Is your site legible
to a buyer's AI agent?

More purchases start with an assistant reading a site on someone's behalf. It guesses the trust addresses, reads the structured data, follows the site's own links to a product page and the pricing page, and gives up on a 404 a person would never see. Doorman walks a site exactly that way and writes down what it got.

Ask for a scan

A request, not a scan: a person reads it, then the scanner runs under the published etiquette. Free. No account.

See it run Wicketry · scanned 13 Sep 2026 · the scanner's own site, first

Every line above is the scanner's own log for this scan — timestamp, the gap since the previous request, the status the site answered with, and why the request was made. The full walk and every finding →

What it found 7 things an agent could not read

FDoors0/3 pts · 1 miss›

• ✕An MCP door answers at /mcp (200, or a deliberate 401/403/405)POST /mcp tools/list → 404Optional: an MCP endpoint lets an agent read your data under a key. If you have one, say so in the agent card.optional; not every site needs a door, but a door that is advertised must answerw 3

BHow it describes itself12/14 pts · 2 misses›

• ✕A Twitter/X card type is declaredmeta twitter:card: (absent)Add `<meta name="twitter:card" content="summary_large_image">`; without it the card falls back to a bare link.w 1
• ✕og:image declares its dimensionsog:image:width/height: (absent) × (absent)Add og:image:width and og:image:height so a reader can lay the card out without downloading the image first.w 1

BWhat the server says7/9 pts · 2 misses›

• ✕A Content-Security-Policy is declaredcontent-security-policy: (absent)Add a Content-Security-Policy. Start in report-only mode; the point here is that one exists and is deliberate, not that it is strict.w 1
• ✕Framing is controlled (X-Frame-Options or CSP frame-ancestors)x-frame-options: (absent) · frame-ancestors in CSP: noDeclare who may frame the page, with `frame-ancestors` in your CSP (the modern form) or `X-Frame-Options`.w 1

ADoes it agree with itself10/11 pts · 1 miss›

• ✕Trailing slashes resolve to one URL (/pricing)GET /pricing/ → 200Pick one form of /pricing and redirect the other to it. Two URLs answering 200 with the same page means an agent cites whichever it happened to be handed, and your own links disagree with each other.w 1

BAgent surfaces5/6 pts · 1 miss›

• ✕/agents.md and the agent card point at the same placespaths in the card: 11; also named in agents.md: 8; only in the card: ['/privacy', '/status', '/terms']Make the two agree. Two agent-facing files describing different paths is worse than one file, because the agent has no way to tell which is current.w 1

What it reads

Public pages only, by GET, in this order — and nothing else:

How the grade is made

Every check carries a weight. The grade is the weighted points earned divided by the points available on the day of the scan; every finding shows its weight and the request it rests on, so nothing is hidden in the total.

A grade describes how legible a site was to an agent that day. It is not a certificate, not a compliance statement and not a ranking; it determines nothing.

The full report — coming soon

Every one of the 73 checks explained, the 7 things an agent could not read and how to fix each one — steps, a verify line, the WordPress and hand-built variants.

One item of the full report, unredacted — this site's heaviest miss

An MCP door answers at /mcp (200, or a deliberate 401/403/405)

POST /mcp tools/list → 404

This is the one optional check in the report. An MCP door lets an agent read your data under a key instead of scraping pages. Not having one is a legitimate choice; having one that nothing points at is the waste.

What to change: Optional: an MCP endpoint lets an agent read your data under a key. If you have one, say so in the agent card.

How to fix it

1. Decide whether you want one at all. Most sites do not need a door, and this finding is marked optional for that reason — a failing row here is not a fault.
2. If you run one, answer at /mcp. A 200 is expected; a deliberate 401, 403 or 405 also counts, because refusing an unauthenticated request is a working door saying no.
3. Name it in the agent card. A door nothing advertises will only be found by a client that probes for it, and most do not.
4. Do not answer 404 at /mcp while advertising an endpoint elsewhere. That is the site disagreeing with itself and the client believes the 404.
5. If you have no door, say so in agents.md and point at the alternatives — the data download, the API description. An explicit no is worth more than a silence.

curl -sS -X POST https://your-site/mcp -H 'content-type: application/json' -d '{"method":"tools/list"}' -o /dev/null -w '%{http_code}\n'

Tell me when it opensOne email when it opens, nothing else; a person reads the request.

Later: monitoring — a fresh scan on a schedule and a note when a grade moves.

Get your site listed