Some cookies are necessary for SecondDoor to work. Others are optional, and tell us how the site and the product are used. Accept all, or decline all optional ones. Without a selection, nothing optional is set. More in our cookie policy.
Basic scanSoftware business · Marketing site/Scanned 8 Sept 2026, 14:03 UTC/1 browser pass
A CRM with published prices and API access, but no comparison pages to help agents shortlist it against competitors.
Older scan
This report was produced by an earlier version of the scanner. Some findings may not match how the site is measured now.
Narrow. Both audiences hit roughly the same walls.
Ordered by what the evidence says is costing most. Written for whoever owns the site, not whoever builds it.
1 piece of evidence and the recommended fix are recorded for this issue, with /compare/attio-vs-competitor written from your own pages.
This is a basic scan, so it raises the three issues the deterministic evidence supports. A deep scan sends two agents over the site and raises up to ten, each with cited evidence and the screens to prove it.
A deep scan walks the site with two agents, records cited evidence and screenshots, and keeps a mission timeline. It comes with the paid plans. Making an account costs nothing and gives you one basic scan a month.
The score and the audit trail stay public. The evidence and the files open with an account.
The audit trail behind every number above. Not measured is not zero.
Machine discoverability
Robots.txt blocks 2 training crawlers (ccbot, bytespider) while allowing major AI agents (GPT, Claude, Perplexity, Google). A real browser is served normally.
4 observations recorded.
Programmatic onboarding
An OpenAPI spec is published at /openapi.json and OAuth authorization metadata is available, so an agent can generate a client and authenticate. However, the spec alone does not establish what happens after signup: whether an API key is.
3 observations recorded.
Pricing legibility
30 prices are readable in raw HTML without JavaScript. Four tiers are published: Free, Plus, Pro, and Enterprise. The first three show per-seat pricing in USD. Enterprise routes to sales, which is standard practice.
1 observation recorded.
Agent-aware instrumentation
An MCP manifest is published at /.well-known/mcp.json. An ai-plugin.json is published. OAuth authorization metadata is available. Pricing.md is machine readable. A full OpenAPI spec is published.
4 observations recorded.
Machine-fetchable trust
No security.txt is published at /.well-known/security.txt. The homepage answers automated requests and schema.org data is present, but there is no machine readable security policy, incident reporting address, or key rotation schedule.
2 observations recorded.
Commercial rails
Prices are published in raw HTML on the pricing page. A self-serve signup form is 2 steps from the homepage and asks only for a Google sign-in, with no payment required upfront. Pricing.md is machine readable.
2 observations recorded.
Steps to first value
The primary call to action, 'Start for free', is 2 steps from the homepage and leads to a signup form. The form has 1 field (Google sign-in) and 0 required fields.
1 observation recorded.
Required fields
The signup form has 1 field and 0 required fields. Google sign-in is offered as the sole option. Nothing stands between a visitor and account creation. This is the absence of a wall, not a missing measurement.
1 observation recorded.
Verification walls
No verification requirement appears on the signup page. Google sign-in avoids email verification entirely. An agent can proceed from the homepage to an account without proving identity or ownership of an email address.
1 observation recorded.
Error recovery
0 of 1 inputs carry validation rules, descriptions, or live error regions. The Google sign-in button offers no inline feedback if authentication fails.
1 observation recorded.
It got through 12 of 15.
The agent got through 12 of 15 requests, but could not find a contact route for machines. It came up empty on 2 other checks too.