{"slug":"gusto-jdkx73","companyName":"Gusto","domain":"gusto.com","url":"https://gusto.com","headline":"Gusto blocks automated clients at the door while publishing pricing behind the same wall, forcing agents to browse as humans or abandon the evaluation.","compositeScore":43,"humanScore":63,"agentScore":23,"doorGap":40,"humanMeasured":4,"agentMeasured":5,"percentile":7,"humanPercentile":19,"agentPercentile":4,"isPartial":false,"depth":"free","siteClass":"b2b_saas","scannerVersion":12,"scannedAt":"2026-09-08T14:12:59.147Z","unlocked":false,"mission":{"steps":[{"url":"https://gusto.com","outcome":"blocked","purpose":"reach the site at all"},{"url":"https://gusto.com/robots.txt","outcome":"ok","purpose":"find out whether machines are welcome"},{"url":"https://gusto.com","outcome":"ok","purpose":"ask whether the door opens for requests carrying the AI crawlers' names"},{"url":"https://gusto.com/llms.txt","outcome":"ok","purpose":"read the site's own guide for language models"},{"url":"https://gusto.com","outcome":"blocked","purpose":"find out what pages exist"},{"url":"https://gusto.com/.well-known/security.txt","outcome":"missing","purpose":"find a contact route for machines"},{"url":"https://gusto.com","outcome":"missing","purpose":"find a published agent interface"},{"url":"https://gusto.com/.well-known/ai-plugin.json","outcome":"missing","purpose":"find an agent plugin manifest"},{"url":"https://gusto.com","outcome":"missing","purpose":"find out whether verified agents are recognised"},{"url":"https://gusto.com","outcome":"missing","purpose":"read the homepage as data rather than as a page"},{"url":"https://gusto.com","outcome":"missing","purpose":"find a machine readable API spec"},{"url":"https://gusto.com","outcome":"missing","purpose":"read the developer documentation"},{"url":"https://gusto.com/product/pricing","outcome":"blocked","purpose":"read the prices without running JavaScript"},{"url":"https://gusto.com","outcome":"blocked","purpose":"find a comparison page worth citing"},{"url":"https://gusto.com/invite/company","outcome":"ok","purpose":"walk the way a visitor would, to a signup form or a product"}],"verdict":"The site refused automated access at gusto.com, so the agent could not reach the site at all."},"observations":null,"dimensions":[{"key":"machine_discoverability","audience":"agent","score":43,"summary":"Gusto publishes llms.txt and allows major AI crawlers in robots.txt, but the homepage and pricing page both refuse HTTP clients while serving real browsers normally.","evidence":{"locked":true,"count":4}},{"key":"programmatic_onboarding","audience":"agent","score":10,"summary":"No API surface exists. The documentation at docs.gusto.com contains 755 characters of text but no credentials, endpoints, code samples, or authentication details.","evidence":{"locked":true,"count":3}},{"key":"pricing_legibility","audience":"agent","score":null,"summary":"Could not verify: this scan did not reach the pages that would show it.","evidence":{"locked":true,"count":1}},{"key":"agent_aware_instrumentation","audience":"agent","score":8,"summary":"No MCP manifest is published at any of the three standard paths. No OpenAPI spec, OAuth metadata, or Web Bot Auth signals are present. An agent has no machine readable way to understand what Gusto offers or how to interact with it.","evidence":{"locked":true,"count":4}},{"key":"machine_fetchable_trust","audience":"agent","score":15,"summary":"No security.txt file is published. The homepage refuses automated clients outright with HTTP 403, blocking any agent from fetching trust signals. A real browser is served the page, but trust verification requires HTTP access.","evidence":{"locked":true,"count":2}},{"key":"commercial_rails","audience":"agent","score":40,"summary":"A self serve signup form is reachable from the homepage in 2 steps and asks for 9 fields, 7 required. No payment is collected on signup. The form accepts Google single sign on.","evidence":{"locked":true,"count":2}},{"key":"steps_to_first_value","audience":"human","score":80,"summary":"The signup form is 2 steps from the homepage. The form collects first name, last name, work email, company name, employee count, password and password confirmation. No verification step appears on the form itself.","evidence":{"locked":true,"count":1}},{"key":"required_fields","audience":"human","score":33,"summary":"7 of 9 fields on the signup form are required: first name, last name, work email, company name, employee count, password and password confirmation. Google single sign on is offered as an alternative to email.","evidence":{"locked":true,"count":1}},{"key":"verification_walls","audience":"human","score":80,"summary":"No verification requirement appears on the signup form. Email verification, phone verification or identity checks are not mentioned. Google single sign on bypasses email entry entirely.","evidence":{"locked":true,"count":1}},{"key":"error_recovery","audience":"human","score":58,"summary":"8 of 16 form inputs carry validation rules. 2 live regions are present for error messaging. No inline error containers are documented. An agent or human can see that some fields have constraints, but error recovery flows are not fully.","evidence":{"locked":true,"count":1}}],"issues":[{"rank":1,"title":"/, /product/pricing turn the honest automated client away while serving a real browser, so the search crawlers that would cite the page are turned away by a rule about the client.","dimensionKey":"machine_discoverability","evidence":{"locked":true,"count":1},"fix":null},{"rank":2,"title":"Automated clients cannot read pricing or reach the signup form because the homepage and pricing page both refuse HTTP requests.","dimensionKey":"machine_discoverability","evidence":{"locked":true,"count":3},"fix":null},{"rank":3,"title":"No API surface is published, so agents cannot obtain credentials or call endpoints to integrate Gusto programmatically.","dimensionKey":"programmatic_onboarding","evidence":{"locked":true,"count":3},"fix":null}],"fixArtifacts":{"locked":true,"count":5,"summaries":[{"id":"bot_wall_guidance:notes","kind":"bot_wall_guidance","title":"Let verified assistants through","path":"notes","effort":{"minutes":60,"role":"developer"},"outcome":{"dimension":"machine_discoverability","external":["Assistant shopping and search crawlers reach the product, pricing and policy pages a buyer asks about."]}},{"id":"robots_search_bots:robots-txt","kind":"robots_search_bots","title":"robots.txt rules for AI crawlers","path":"/robots.txt","effort":{"minutes":10,"role":"owner"},"outcome":{"dimension":"machine_discoverability","external":["The assistants' search crawlers read and cite the site to buyers; training stays the owner's decision."]}},{"id":"interfaces_note:notes","kind":"interfaces_note","title":"Machine interfaces: where you stand","path":"notes","effort":{"minutes":10,"role":"owner"},"outcome":{"dimension":"agent_aware_instrumentation","external":["The developer surface is built in an order where every published pointer answers."]}},{"id":"organization_jsonld:homepage","kind":"organization_jsonld","title":"Organization structured data","path":"homepage","effort":{"minutes":15,"role":"developer"},"outcome":{"dimension":"machine_discoverability","external":["Search and assistant crawlers read the company entity from the homepage rather than inferring it."]}},{"id":"security_txt:well-known-security-txt","kind":"security_txt","title":"security.txt","path":"/.well-known/security.txt","effort":{"minutes":10,"role":"owner"},"outcome":{"dimension":"machine_fetchable_trust","external":["Researchers and automated scanners find a disclosure address instead of guessing one."]}}]},"feedback":{"endpoint":"/api/feedback","mcpTool":"rate_fix","targets":[{"type":"report","key":"report"},{"type":"dimension","dimensionKey":"machine_discoverability","key":"dimension:machine_discoverability"},{"type":"dimension","dimensionKey":"programmatic_onboarding","key":"dimension:programmatic_onboarding"},{"type":"dimension","dimensionKey":"pricing_legibility","key":"dimension:pricing_legibility"},{"type":"dimension","dimensionKey":"agent_aware_instrumentation","key":"dimension:agent_aware_instrumentation"},{"type":"dimension","dimensionKey":"machine_fetchable_trust","key":"dimension:machine_fetchable_trust"},{"type":"dimension","dimensionKey":"commercial_rails","key":"dimension:commercial_rails"},{"type":"dimension","dimensionKey":"steps_to_first_value","key":"dimension:steps_to_first_value"},{"type":"dimension","dimensionKey":"required_fields","key":"dimension:required_fields"},{"type":"dimension","dimensionKey":"verification_walls","key":"dimension:verification_walls"},{"type":"dimension","dimensionKey":"error_recovery","key":"dimension:error_recovery"},{"type":"issue","dimensionKey":"machine_discoverability","checkId":"bot_walls","key":"issue:machine_discoverability:bot_walls"},{"type":"issue","dimensionKey":"machine_discoverability","checkId":null,"key":"issue:machine_discoverability:-"},{"type":"issue","dimensionKey":"programmatic_onboarding","checkId":null,"key":"issue:programmatic_onboarding:-"}]}}