# Attio: -1 point Door Gap
- Site: attio.com
- Scanned: 2026-09-08
- Scan type: Basic scan
- Business type: b2b_saas
- Report: https://www.seconddoor.io/r/attio-w6mdcc
- Scanner version: 12
A CRM with published prices and API access, but no comparison pages to help agents shortlist it against competitors.
## Scores
| Measure | Score |
| --- | --- |
| Humans | 73/100 |
| Agents | 74/100 |
| Composite | 74/100 |
| Door Gap | -1 points |
| Percentile | 99th |
The human score is the mean of the four human dimensions, the agent score the mean of the six agent dimensions, and the Door Gap the difference between them.
## What the machine actually did
The agent got through 12 of 15 requests, but could not find a contact route for machines. It came up empty on 2 other checks too.
- ok      reach the site at all
- ok      find out whether machines are welcome
- ok      ask whether the door opens for requests carrying the AI crawlers' names
- ok      read the site's own guide for language models
- ok      find out what pages exist
- missing find a contact route for machines
- ok      find a published agent interface
- ok      find an agent plugin manifest
- missing find out whether verified agents are recognised
- ok      read the homepage as data rather than as a page
- ok      find a machine readable API spec
- ok      read the developer documentation
- ok      read the prices without running JavaScript
- missing find a comparison page worth citing
- ok      walk the way a visitor would, to a signup form or a product
## Top issues
1. **No comparison or alternatives page exists, which is the page an assistant cites when a buyer asks it to shortlist vendors.** (machine_discoverability)
2. **No security.txt is published, so a machine has no documented route to report a problem.** (machine_fetchable_trust)
3. **No comparison pages exist to help agents shortlist Attio against competing CRMs.** (machine_discoverability)
The evidence and the recommended fix for each are on the report page: https://www.seconddoor.io/r/attio-w6mdcc
## Files generated from this scan
- **Pricing as Offer structured data** at `pricing page`, 20 minutes, developer. Verify: The next scan reads Offer structured data with a price and currency on the pricing page, and the pricing check credits it.
- **A comparison page brief** at `/compare/attio-vs-competitor`, 3 hours, no developer needed. Verify: The next scan finds a comparison page listed in the sitemap or linked from the homepage, and reads its text without JavaScript.
- **security.txt** at `/.well-known/security.txt`, 10 minutes, no developer needed. Verify: The next scan fetches /.well-known/security.txt as text and the security.txt check passes.
Each file is written from what this scan found on the site. The content is in the JSON once the evidence is opened: https://www.seconddoor.io/api/reports/attio-w6mdcc
## The agent door
- **machine_discoverability** 79/100. Robots.txt blocks 2 training crawlers (ccbot, bytespider) while allowing major AI agents (GPT, Claude, Perplexity, Google). A real browser is served normally.
- **programmatic_onboarding** 62/100. An OpenAPI spec is published at /openapi.json and OAuth authorization metadata is available, so an agent can generate a client and authenticate. However, the spec alone does not establish what happens after signup: whether an API key is.
- **pricing_legibility** 85/100. 30 prices are readable in raw HTML without JavaScript. Four tiers are published: Free, Plus, Pro, and Enterprise. The first three show per-seat pricing in USD. Enterprise routes to sales, which is standard practice.
- **agent_aware_instrumentation** 100/100. An MCP manifest is published at /.well-known/mcp.json. An ai-plugin.json is published. OAuth authorization metadata is available. Pricing.md is machine readable. A full OpenAPI spec is published.
- **machine_fetchable_trust** 40/100. No security.txt is published at /.well-known/security.txt. The homepage answers automated requests and schema.org data is present, but there is no machine readable security policy, incident reporting address, or key rotation schedule.
- **commercial_rails** 75/100. Prices are published in raw HTML on the pricing page. A self-serve signup form is 2 steps from the homepage and asks only for a Google sign-in, with no payment required upfront. Pricing.md is machine readable.
## The human door
- **steps_to_first_value** 80/100. The primary call to action, 'Start for free', is 2 steps from the homepage and leads to a signup form. The form has 1 field (Google sign-in) and 0 required fields.
- **required_fields** 98/100. The signup form has 1 field and 0 required fields. Google sign-in is offered as the sole option. Nothing stands between a visitor and account creation. This is the absence of a wall, not a missing measurement.
- **verification_walls** 80/100. No verification requirement appears on the signup page. Google sign-in avoids email verification entirely. An agent can proceed from the homepage to an account without proving identity or ownership of an email address.
- **error_recovery** 35/100. 0 of 1 inputs carry validation rules, descriptions, or live error regions. The Google sign-in button offers no inline feedback if authentication fails.
---
Scored by SecondDoor. Method: https://www.seconddoor.io/methodology
Scan another site: https://www.seconddoor.io
Rate an issue or this report: POST https://www.seconddoor.io/api/feedback, or the rate_fix tool on https://www.seconddoor.io/api/mcp