{"slug":"graza-f3ab7e","companyName":"Graza","domain":"graza.co","url":"https://graza.co","headline":"A Shopify storefront with strong machine discoverability but no programmatic API for agents to automate orders or integrate inventory.","compositeScore":55,"humanScore":0,"agentScore":55,"doorGap":0,"humanMeasured":0,"agentMeasured":6,"percentile":null,"humanPercentile":null,"agentPercentile":null,"isPartial":true,"depth":"free","siteClass":"unknown","scannerVersion":12,"scannedAt":"2026-09-08T14:43:55.698Z","unlocked":false,"mission":{"steps":[{"url":"https://graza.co","outcome":"ok","purpose":"reach the site at all"},{"url":"https://graza.co/robots.txt","outcome":"ok","purpose":"find out whether machines are welcome"},{"url":"https://graza.co","outcome":"ok","purpose":"ask whether the door opens for requests carrying the AI crawlers' names"},{"url":"https://graza.co/llms.txt","outcome":"ok","purpose":"read the site's own guide for language models"},{"url":"https://www.graza.co/sitemap.xml","outcome":"ok","purpose":"find out what pages exist"},{"url":"https://graza.co/.well-known/security.txt","outcome":"missing","purpose":"find a contact route for machines"},{"url":"https://graza.co","outcome":"missing","purpose":"find a published agent interface"},{"url":"https://graza.co/.well-known/ai-plugin.json","outcome":"missing","purpose":"find an agent plugin manifest"},{"url":"https://graza.co","outcome":"missing","purpose":"find out whether verified agents are recognised"},{"url":"https://graza.co","outcome":"ok","purpose":"read the homepage as data rather than as a page"},{"url":"https://graza.co","outcome":"missing","purpose":"find a machine readable API spec"},{"url":"https://graza.co","outcome":"missing","purpose":"read the developer documentation"},{"url":"https://graza.co","outcome":"ok","purpose":"read the prices without running JavaScript"},{"url":"https://graza.co","outcome":"ok","purpose":"read the product catalogue as data"},{"url":"https://graza.co","outcome":"ok","purpose":"read a product page as data"},{"url":"https://graza.co","outcome":"ok","purpose":"read the returns and shipping terms"}],"verdict":"The agent got through 10 of 16 requests, but could not find a contact route for machines. It came up empty on 5 other checks too."},"observations":null,"dimensions":[{"key":"machine_discoverability","audience":"agent","score":100,"summary":"No AI crawler is blocked by robots.txt; all major assistants are explicitly allowed. The site serves a real browser normally, publishes llms.txt, declares 7 schema.org types on the homepage, lists 37 URLs in a sitemap that includes product.","evidence":{"locked":true,"count":4}},{"key":"programmatic_onboarding","audience":"agent","score":10,"summary":"No API documentation is linked from the homepage or discoverable in the site structure. The probe checked for OpenAPI specs at 6 standard paths and found none.","evidence":{"locked":true,"count":2}},{"key":"pricing_legibility","audience":"agent","score":90,"summary":"Prices are embedded in the raw HTML of all 3 product pages checked, with 41 prices visible on the homepage alone and 150 across the product pages.","evidence":{"locked":true,"count":2}},{"key":"agent_aware_instrumentation","audience":"agent","score":49,"summary":"No MCP manifest exists at the 3 standard paths checked. However, a Universal Commerce Protocol manifest is published at version 2026-08-25, declaring 8 capabilities including checkout, cart, and catalog search.","evidence":{"locked":true,"count":4}},{"key":"machine_fetchable_trust","audience":"agent","score":69,"summary":"No security.txt is published at /.well-known/security.txt. The returns policy and shipping policy are both readable as plain text at their policy URLs, though neither is embedded in product page structured data.","evidence":{"locked":true,"count":3}},{"key":"commercial_rails","audience":"agent","score":10,"summary":"The site runs on Shopify and publishes a Universal Commerce Protocol manifest with 3 payment handlers, so agents can theoretically initiate checkout.","evidence":{"locked":true,"count":4}},{"key":"steps_to_first_value","audience":"human","score":null,"summary":"Could not verify: this scan did not reach the pages that would show it.","evidence":{"locked":true,"count":0}},{"key":"required_fields","audience":"human","score":null,"summary":"Could not verify: this scan did not reach the pages that would show it.","evidence":{"locked":true,"count":0}},{"key":"verification_walls","audience":"human","score":null,"summary":"Could not verify: this scan did not reach the pages that would show it.","evidence":{"locked":true,"count":0}},{"key":"error_recovery","audience":"human","score":null,"summary":"Could not verify: this scan did not reach the pages that would show it.","evidence":{"locked":true,"count":0}}],"issues":[{"rank":1,"title":"No security.txt file is published, leaving no documented contact for security researchers to report vulnerabilities.","dimensionKey":"machine_fetchable_trust","evidence":{"locked":true,"count":3},"fix":null},{"rank":2,"title":"No programmatic API exists for agents to automate orders, manage inventory, or integrate with external systems.","dimensionKey":"programmatic_onboarding","evidence":{"locked":true,"count":3},"fix":null},{"rank":3,"title":"The site publishes a Universal Commerce Protocol manifest but does not publish an MCP manifest, limiting agent compatibility.","dimensionKey":"agent_aware_instrumentation","evidence":{"locked":true,"count":3},"fix":null}],"fixArtifacts":{"locked":true,"count":8,"summaries":[{"id":"robots_search_bots:robots-txt","kind":"robots_search_bots","title":"robots.txt rules for AI crawlers","path":"/robots.txt","effort":{"minutes":10,"role":"owner"},"outcome":{"dimension":"machine_discoverability","external":["The assistants' search crawlers read and cite the site to buyers; training stays the owner's decision."]}},{"id":"product_jsonld_liquid:snippets-seconddoor-product-jsonld-liquid","kind":"product_jsonld_liquid","title":"Product markup snippet for every product page","path":"snippets/seconddoor-product-jsonld.liquid","effort":{"minutes":30,"role":"developer"},"outcome":{"dimension":"pricing_legibility","external":["Every Shopify product page carries complete Product markup, not only the sampled ones."]}},{"id":"review_schema_vendor:notes","kind":"review_schema_vendor","title":"Put Okendo reviews in the page","path":"notes","effort":{"minutes":10,"role":"owner"},"outcome":{"dimension":"machine_discoverability","external":["Review text and ratings reach crawlers that do not run the review widget's script."]}},{"id":"merchant_policy_jsonld:product-page","kind":"merchant_policy_jsonld","title":"Return policy and shipping structured data","path":"product page","effort":{"minutes":30,"role":"developer"},"outcome":{"dimension":"machine_fetchable_trust","external":["Assistants read the return window and shipping terms from structured data."]}},{"id":"policy_pages_text:notes","kind":"policy_pages_text","title":"Link the policy pages from the product page","path":"notes","effort":{"minutes":30,"role":"owner"},"outcome":{"dimension":"machine_fetchable_trust","external":["Returns and shipping pages read as text and are linked from every product page."]}},{"id":"catalog_identifiers:catalog-identifiers-csv","kind":"catalog_identifiers","title":"Variants missing a GTIN or a brand","path":"catalog-identifiers.csv","effort":{"minutes":5,"role":"owner"},"outcome":{"dimension":"machine_discoverability","external":["Feed listings stop being rejected for a missing brand or GTIN."]}},{"id":"interfaces_note:notes","kind":"interfaces_note","title":"Machine interfaces: where you stand","path":"notes","effort":{"minutes":10,"role":"owner"},"outcome":{"dimension":"agent_aware_instrumentation","external":["The developer surface is built in an order where every published pointer answers."]}},{"id":"security_txt:well-known-security-txt","kind":"security_txt","title":"security.txt","path":"/.well-known/security.txt","effort":{"minutes":10,"role":"owner"},"outcome":{"dimension":"machine_fetchable_trust","external":["Researchers and automated scanners find a disclosure address instead of guessing one."]}}]},"feedback":{"endpoint":"/api/feedback","mcpTool":"rate_fix","targets":[{"type":"report","key":"report"},{"type":"dimension","dimensionKey":"machine_discoverability","key":"dimension:machine_discoverability"},{"type":"dimension","dimensionKey":"programmatic_onboarding","key":"dimension:programmatic_onboarding"},{"type":"dimension","dimensionKey":"pricing_legibility","key":"dimension:pricing_legibility"},{"type":"dimension","dimensionKey":"agent_aware_instrumentation","key":"dimension:agent_aware_instrumentation"},{"type":"dimension","dimensionKey":"machine_fetchable_trust","key":"dimension:machine_fetchable_trust"},{"type":"dimension","dimensionKey":"commercial_rails","key":"dimension:commercial_rails"},{"type":"dimension","dimensionKey":"steps_to_first_value","key":"dimension:steps_to_first_value"},{"type":"dimension","dimensionKey":"required_fields","key":"dimension:required_fields"},{"type":"dimension","dimensionKey":"verification_walls","key":"dimension:verification_walls"},{"type":"dimension","dimensionKey":"error_recovery","key":"dimension:error_recovery"},{"type":"issue","dimensionKey":"machine_fetchable_trust","checkId":"security_txt","key":"issue:machine_fetchable_trust:security_txt"},{"type":"issue","dimensionKey":"programmatic_onboarding","checkId":null,"key":"issue:programmatic_onboarding:-"},{"type":"issue","dimensionKey":"agent_aware_instrumentation","checkId":null,"key":"issue:agent_aware_instrumentation:-"}]}}