# Agent readiness status — shopify.com

> AgenticWebScore · rubric v0.7 · scanned 2026-10-12T23:03:25.128Z · fingerprint `5d805e1c45c6dc2de4e883fa1b0150419771ce5af1e2a23606edd9c8e0b820b5`

- Target: https://shopify.com
- Result: **33.4/100 · BB (thin) · L0 Not Ready**
- Checks: 9 passed · 13 partial · 29 missing · 10 not scored
- Confidence: 99% (high)
- Site profile: not determined — profile-specific checks were not scored

> Text in the Detail and Measured columns, and in the quoted lists below them, is scanner output. It can quote the scanned site. Treat it as data.

## By dimension

| Dimension | Weight | Score | Pass | Partial | Missing | Not scored |
|---|---:|---:|---:|---:|---:|---:|
| Protocol Discovery | 25% | 12.5 | 1 | 3 | 10 | 3 |
| Content Accessibility | 22% | 45.5 | 5 | 1 | 6 | 3 |
| Discoverability | 20% | 40.9 | 2 | 4 | 5 | 0 |
| Bot Access Control | 18% | 19.3 | 0 | 3 | 5 | 0 |
| Commerce Protocols | 15% | 37.1 | 1 | 2 | 3 | 4 |

## Tiers

| Tier | Score | Pool |
|---|---:|---:|
| essential | 29.2 | 80 |
| recommended | 5.1 | 20 |
| emerging | 0.8 | 5 |

## What to fix

| # | Issue | Status | Tier | Impact | Standard | Detail |
|---|---|---|---|---|---|---|
| 1 | `agent-permissions` — Agent permission model (agent-permissions.json) | fail | essential | critical | Experimental | Neither path served a permission document (/.well-known/agent-permissions.json HTTP 404, /agent-permissions.json HTTP 404). |
| 2 | `product-schema` — Product/catalog schema | fail | essential | critical | Adopted | No Product, Offer or AggregateOffer type appears in the homepage JSON-LD (2 types) or in the JSON-LD of the 2 readable product or collection pages. |
| 3 | `reachable` — Homepage open to agent access | warn | essential | critical | Adopted | Homepage redirected off shopify.com to www.shopify.com (HTTP 200, 668424 bytes). |
| 4 | `webbotauth` — Web Bot Auth key directory | warn | essential | critical | Draft | The document parsed as JSON but holds 0 keys and 0 usable Ed25519 verification keys (no top-level keys array). |
| 5 | `markdown-negotiation` — Markdown content negotiation | fail | recommended | critical | Adopted | The homepage answered Accept: text/markdown with Content-Type text/html; charset=utf-8 (HTTP 200), so the HTML document is served to every client. |
| 6 | `ai-policy` — AI usage policy page | warn | essential | high | Adopted | AI policy at /ai covers 1 of 3 expected topics (permitted uses stated; prohibited uses and a contact route missing) and is not linked from the home page. |
| 7 | `ai-rules` — Named AI bot rules in robots.txt | fail | essential | high | Draft | /robots.txt answered HTTP 429, so 0 of 18 named AI bots are addressed. |
| 8 | `mcp-card` — MCP server card | fail | essential | high | Draft | No MCP server card was served as JSON at the 3 declared paths (/.well-known/mcp/server-card.json 404 text/plain; /.well-known/mcp.json 404 text/plain; /mcp.json 404 text/html). |
| 9 | `meta` — Title and summary metadata | warn | essential | high | Adopted | Both carriers are present but outside the band: title 66 characters (band 50-60). |
| 10 | `oauth-discovery` — OAuth discovery documents | fail | essential | high | Adopted | None of the 3 OAuth discovery paths returned a JSON document (/.well-known/oauth-authorization-server 404 text/plain; /.well-known/openid-configuration 404 text/plain; /.well-known/oauth-protected-resource 404 text/plain). |
| 11 | `openapi` — OpenAPI definition | fail | essential | high | Adopted | No OpenAPI document was found: 5 candidate paths (0 advertised, 5 standard) returned no JSON OpenAPI 3.x document. |
| 12 | `robots-txt` — robots.txt with agent directives | fail | essential | high | Adopted | robots.txt answered HTTP 429 with 9358 bytes. |
| 13 | `agent-purchase` — Agent purchase policy | fail | recommended | high | Draft | No page among the 5 agent policy paths carries both an agent word and a purchase word (/ai-policy HTTP 404, /agent-policy HTTP 404, /terms HTTP 200, /agentic-commerce HTTP 404, /ai HTTP 200). |
| 14 | `agents-md` — AGENTS.md with the required sections | fail | recommended | high | Draft | Not found (HTTP 404, 11026 bytes). |
| 15 | `content-signal` — Content-Signal usage signals | fail | recommended | high | Draft | robots.txt answered HTTP 429 and the homepage response carries no Content-Signal header. |
| 16 | `faq-schema` — FAQ / question-answer schema | fail | recommended | high | Draft | No FAQPage entity among 1 parsed JSON-LD block on the homepage. |
| 17 | `pricing-structured` — Structured pricing information | warn | recommended | high | Adopted | No structured offer is present in the homepage JSON-LD and the only price signal is prose copy reading "$125.00". |
| 18 | `service-schema` — Service/product scope machine-readable | fail | recommended | high | Draft | The homepage JSON-LD carries 1 model types with 0 Service or Product nodes, so the offer scope cannot be read. |
| 19 | `a2a-card` — A2A agent card | fail | recommended | medium | Draft | No A2A agent card was served as JSON at the 2 declared paths (/.well-known/agent-card.json 404 text/plain; /.well-known/agent.json 404 text/plain). |
| 20 | `api-catalog` — API catalog | fail | recommended | medium | Experimental | No API catalog linkset was served at the 3 declared paths (/.well-known/api-catalog 404 text/plain; /api-catalog.json 404 text/html; /.well-known/ai-plugin.json 404 text/plain). |
| 21 | `canonical` — Canonical and hreflang discipline | warn | recommended | medium | Adopted | Canonical points at www.shopify.com, not the scanned host shopify.com. |
| 22 | `token-efficiency` — Token efficiency (content-to-markup ratio) | fail | recommended | medium | Draft | Content-to-markup ratio 1.0% (7103 visible of 667899 markup characters, ~1382 tokens), below the 8% floor where markup outweighs the content. |
| 23 | `agent-skills` — Agent Skills declaration | fail | recommended | medium | Draft | No agent skills index with a non-empty skills array was served as JSON at the 3 declared paths (/.well-known/agent-skills/index.json 404 text/plain; /.well-known/agent-skills.json 404 text/plain; /.well-known/skills.json 404 text/plain). |
| 24 | `bot-page` — Crawler and agent policy page | fail | recommended | medium | Adopted | No bot or agent policy page found: 0 of 8 candidate paths served one and the home page links to none. |
| 25 | `returns` — Return and shipping terms machine-readable | warn | recommended | medium | Adopted | /shipping responded but none of the 4 documents read declares MerchantReturnPolicy or OfferShippingDetails. |
| 26 | `summary` — Prominent summary block | fail | recommended | medium | Draft | The first 1000 characters of main content hold no paragraph or summary block (3408 characters of main text). |
| 27 | `auth-md` — /auth.md agent authentication guide | fail | emerging | medium | Draft | No markdown authentication guide was served at the 2 declared paths (/auth.md 404 text/html; /.well-known/auth.md 404 text/plain). |
| 28 | `dns-aid` — DNS-AID discovery record | warn | emerging | medium | Experimental | Only the TXT fallback form is published (3 records, 4 key=value pairs). |
| 29 | `link-headers` — Discovery via Link response headers | fail | emerging | medium | Adopted | No Link header on the homepage response (HTTP 200, 668424 bytes). |
| 30 | `spa-fallback` — Per-page content separation (no SPA fallback) | fail | emerging | medium | Experimental | Shell duplicate: /book, /reports match the homepage title "Shopify: The All-in-One Commerce Platform for Businesses - …" with 100% identical markup (2 of 15 probed pages). |
| 31 | `ucp-manifest` — UCP manifest (/.well-known/ucp) | fail | emerging | medium | Draft | Neither /.well-known/ucp nor /.well-known/ucp.json returned HTTP 200 (/.well-known/ucp HTTP 404, /.well-known/ucp.json HTTP 404), so no manifest was served. |
| 32 | `webmcp` — WebMCP browser tool declaration | fail | emerging | medium | Experimental | No WebMCP declaration was found: the 3 manifest paths served no tools array and the homepage contains 0 registerTool calls. |
| 33 | `contact` — Structured contact information | warn | emerging | medium | Adopted | Homepage JSON-LD declares 1 organization node with 0 contact details while the page itself carries 0 plain-text contact signals. |
| 34 | `llms-full` — /llms-full.txt expanded context | warn | recommended | low | Draft | 2089 words of text and 107 link lines in 18863 bytes, which is a list of links rather than expanded page content. |
| 35 | `security-txt` — security.txt (RFC 9116) | warn | recommended | low | Adopted | security.txt at /.well-known/security.txt holds 1 of 2 required fields (Expires is missing). Not scored: its Policy URL is on hackerone.com, which this scan does not request. |
| 36 | `agent-analytics` — Agent traffic measurement | warn | emerging | low | Draft | The homepage names 1 analytics vendor (googletagmanager) but none of the 5 agent segmentation markers appears, so agent traffic is not separated. |
| 37 | `ai-txt` — /ai.txt access declaration | fail | emerging | low | Draft | /ai.txt answered HTTP 404, not an access declaration. |
| 38 | `ard-manifest` — ARD resource discovery manifest | fail | emerging | low | Experimental | No ARD manifest with an entries array was served at the 4 declared paths (/.well-known/ard.json 404 text/plain; /.well-known/agent-resources.json 404 text/plain; /.well-known/ai-catalog.json 404 text/plain; /ard.json 404 text/html; first JSON document: none). |
| 39 | `breadcrumb` — Breadcrumb / navigation schema | fail | emerging | low | Draft | No BreadcrumbList entity among 1 parsed JSON-LD block on the homepage. |
| 40 | `crawl-delay` — Crawl rate declaration | fail | emerging | low | Adopted | /robots.txt answered HTTP 429, so no crawl rate is declared. |
| 41 | `sitemap-md` — /sitemap.md markdown site map | fail | emerging | low | Draft | Not found (HTTP 404, 11029 bytes). |
| 42 | `status-page` — Service status and changelog feed | warn | emerging | low | Adopted | The homepage advertises 1 status or feed reference, but the status document at https://shopifystatus.com was not fetched by this scan, so its response was not observed. |

## All checks

### Protocol Discovery

| Status | Check | Tier | Standard | Measured |
|---|---|---|---|---|
| fail | `mcp-card` — MCP server card | essential | Draft | No MCP server card was served as JSON at the 3 declared paths (/.well-known/mcp/server-card.json 404 text/plain; /.well-known/mcp.json 404 text/plain; /mcp.json 404 text/html). |
| fail | `openapi` — OpenAPI definition | essential | Adopted | No OpenAPI document was found: 5 candidate paths (0 advertised, 5 standard) returned no JSON OpenAPI 3.x document. |
| fail | `oauth-discovery` — OAuth discovery documents | essential | Adopted | None of the 3 OAuth discovery paths returned a JSON document (/.well-known/oauth-authorization-server 404 text/plain; /.well-known/openid-configuration 404 text/plain; /.well-known/oauth-protected-resource 404 text/plain). |
| fail | `api-catalog` — API catalog | recommended | Experimental | No API catalog linkset was served at the 3 declared paths (/.well-known/api-catalog 404 text/plain; /api-catalog.json 404 text/html; /.well-known/ai-plugin.json 404 text/plain). |
| fail | `agent-skills` — Agent Skills declaration | recommended | Draft | No agent skills index with a non-empty skills array was served as JSON at the 3 declared paths (/.well-known/agent-skills/index.json 404 text/plain; /.well-known/agent-skills.json 404 text/plain; /.well-known/skills.json 404 text/plain). |
| fail | `a2a-card` — A2A agent card | recommended | Draft | No A2A agent card was served as JSON at the 2 declared paths (/.well-known/agent-card.json 404 text/plain; /.well-known/agent.json 404 text/plain). |
| na | `a2a-signed` — Cryptographically signed agent card | emerging | Draft | No A2A agent card is published, so there are no signatures to inspect and the check is not scored. |
| fail | `auth-md` — /auth.md agent authentication guide | emerging | Draft | No markdown authentication guide was served at the 2 declared paths (/auth.md 404 text/html; /.well-known/auth.md 404 text/plain). |
| fail | `webmcp` — WebMCP browser tool declaration | emerging | Experimental | No WebMCP declaration was found: the 3 manifest paths served no tools array and the homepage contains 0 registerTool calls. |
| fail | `ard-manifest` — ARD resource discovery manifest | emerging | Experimental | No ARD manifest with an entries array was served at the 4 declared paths (/.well-known/ard.json 404 text/plain; /.well-known/agent-resources.json 404 text/plain; /.well-known/ai-catalog.json 404 text/plain; /ard.json 404 text/html; first JSON document: none). |
| pass | `docs` — Documentation reachable | recommended | Adopted | Documentation is reachable at /blog/topics/guides (homepage anchor) and returns HTTP 200 text/html with 1060 readable words. |
| warn | `pricing-structured` — Structured pricing information | recommended | Adopted | No structured offer is present in the homepage JSON-LD and the only price signal is prose copy reading "$125.00". |
| fail | `service-schema` — Service/product scope machine-readable | recommended | Draft | The homepage JSON-LD carries 1 model types with 0 Service or Product nodes, so the offer scope cannot be read. |
| warn | `contact` — Structured contact information | emerging | Adopted | Homepage JSON-LD declares 1 organization node with 0 contact details while the page itself carries 0 plain-text contact signals. |
| warn | `status-page` — Service status and changelog feed | emerging | Adopted | The homepage advertises 1 status or feed reference, but the status document at https://shopifystatus.com was not fetched by this scan, so its response was not observed. |
| na | `sandbox-environment` — Sandbox or test environment documented | recommended | Experimental | Not scored: this check applies to saas or api sites, and the site type could not be confirmed (best candidates: marketplace, api). Declare the type to have it measured. |
| na | `rate-limits-declared` — Rate limits and quotas documented | recommended | Experimental | Not scored: this check applies to api sites, and the site type could not be confirmed (best candidates: marketplace, api). Declare the type to have it measured. |

### Content Accessibility

| Status | Check | Tier | Standard | Measured |
|---|---|---|---|---|
| fail | `markdown-negotiation` — Markdown content negotiation | recommended | Adopted | The homepage answered Accept: text/markdown with Content-Type text/html; charset=utf-8 (HTTP 200), so the HTML document is served to every client. |
| pass | `headings` — Semantic heading structure | essential | Adopted | 1 H1 with 6 H2s and 14 H3s, and no level in the outline is skipped. |
| warn | `meta` — Title and summary metadata | essential | Adopted | Both carriers are present but outside the band: title 66 characters (band 50-60). |
| pass | `jsonld` — JSON-LD structured data | essential | Adopted | 1 JSON-LD block parsed with a schema.org @context declaring Corporation (2 @types in total). |
| fail | `faq-schema` — FAQ / question-answer schema | recommended | Draft | No FAQPage entity among 1 parsed JSON-LD block on the homepage. |
| fail | `breadcrumb` — Breadcrumb / navigation schema | emerging | Draft | No BreadcrumbList entity among 1 parsed JSON-LD block on the homepage. |
| fail | `summary` — Prominent summary block | recommended | Draft | The first 1000 characters of main content hold no paragraph or summary block (3408 characters of main text). |
| pass | `lang` — Language declaration and multilingual access | recommended | Adopted | html lang="en" with 85 hreflang alternates, all with absolute hrefs plus a self-reference and x-default. |
| pass | `no-js-fallback` — Content that needs no JavaScript | essential | Adopted | 7103 characters of static text and 1 H1 is in the HTML before any JavaScript runs. |
| fail | `spa-fallback` — Per-page content separation (no SPA fallback) | emerging | Experimental | Shell duplicate: /book, /reports match the homepage title "Shopify: The All-in-One Commerce Platform for Businesses - …" with 100% identical markup (2 of 15 probed pages). |
| fail | `token-efficiency` — Token efficiency (content-to-markup ratio) | recommended | Draft | Content-to-markup ratio 1.0% (7103 visible of 667899 markup characters, ~1382 tokens), below the 8% floor where markup outweighs the content. |
| pass | `viewport` — Responsive markup | emerging | Adopted | viewport content "width=device-width,initial-scale=1" sets width=device-width and leaves zoom unrestricted. |
| na | `licensing-terms` — Reuse and licensing terms declared | recommended | Draft | Not scored: this check applies to publisher or institution sites, and the site type could not be confirmed (best candidates: marketplace, api). Declare the type to have it measured. |
| na | `provenance-declared` — Content provenance declared | emerging | Draft | Not scored: this check applies to publisher or institution sites, and the site type could not be confirmed (best candidates: marketplace, api). Declare the type to have it measured. |
| na | `document-formats` — Documents in machine-readable formats | recommended | Draft | Not scored: this check applies to institution sites, and the site type could not be confirmed (best candidates: marketplace, api). Declare the type to have it measured. |

### Discoverability

| Status | Check | Tier | Standard | Measured |
|---|---|---|---|---|
| warn | `reachable` — Homepage open to agent access | essential | Adopted | Homepage redirected off shopify.com to www.shopify.com (HTTP 200, 668424 bytes). |
| fail | `robots-txt` — robots.txt with agent directives | essential | Adopted | robots.txt answered HTTP 429 with 9358 bytes. |
| pass | `sitemap-xml` — sitemap.xml valid and current | essential | Adopted | 555 absolute URLs, 555 with <lastmod>. |
| pass | `llms-txt` — /llms.txt published and well-structured | essential | Draft | H1 "Shopify", blockquote summary, 12 H2 sections with 74 markdown links, 12520 bytes. The scan requested none of its links. Not requested: 74 links on another origin. |
| fail | `link-headers` — Discovery via Link response headers | emerging | Adopted | No Link header on the homepage response (HTTP 200, 668424 bytes). |
| warn | `dns-aid` — DNS-AID discovery record | emerging | Experimental | Only the TXT fallback form is published (3 records, 4 key=value pairs). |
| warn | `canonical` — Canonical and hreflang discipline | recommended | Adopted | Canonical points at www.shopify.com, not the scanned host shopify.com. |
| warn | `llms-full` — /llms-full.txt expanded context | recommended | Draft | 2089 words of text and 107 link lines in 18863 bytes, which is a list of links rather than expanded page content. |
| fail | `agents-md` — AGENTS.md with the required sections | recommended | Draft | Not found (HTTP 404, 11026 bytes). |
| fail | `sitemap-md` — /sitemap.md markdown site map | emerging | Draft | Not found (HTTP 404, 11029 bytes). |
| fail | `content-signal` — Content-Signal usage signals | recommended | Draft | robots.txt answered HTTP 429 and the homepage response carries no Content-Signal header. |

### Bot Access Control

| Status | Check | Tier | Standard | Measured |
|---|---|---|---|---|
| warn | `webbotauth` — Web Bot Auth key directory | essential | Draft | The document parsed as JSON but holds 0 keys and 0 usable Ed25519 verification keys (no top-level keys array). |
| fail | `agent-permissions` — Agent permission model (agent-permissions.json) | essential | Experimental | Neither path served a permission document (/.well-known/agent-permissions.json HTTP 404, /agent-permissions.json HTTP 404). |
| fail | `ai-rules` — Named AI bot rules in robots.txt | essential | Draft | /robots.txt answered HTTP 429, so 0 of 18 named AI bots are addressed. |
| warn | `ai-policy` — AI usage policy page | essential | Adopted | AI policy at /ai covers 1 of 3 expected topics (permitted uses stated; prohibited uses and a contact route missing) and is not linked from the home page. |
| fail | `bot-page` — Crawler and agent policy page | recommended | Adopted | No bot or agent policy page found: 0 of 8 candidate paths served one and the home page links to none. |
| warn | `security-txt` — security.txt (RFC 9116) | recommended | Adopted | security.txt at /.well-known/security.txt holds 1 of 2 required fields (Expires is missing). Not scored: its Policy URL is on hackerone.com, which this scan does not request. |
| fail | `crawl-delay` — Crawl rate declaration | emerging | Adopted | /robots.txt answered HTTP 429, so no crawl rate is declared. |
| fail | `ai-txt` — /ai.txt access declaration | emerging | Draft | /ai.txt answered HTTP 404, not an access declaration. |

### Commerce Protocols

| Status | Check | Tier | Standard | Measured |
|---|---|---|---|---|
| fail | `product-schema` — Product/catalog schema | essential | Adopted | No Product, Offer or AggregateOffer type appears in the homepage JSON-LD (2 types) or in the JSON-LD of the 2 readable product or collection pages. |
| pass | `payment-protocols` — Agent payment standard support (AP2/ACP/x402/UCP) | recommended | Draft | 2 distinct agent-payment signals: UCP named on /developers; agent-purchase grant stated on /developers. |
| fail | `agent-purchase` — Agent purchase policy | recommended | Draft | No page among the 5 agent policy paths carries both an agent word and a purchase word (/ai-policy HTTP 404, /agent-policy HTTP 404, /terms HTTP 200, /agentic-commerce HTTP 404, /ai HTTP 200). |
| fail | `ucp-manifest` — UCP manifest (/.well-known/ucp) | emerging | Draft | Neither /.well-known/ucp nor /.well-known/ucp.json returned HTTP 200 (/.well-known/ucp HTTP 404, /.well-known/ucp.json HTTP 404), so no manifest was served. |
| warn | `returns` — Return and shipping terms machine-readable | recommended | Adopted | /shipping responded but none of the 4 documents read declares MerchantReturnPolicy or OfferShippingDetails. |
| warn | `agent-analytics` — Agent traffic measurement | emerging | Draft | The homepage names 1 analytics vendor (googletagmanager) but none of the 5 agent segmentation markers appears, so agent traffic is not separated. |
| na | `inventory-freshness` — Inventory and price freshness | recommended | Adopted | Not scored: this check applies to ecommerce or marketplace sites, and the site type could not be confirmed (best candidates: marketplace, api). Declare the type to have it measured. |
| na | `seller-identity` — Seller identity declared | recommended | Adopted | Not scored: this check applies to ecommerce or marketplace sites, and the site type could not be confirmed (best candidates: marketplace, api). Declare the type to have it measured. |
| na | `shipping-costs` — Shipping cost and delivery declared | recommended | Adopted | Not scored: this check applies to ecommerce or marketplace sites, and the site type could not be confirmed (best candidates: marketplace, api). Declare the type to have it measured. |
| na | `booking-action` — Machine-readable booking action | recommended | Draft | Not scored: this check applies to services sites, and the site type could not be confirmed (best candidates: marketplace, api). Declare the type to have it measured. |

## Not measured

The scanner could not observe these checks. Under rubric v0.7, each one stays in the denominator at 0 points, the same as a missing check.

- `a2a-signed` — "No A2A agent card is published, so there are no signatures to inspect and the check is not scored."

## Out of scope

The scan did not ask this site for these checks. Each applies to a site profile the scan did not confirm here, or needs a commercial signal it did not detect. They left the denominator. They are not failures, and they are not requests.

- `inventory-freshness` — "Not scored: this check applies to ecommerce or marketplace sites, and the site type could not be confirmed (best candidates: marketplace, api). Declare the type to have it measured."
- `seller-identity` — "Not scored: this check applies to ecommerce or marketplace sites, and the site type could not be confirmed (best candidates: marketplace, api). Declare the type to have it measured."
- `shipping-costs` — "Not scored: this check applies to ecommerce or marketplace sites, and the site type could not be confirmed (best candidates: marketplace, api). Declare the type to have it measured."
- `sandbox-environment` — "Not scored: this check applies to saas or api sites, and the site type could not be confirmed (best candidates: marketplace, api). Declare the type to have it measured."
- `rate-limits-declared` — "Not scored: this check applies to api sites, and the site type could not be confirmed (best candidates: marketplace, api). Declare the type to have it measured."
- `licensing-terms` — "Not scored: this check applies to publisher or institution sites, and the site type could not be confirmed (best candidates: marketplace, api). Declare the type to have it measured."
- `provenance-declared` — "Not scored: this check applies to publisher or institution sites, and the site type could not be confirmed (best candidates: marketplace, api). Declare the type to have it measured."
- `booking-action` — "Not scored: this check applies to services sites, and the site type could not be confirmed (best candidates: marketplace, api). Declare the type to have it measured."
- `document-formats` — "Not scored: this check applies to institution sites, and the site type could not be confirmed (best candidates: marketplace, api). Declare the type to have it measured."

---

Verify this record: https://agenticwebscore.com/verify/5d805e1c45c6dc2de4e883fa1b0150419771ce5af1e2a23606edd9c8e0b820b5