# Figma: 24 point Door Gap
- Site: figma.com
- Scanned: 2026-09-08
- Scan type: Basic scan
- Business type: b2b_saas
- Report: https://www.seconddoor.io/r/figma-zsrnqp
- Scanner version: 12
Figma blocks AI crawlers from reading its pricing and product pages, then publishes no API surface for agents to complete purchases programmatically.
## Scores
| Measure | Score |
| --- | --- |
| Humans | 73/100 |
| Agents | 49/100 |
| Composite | 61/100 |
| Door Gap | 24 points |
The human score is the mean of the four human dimensions, the agent score the mean of the six agent dimensions, and the Door Gap the difference between them.
## What the machine actually did
The agent got through 8 of 15 requests, but could not find out whether machines are welcome. It came up empty on 6 other checks too. That is enough missing for a machine to give up before it reaches a purchase.
- ok      reach the site at all
- missing find out whether machines are welcome
- ok      ask whether the door opens for requests carrying the AI crawlers' names
- missing read the site's own guide for language models
- ok      find out what pages exist
- ok      find a contact route for machines
- missing find a published agent interface
- missing find an agent plugin manifest
- missing find out whether verified agents are recognised
- ok      read the homepage as data rather than as a page
- missing find a machine readable API spec
- missing read the developer documentation
- ok      read the prices without running JavaScript
- ok      find a comparison page worth citing
- ok      walk the way a visitor would, to a signup form or a product
## Top issues
1. **No developer documentation is linked from the homepage, in raw HTML or the rendered page, so integration starts with a search engine.** (programmatic_onboarding)
2. **robots.txt blocks 9 AI crawlers, so those assistants cannot read this site at all.** (machine_discoverability)
3. **No API surface exists in the developer documentation, blocking agents from obtaining credentials or making authenticated requests.** (programmatic_onboarding)
The evidence and the recommended fix for each are on the report page: https://www.seconddoor.io/r/figma-zsrnqp
## Files generated from this scan
- **Pricing as Offer structured data** at `pricing page`, 20 minutes, developer. Verify: The next scan reads Offer structured data with a price and currency on the pricing page, and the pricing check credits it.
- **robots.txt rules for AI crawlers** at `/robots.txt`, 10 minutes, no developer needed. Verify: The next scan reads robots.txt and finds every search and agent crawler allowed, none of them kept off product or pricing paths.
- **Machine interfaces: where you stand** at `notes`, 10 minutes, no developer needed. Verify: The next scan finds the interface you published answering at its well-known path, and that check passes.
- **pricing.md** at `/pricing.md`, 20 minutes, no developer needed. Verify: The next scan fetches /pricing.md as text and records pricing as machine readable.
- **Organization structured data** at `homepage`, 15 minutes, developer. Verify: The next scan reads Organization and WebSite nodes in the homepage JSON-LD and the structured data check passes.
- **llms.txt** at `/llms.txt`, 15 minutes, no developer needed. Verify: The next scan fetches /llms.txt as text and the llms.txt check passes.
Each file is written from what this scan found on the site. The content is in the JSON once the evidence is opened: https://www.seconddoor.io/api/reports/figma-zsrnqp
## The agent door
- **machine_discoverability** 39/100. Robots.txt blocks 5 of the 9 named AI crawlers that fetch pages to answer buyers: oai-searchbot, claude-searchbot, perplexitybot, chatgpt-user and claude-user.
- **programmatic_onboarding** 22/100. No API credentials, endpoints, code samples or authentication documentation exist at /developers. OAuth authorization metadata is published, which signals remote MCP capability, but the documentation itself contains no API surface to call.
- **pricing_legibility** 85/100. 9 prices are readable in raw HTML without JavaScript: Starter at $12, Professional at $16, and per-seat rates from $3 to $90. An Enterprise tier routes to sales, which is standard practice. Prices are legible to machines and humans alike.
- **agent_aware_instrumentation** 0/100. No MCP manifest exists at any of the 3 standard paths checked. OAuth authorization metadata is published, which is how a remote MCP server is discovered, but no manifest implements it.
- **machine_fetchable_trust** 85/100. Security.txt is published at /.well-known/security.txt with a contact route for machines. The homepage answers automated requests with HTTP 200 and serves structured data (Organization and ContactPoint). A real browser is not blocked.
- **commercial_rails** 65/100. Prices are published in raw HTML on the pricing page. A self-serve signup form is 2 steps from the homepage with a single Google sign-in option and no required fields.
## The human door
- **steps_to_first_value** 80/100. The signup form is 2 steps from the homepage via 'Get started for free'. The form contains 1 field with no required fields and offers Google sign-in, reducing friction. The walk could not verify what happens after submission.
- **required_fields** 98/100. The signup form has 1 field total and 0 required fields. Google sign-in is offered as an alternative, eliminating the need to enter credentials. A visitor can proceed without providing any information.
- **verification_walls** 80/100. No verification requirement appears on the signup page itself. Google sign-in avoids email verification entirely. The walk could not verify what verification steps occur after form submission.
- **error_recovery** 35/100. 0 of 1 inputs on the signup form carry validation rules, descriptions or live error regions. A visitor entering invalid data receives no inline guidance. The form offers no recovery path visible before submission.
---
Scored by SecondDoor. Method: https://www.seconddoor.io/methodology
Scan another site: https://www.seconddoor.io
Rate an issue or this report: POST https://www.seconddoor.io/api/feedback, or the rate_fix tool on https://www.seconddoor.io/api/mcp