How we check your store.

Each scan reads up to 5 product pages, makes up to 64 HTTP requests and runs for up to 60 seconds. We read HTML and JSON-LD without running JavaScript. Product data added only by JavaScript, microdata or unsupported formats may go unverified.

We also look for public agent integration details in discovery files, response headers and DNS records. These are declarations from your store; finding them does not confirm that the integration works.

We group the checks into four areas worth 100 points in total. They cover how an agent might find your store, read a page, understand an offer and take action. Your level also caps your score; the levels are explained below.

If we read several pages of a site and find no sign of a shop, such as products, product markup, a cart, checkout or a shop platform, we report it as not a webshop, give no score and show only the checks that apply to any site.

You don’t need every protocol

We group protocols that serve a similar purpose. Passing any one check in a group earns all of that group’s points. Adding more protocols in the same group won’t increase your score.

• Agent endpointMCP, A2A, Agent Skills
  10 pts
• API discoveryAPI catalog, AI catalog, Link headers
  7 pts
• Agent authenticationOAuth, protected resource, auth.md
  5 pts
• Commerce protocolUCP, ACP, MPP, x402
  10 pts

How a check earns points

• A passing check earns full points. For checks across several products, the share that passes determines the points earned.
• Checks we cannot verify earn no points. Coverage shows the share of available points we were able to assess.
• Checks that do not apply are left out of the available points.
• Your score is the percentage of available points earned, up to the cap for your level.

Checks that don’t affect your score

These findings are useful context. They carry no points and are not required for any level.

• Product identifiers
• AI crawler rules
• DNS-AID agent records
• AI content usage signals
• WebMCP tools
• Web Bot Auth public keys

Each level has a set of requirements and a score cap. You reach it when you meet its requirements and those of every level below it. An unverified requirement holds the level back. Proposal-stage protocols are never required.

1. 5

   Level 5 of 5

   Commerce protocol found

   Score cap100/100

   Your store passes all five levels, including a public commerce protocol check.

   Requires

   • Commerce protocolUCP, ACP, MPP, x402
2. 4

   Level 4 of 5

   Agent integrations found

   Score cap90/100

   Your store passes the discovery checks. We couldn't verify a commerce protocol.

   Requires

   • Agent endpointMCP, A2A, Agent Skills
   • API discoveryAPI catalog, AI catalog, Link headers
3. 3

   Level 3 of 5

   Readable content

   Score cap70/100

   Your core product data and Markdown checks pass. Agent discovery still needs attention.

   Requires

   • Markdown version
4. 2

   Level 2 of 5

   Product data found

   Score cap45/100

   Your product data passes the core checks. We couldn't verify a Markdown version of your page.

   Requires

   • Structured product data
   • Product names and images
   • Store contact details
   • Prices and currencies ≥ 50%
   • Stock availability ≥ 50%
5. 1

   Level 1 of 5

   Reachable

   Score cap30/100

   Your store passes the access checks. Some product data checks still need attention.

   Requires

   • Public page access
   • Secure public address
   • Search crawler policy
   • Indexing directives
6. 0

   Level 0 of 5

   Access checks incomplete

   Score cap15/100

   The starting level, before all access checks pass.

• Log in, create carts, pay or place orders.
• Call MCP tools, run agent skills or execute JavaScript.
• Pretend to be a verified search or AI crawler.
• Get around access challenges, logins or paywalls.

What the score doesn’t tell you

• Search rankings, or whether an AI platform will recommend you.
• That a declared protocol integration actually works.
• Eligibility for AI shopping programs or for feeds that need authentication.

• We keep a report for up to 15 minutes after the scan finishes, then delete it. It may be deleted sooner.
• Your browser saves the current scan ID for reconnection while the tab is open. An essential session cookie expires after an hour.
• We count page visits with analytics and only store anything with your consent. We never send your scan to an AI model.
• Hosting logs may include request details. Only submit public URLs without private tokens or signatures.
• Download your report if you want to keep a copy.

Our scanner identifies itself as CanAIBuyBot. It respects applicable robots rules, limits request counts and response sizes, and stops at access challenges. To exclude it, add this to robots.txt:

User-agent: CanAIBuyBot
Disallow: /

These are the references behind our checks, grouped by their status. Some describe established standards; others are still proposals or experiments.