# Copper CRM: 21 point Door Gap
- Site: copper.com
- Scanned: 2026-09-08
- Scan type: Basic scan
- Business type: b2b_saas
- Report: https://www.seconddoor.io/r/copper-j78dgt
- Scanner version: 12
Copper publishes prices and welcomes agents to browse, but offers no API key without a sales conversation and no machine readable specification to build against.
## Scores
| Measure | Score |
| --- | --- |
| Humans | 77/100 |
| Agents | 56/100 |
| Composite | 67/100 |
| Door Gap | 21 points |
| Percentile | 76th |
The human score is the mean of the four human dimensions, the agent score the mean of the six agent dimensions, and the Door Gap the difference between them.
## What the machine actually did
The agent got through 10 of 15 requests, but could not find a contact route for machines. It came up empty on 4 other checks too.
- ok      reach the site at all
- ok      find out whether machines are welcome
- ok      ask whether the door opens for requests carrying the AI crawlers' names
- ok      read the site's own guide for language models
- ok      find out what pages exist
- missing find a contact route for machines
- missing find a published agent interface
- missing find an agent plugin manifest
- missing find out whether verified agents are recognised
- ok      read the homepage as data rather than as a page
- missing find a machine readable API spec
- ok      read the developer documentation
- ok      read the prices without running JavaScript
- ok      find a comparison page worth citing
- ok      walk the way a visitor would, to a signup form or a product
## Top issues
1. **No security.txt is published, so a machine has no documented route to report a problem.** (machine_fetchable_trust)
2. **No OpenAPI specification is published for the Copper API.** (programmatic_onboarding)
3. **No MCP manifest is published to advertise machine readable integration points.** (agent_aware_instrumentation)
The evidence and the recommended fix for each are on the report page: https://www.seconddoor.io/r/copper-j78dgt
## Files generated from this scan
- **robots.txt rules for AI crawlers** at `/robots.txt`, 10 minutes, no developer needed. Verify: The next scan reads robots.txt and finds every search and agent crawler allowed, none of them kept off product or pricing paths.
- **Machine interfaces: where you stand** at `notes`, 10 minutes, no developer needed. Verify: The next scan finds the interface you published answering at its well-known path, and that check passes.
- **pricing.md** at `/pricing.md`, 20 minutes, no developer needed. Verify: The next scan fetches /pricing.md as text and records pricing as machine readable.
- **security.txt** at `/.well-known/security.txt`, 10 minutes, no developer needed. Verify: The next scan fetches /.well-known/security.txt as text and the security.txt check passes.
Each file is written from what this scan found on the site. The content is in the JSON once the evidence is opened: https://www.seconddoor.io/api/reports/copper-j78dgt
## The agent door
- **machine_discoverability** 100/100. No AI crawler is blocked by user agent rule, a real browser is served the page normally, and the site publishes a sitemap with 946 URLs, llms.txt, and 5 schema.org types on the homepage.
- **programmatic_onboarding** 24/100. Authentication is documented and code samples are provided on developer.copper.com, but no OpenAPI spec is published at any of the 6 standard paths checked. A client must be written by hand from prose documentation.
- **pricing_legibility** 93/100. 9 prices are readable without JavaScript on the pricing page, with no tier routed to sales. Plans are published as Offer structured data. The pricing ladder is Basic at $23, Professional at $29, and Business at $59 per seat per month, with.
- **agent_aware_instrumentation** 8/100. No MCP manifest is published at any of the 3 standard paths checked. No ai-plugin.json or Web Bot Auth signals are present. The site does not advertise machine readable integration points for agents.
- **machine_fetchable_trust** 40/100. No security.txt is published at /.well-known/security.txt. The homepage answers automated requests and is served normally, but no security contact or vulnerability disclosure policy is machine readable.
- **commercial_rails** 70/100. Prices are published in raw HTML and as Offer structured data. A self serve signup form is reachable from the homepage in 2 steps with no typed fields required.
## The human door
- **steps_to_first_value** 80/100. The primary call to action, 'Try Copper free', is 2 steps from the homepage and leads to a signup form with no required fields. A visitor can reach a working trial without typing anything.
- **required_fields** 98/100. The signup form has 0 required fields. Entry is by Google single sign on only, with no email, name, company or other typed input. Nothing stands between a visitor and account creation.
- **verification_walls** 80/100. No verification requirement appears on the signup page. Single sign on with Google avoids email verification entirely. A visitor can proceed to the product without confirming an address or phone number.
- **error_recovery** 50/100. No typed inputs were found on the signup form, so validation and error recovery cannot be observed. The form accepts Google authentication only, which either succeeds or fails at the provider level.
---
Scored by SecondDoor. Method: https://www.seconddoor.io/methodology
Scan another site: https://www.seconddoor.io
Rate an issue or this report: POST https://www.seconddoor.io/api/feedback, or the rate_fix tool on https://www.seconddoor.io/api/mcp