# folk: 13 point Door Gap
- Site: folk.app
- Scanned: 2026-09-08
- Scan type: Basic scan
- Business type: b2b_saas
- Report: https://www.seconddoor.io/r/folk-tqvkp6
- Scanner version: 12
Folk publishes prices and welcomes agents, but offers no API surface for programmatic access or integration.
## Scores
| Measure | Score |
| --- | --- |
| Humans | 77/100 |
| Agents | 64/100 |
| Composite | 71/100 |
| Door Gap | 13 points |
| Percentile | 99th |
The human score is the mean of the four human dimensions, the agent score the mean of the six agent dimensions, and the Door Gap the difference between them.
## What the machine actually did
The agent got through 10 of 15 requests, but could not find a contact route for machines. It came up empty on 4 other checks too.
- ok      reach the site at all
- ok      find out whether machines are welcome
- ok      ask whether the door opens for requests carrying the AI crawlers' names
- ok      read the site's own guide for language models
- ok      find out what pages exist
- missing find a contact route for machines
- ok      find a published agent interface
- missing find an agent plugin manifest
- missing find out whether verified agents are recognised
- ok      read the homepage as data rather than as a page
- missing find a machine readable API spec
- missing read the developer documentation
- ok      read the prices without running JavaScript
- ok      find a comparison page worth citing
- ok      walk the way a visitor would, to a signup form or a product
## Top issues
1. **No security contact information is published for responsible disclosure.** (machine_fetchable_trust)
2. **No API surface is documented or accessible for programmatic integration.** (programmatic_onboarding)
3. **No machine-readable pricing or procurement metadata is published for agent-driven evaluation.** (commercial_rails)
The evidence and the recommended fix for each are on the report page: https://www.seconddoor.io/r/folk-tqvkp6
## Files generated from this scan
- **Machine interfaces: where you stand** at `notes`, 10 minutes, no developer needed. Verify: The next scan finds the interface you published answering at its well-known path, and that check passes.
- **pricing.md** at `/pricing.md`, 20 minutes, no developer needed. Verify: The next scan fetches /pricing.md as text and records pricing as machine readable.
- **security.txt** at `/.well-known/security.txt`, 10 minutes, no developer needed. Verify: The next scan fetches /.well-known/security.txt as text and the security.txt check passes.
Each file is written from what this scan found on the site. The content is in the JSON once the evidence is opened: https://www.seconddoor.io/api/reports/folk-tqvkp6
## The agent door
- **machine_discoverability** 100/100. Robots.txt names 6 AI crawlers and allows them all. A real browser is served the page normally. Key pages read without JavaScript. Sitemap lists 1274 URLs. Homepage carries 9 schema.org types including SoftwareApplication and Offer.
- **programmatic_onboarding** 10/100. Developer documentation at developer.folk.app/ contains 687 characters of text but shows no API credentials, endpoints, code samples, authentication documentation or self-serve key issuance.
- **pricing_legibility** 96/100. 24 prices are readable without JavaScript on the pricing page. Three plans are published: Standard at $24/month, Premium at $48/month, and Enterprise routed to sales. Plans are structured as Offer schema. FAQ markup is present.
- **agent_aware_instrumentation** 70/100. MCP manifest is published at https://developer.folk.app/.well-known/mcp.json. Robots.txt names 6 AI crawlers (gptbot, chatgpt-user, claudebot, anthropic-ai, perplexitybot, ccbot) and allows them.
- **machine_fetchable_trust** 40/100. Homepage answers automated requests with HTTP 200. No security.txt is published at /.well-known/security.txt. No Web Bot Auth signals are present. No ai-plugin.json is published.
- **commercial_rails** 70/100. Prices are published in raw HTML on the pricing page without JavaScript requirement. Self-serve signup form is 2 steps from the homepage. Plans are published as Offer structured data. Google single sign-on is the only entry method offered.
## The human door
- **steps_to_first_value** 80/100. Primary call to action is 'Try for free' at https://app.folk.app/login, 2 steps from the homepage. No typed fields are required. Single sign-on with Google is the only option. No payment is requested at signup.
- **required_fields** 98/100. The signup form contains 0 required fields. Entry is via Google single sign-on only. No email, name, company or other typed input is collected before access is granted.
- **verification_walls** 80/100. No verification requirement appears on the signup page. Single sign-on with Google avoids email verification entirely. No CAPTCHA, phone verification or other confirmation step stands between the visitor and the product.
- **error_recovery** 50/100. No typed inputs were found on the signup form, so validation and error recovery cannot be observed. Single sign-on delegates error handling to Google's authentication flow.
---
Scored by SecondDoor. Method: https://www.seconddoor.io/methodology
Scan another site: https://www.seconddoor.io
Rate an issue or this report: POST https://www.seconddoor.io/api/feedback, or the rate_fix tool on https://www.seconddoor.io/api/mcp