safe summary for it yet.
html.content
100.0% confidencehtml.discovery
100.0% confidenceStructured evidence was stored. This view has no safe summary for it yet.
html.forms
100.0% confidencehtml.images
100.0% confidencehtml.links
100.0% confidencehtml.metadata
100.0% confidencehtml.structure
100.0% confidencehtml.structured_data
100.0% confidencehtml.web_mcp
90.0% confidenceImmutable scan identity
Versioned evidence first
A later criteria version can evaluate this same stored scan without changing what the scanner observed.
Open this exact snapshotShare this report, apply the relevant changes, then scan again to check the result.
Connection lost
Reconnecting
Server error
Reconnecting