Site audit
Agent readiness report
stripe.com
77out of 100
Grade B
Stripe offers comprehensive payment APIs with excellent developer discoverability, but lacks published OpenAPI specification.
DiscoveryCan agents discover and fetch your site?
19/20points
AccessCan agents get the answer from what they fetch?
22/30points
UsabilityCan agents complete a task through an interface?
28/40points
PaymentsCan agents complete a payment?
—not scored
01Can an agent discover and trust you?Can agents reach your pages, find them, and confirm they belong to you?ROBOTSSITEMAPSKILLSDISCOVERY95/1003 shown · 2 in the fix kit
ARD discoveryFailedard-catalogRequiredVerifiedNo /.well-known/ard.json, no same-site rel="ard" link, and no legacy /.well-known/ai-catalog.json+1.2est. points
Scan result
No /.well-known/ard.json, no same-site rel="ard" link, and no legacy /.well-known/ai-catalog.json
What this checks
One catalog that tells agents everything you offer them: MCP servers, APIs, agents, and skills. Without it, every agent has to hunt for your capabilities page by page. We look where ARD v0.91 tells agents to look: an Agentic Resource Discov
Sitemap freshness (lastmod)Failedsitemap-lastmodRecommendedVerifiedBonusNone of the 500 sampled sitemap entries carries a lastmod date. Add <lastmod> (W3C datetime) so agents can prioritize fresh content.+0.1est. points
Scan result
None of the 500 sampled sitemap entries carries a lastmod date. Add <lastmod> (W3C datetime) so agents can prioritize fresh content.
What this checks
Dates in your sitemap tell agents what changed and when, so they reread fresh pages instead of guessing. We check lastmod dates parse and the newest is recent.
Registry brandingFailedregistry-brandingEmergingEmergingNo registry branding (name, icon, description) found
Scan result
No registry branding (name, icon, description) found
What this checks
Your MCP registry entry has a display name, icon, and description. Agents choosing between servers see this first; a bare entry looks abandoned.
2 more issues in this goal, each with a fix promptGet the fix kit
02Do you welcome agents?Do your crawler rules and security checks let legitimate agents through?ROBOTSCRAWLBOT AUTH100/1001 issue
Web Bot Auth directoryFailedweb-bot-auth-directoryEmergingEmergingBonusNo /.well-known/http-message-signatures-directory found
Scan result
No /.well-known/http-message-signatures-directory found
What this checks
A public key directory (RFC 9421) that lets agents cryptographically sign their requests, so you know exactly who is calling and can let the good ones through.
03Does an agent understand who you are and what you do?Can an agent explain your business using the content and facts on your site?HTMLJSON-LDNLWEBLLMS.TXTSKILLSDOCS72/1003 shown · 5 in the fix kit
Content without JavaScriptWarningcontent-no-jsRequiredVerified10698 chars with H1, but 2.8% content ratio is below the 5% target+0.6est. points
Scan result
10698 chars with H1, but 2.8% content ratio is below the 5% target
What this checks
Most AI crawlers never run JavaScript. If your pages need it to show content, agents see a blank site. We fetch your pages with JavaScript off and check the content is still there.
How to fix this
Agent discovery fileFailedagent-discovery-fileRequiredVerifiedNo agent discovery file found+1.1est. points
Scan result
No agent discovery file found
What this checks
A dedicated endpoint that tells arriving agents what you are and where to start, like a front desk for automated visitors.
Schema type breadthFailedschema-type-breadthRecommendedVerifiedNo extended schema types found - AI can only answer basic questions about this entity+1.1est. points
Scan result
No extended schema types found - AI can only answer basic questions about this entity
What this checks
The more kinds of content you mark up with schema.org (FAQs, reviews, services, events, videos), the more kinds of questions an AI can answer about you with confidence.
5 more issues in this goal, each with a fix promptGet the fix kit
04Can an agent integrate with you?Can an agent connect through a documented API, tool server, or software kit?LINKSSKILLSDOCSAPIOPSSDKMCP70/1002 shown · 4 in the fix kit
OpenAPI spec publishedFailedopenapi-specRequiredVerifiedNo OpenAPI/Swagger specification found+4est. points
Scan result
No OpenAPI/Swagger specification found
What this checks
An OpenAPI spec is your API in a form machines can read. Agents use it to integrate without a human studying the docs, so it is one of the highest-leverage files you can publish.
Suggested change
Publish an OpenAPI (Swagger) specification at /openapi.json or /api/openapi.yaml. This is how agents understand your API surface automatically.
Check the result
Rescan stripe.com after the change, then inspect the affected public page or endpoint directly.
Function calling compatibilityFailedfunction-calling-compatRecommendedVerifiedNo API spec found - function calling requires discoverable endpoints+1.1est. points
Scan result
No API spec found - function calling requires discoverable endpoints
What this checks
Whether your API spec translates cleanly into the function-calling format ChatGPT, Claude, and Gemini actually consume. Incompatible specs mean agents cannot call you even when they want to.
4 more issues in this goal, each with a fix promptGet the fix kit
05Is your integration well-built?Can an agent tell what your software tools do and how to call them?APIMCP25/1002 shown · 2 in the fix kit
API schema complexity analysisFailedapi-schema-analysisRecommendedVerifiedNo API schema detected+1.1est. points
Scan result
No API schema detected
What this checks
Is your API simple enough for an agent to use without a human explaining it? Deeply nested, ambiguous schemas fail silently in agent hands.
Product + docs MCP coverageFailedmcp-multi-surface-coverageRecommendedVerifiedBonusYou run an MCP server for your product, but not one for your documentation. This bonus needs two MCP servers: one for your product so agents can take actions, and a separate one for your documentation so agents can answer questions from your docs.+0.3est. points
Scan result
You run an MCP server for your product, but not one for your documentation. This bonus needs two MCP servers: one for your product so agents can take actions, and a separate one for your documentation so agents can answer questions from your docs.
What this checks
Two MCP servers, cleanly split: one for taking actions in your product, one for answering questions from your docs. The mature pattern for brands that have both.
2 more issues in this goal, each with a fix promptGet the fix kit
06Can an agent use you reliably in production?Does your API handle errors, usage limits, more results, and retries predictably?APIOPSMCP37/1002 shown · 4 in the fix kit
Rate limit response headersFailedrate-limit-headersRecommendedVerifiedNo REST rate-limit headers found on probed endpoints+1.1est. points
Scan result
No REST rate-limit headers found on probed endpoints
What this checks
Standard RateLimit headers tell agents how much room they have left, so they slow down gracefully instead of hitting errors and giving up on you.
REST typed error modelFailedapi-error-modelRecommendedVerifiedNo typed error model found+1.6est. points
Scan result
No typed error model found
What this checks
A typed error schema in your OpenAPI spec, so agents know every failure shape in advance and can handle each one deliberately.
4 more issues in this goal, each with a fix promptGet the fix kit
07Can an agent authenticate to you?Can an agent sign in with limited permission without asking a person every time?SDKMCPOAUTHAUTH.MDPAP80/1002 shown · 4 in the fix kit
Scoped permissionsWarningscoped-permissionsRecommendedVerifiedScoped permissions described at https://docs.stripe.com, but no machine-readable scope declaration found (OpenAPI oauth2 scopes or RFC 9728 scopes_supported)+1.6est. points
Scan result
Scoped permissions described at https://docs.stripe.com, but no machine-readable scope declaration found (OpenAPI oauth2 scopes or RFC 9728 scopes_supported)
What this checks
Granular permissions so an agent gets only the access it needs, nothing more. Businesses connect faster when the blast radius of a mistake is small. We look for declared OAuth scopes (OpenAPI security schemes, RFC 9728 metadata), not prose
Agent onboarding frictionWarningonboarding-frictionRecommendedVerifiedOnboarding signals described but not verified live: free tier available, self-serve key generation, sandbox/test environment+0.5est. points
Scan result
Onboarding signals described but not verified live: free tier available, self-serve key generation, sandbox/test environment
What this checks
Can an agent go from discovering you to a first successful API call with no human in the loop? Every manual step is a place automated integrations quietly die.
4 more issues in this goal, each with a fix promptGet the fix kit
08Can an agent transact with you?Can an agent find your prices and pay through a supported payment method?PRICINGX402MPPUCPACPAP2100/1002 shown · 5 in the fix kit
ACP delegate paymentWarningacp-delegate-paymentRecommendedVerifiedBonusDelegate Payment text signals (shared payment token); no reachable /agentic_commerce/delegate_payment endpoint on https://stripe.com or https://api.stripe.com; OPTIONS allows POST at https://api.stripe.com/agentic_commerce/delegate_payment but POST 404 returned no ACP-shaped response
Scan result
Delegate Payment text signals (shared payment token); no reachable /agentic_commerce/delegate_payment endpoint on https://stripe.com or https://api.stripe.com; OPTIONS allows POST at https://api.stripe.com/agentic_commerce/delegate_payment but POST 404 returned no ACP-shaped response
What this checks
The ACP endpoint that lets a buyer's agent hand you a payment credential securely (/agentic_commerce/delegate_payment). Supporting any one payment protocol is enough, so this reads N/A when another is detected. Optional for non-commerce sit
ACP - Agentic Commerce ProtocolWarningacp-supportRequiredVerifiedBonusACP text signals (agentic commerce protocol, shared payment token, shared-payment-token) plus ACP request headers (API-Version / Idempotency-Key); no live /checkout_sessions endpoint on https://stripe.com or https://api.stripe.com; OPTIONS allows POST at https://api.stripe.com/checkout_sessions but POST 404 returned no
Scan result
ACP text signals (agentic commerce protocol, shared payment token, shared-payment-token) plus ACP request headers (API-Version / Idempotency-Key); no live /checkout_sessions endpoint on https://stripe.com or https://api.stripe.com; OPTIONS allows POST at https://api.stripe.com/checkout_sessions but POST 404 returned no
What this checks
A live Agentic Commerce Protocol checkout endpoint (/checkout_sessions), the flow behind agent-driven purchases in ChatGPT. Supporting any one payment protocol is enough, so this reads N/A when another is detected. Optional for non-commerce
5 more issues in this goal, each with a fix promptGet the fix kit
09Can an agent operate your website directly?If there is no API, can an agent read and use your website directly?HTMLNLWEBLLMS.TXTWEBMCPMARKDOWNA11Y71/1003 shown · 5 in the fix kit
Agent-friendly 404sWarningagent-friendly-404RecommendedVerifiedThe nonexistent path https://stripe.com/__site-404-probe-m180idlu correctly returns HTTP 404. Partial credit: no Markdown error body was detected.+0.5est. points
Scan result
The nonexistent path https://stripe.com/__site-404-probe-m180idlu correctly returns HTTP 404. Partial credit: no Markdown error body was detected.
What this checks
A real 404/410 status earns partial credit. Full credit also requires a Markdown error body, so agents can read what happened and where to go next.
WebMCP supportWarningwebmcpRequiredVerifiedWebMCP mentioned in documentation at /docs but not implemented on homepage+2.2est. points
Scan result
WebMCP mentioned in documentation at /docs but not implemented on homepage
What this checks
WebMCP (a W3C draft) exposes tools to agents right on your web pages, no separate server needed. Chrome and the ChatGPT desktop browser now discover and call these tools, so agents browsing your site can act, not just read.
Markdown content negotiation (acceptmarkdown.com)Failedmarkdown-negotiation-varyRecommendedVerifiedBonusHomepage https://stripe.com does not meet the Markdown negotiation requirements: Accept: text/markdown returned text/html; charset=utf-8; Vary header missing Accept (got "none")+0.1est. points
Scan result
Homepage https://stripe.com does not meet the Markdown negotiation requirements: Accept: text/markdown returned text/html; charset=utf-8; Vary header missing Accept (got "none")
What this checks
The homepage serves Markdown when requested and HTML for browsers, with Vary: Accept on the Markdown response. Markdown support on a docs page alone does not satisfy this homepage check.
5 more issues in this goal, each with a fix promptGet the fix kit
Fix prompts for all 51 issues
You can see 20 of them above. The fix kit lists all 51 in priority order and gives each one a prompt for Claude Code, Cursor or another coding agent. Each prompt says what to change and how to check it worked.
Hand it to
Claude Code
Codex
Cursor
GitHub Copilot
Get the fix kit · $30One-time payment. ZIP download right after checkout.
# Fix "OpenAPI spec published" on stripe.com ## Goal Improve stripe.com's agent readiness by resolving the finding below in the connected codebase. Implement the change; do not return advice alone. ## Finding - Check ID: openapi-spec - Layer: Access - Status: fail - Check points: 0/7 - Estimated overall score gain: +4 points - Finding: No OpenAPI/Swagger specification found - Why it matters: An OpenAPI spec is your API in a form machines can read. Agents use it to integrate without a human studying the docs, so it is one of the highest-leverage files you can publish. - Recommended change: Publish an OpenAPI (Swagger) specification at /openapi.json or /api/openapi.yaml. This is how agents understand your API surface automatically. ## Work instructions 1. Inspect the repository first. Identify its framework, relevant routes or configuration, and existing conventions; do not assume file paths or implementation details from the finding alone. 2. Confirm how the finding maps to the current code and make the smallest correct change that addresses the recommendation. Keep unrelated behavior intact. 3. If a recommendation does not fit this product or requires unavailable credentials, policy, or backend access, explain the blocker instead of inventing details or making an unrelated change. 4. Run the relevant checks already available in the repository and report exactly which commands passed or failed. Do not claim a check passed unless you ran it. ## Verification - Test the affected page or API behavior directly for stripe.com. - After changes are deployed, rescan stripe.com in Dedica and confirm the check's result. If the site is not live yet, say that a public rescan is still needed. - Report the files changed, checks run, remaining issues, and any assumptions. ## Site context - Domain: stripe.com - Scan date: 2026-10-23 - Score: 77/100 (B) - Summary: Stripe offers comprehensive payment APIs with excellent developer discoverability, but lacks published OpenAPI specification. - Layer breakdown: - Discovery: 19/20 - Access: 22/30 - Usability: 28/40 - Payments: Not scored Score gains are estimates, not guarantees. A passing scan check is not a substitute for testing the real user task.
Checks reference the AgentReady open specification. The numeric score is separate and is not a conformance result or certification.