# Kosas Cosmetics: 26 point Door Gap
- Site: kosas.com
- Scanned: 2026-09-08
- Scan type: Basic scan
- Business type: ecommerce
- Report: https://www.seconddoor.io/r/kosas-5x2jap
- Scanner version: 12
A Shopify storefront with product data and UCP checkout support, but no structured pricing on product pages forces agents to scrape.
## Scores
| Measure | Score |
| --- | --- |
| Humans | 77/100 |
| Agents | 51/100 |
| Composite | 64/100 |
| Door Gap | 26 points |
The human score is the mean of the four human dimensions, the agent score the mean of the six agent dimensions, and the Door Gap the difference between them.
## What the machine actually did
The agent got through 10 of 17 requests, but could not find a contact route for machines. It came up empty on 6 other checks too.
- ok      reach the site at all
- ok      find out whether machines are welcome
- ok      ask whether the door opens for requests carrying the AI crawlers' names
- ok      read the site's own guide for language models
- ok      find out what pages exist
- missing find a contact route for machines
- missing find a published agent interface
- missing find an agent plugin manifest
- missing find out whether verified agents are recognised
- ok      read the homepage as data rather than as a page
- missing find a machine readable API spec
- missing read the developer documentation
- ok      read the prices without running JavaScript
- ok      read the product catalogue as data
- missing read a product page as data
- ok      read the returns and shipping terms
- ok      walk the way a visitor would, to a signup form or a product
## Top issues
1. **The product pages carry no Product structured data, so an assistant must scrape the page to learn a price, and cannot learn availability or an identifier at all.** (pricing_legibility)
2. **Product pages publish prices in HTML text only, with no structured data markup, forcing agents to scrape instead of reading schema.org.** (pricing_legibility)
3. **No API documentation is published, leaving agents to discover the UCP manifest by trial rather than by reading a guide.** (programmatic_onboarding)
The evidence and the recommended fix for each are on the report page: https://www.seconddoor.io/r/kosas-5x2jap
## Files generated from this scan
- **Product markup for Good Angles Set** at `/products/good-angles-set`, 30 minutes, developer. Verify: The next scan reads price, currency and availability in the Product markup of at least one product page, with the structured price matching the catalogue feed.
- **Product markup for Mini Lip Pulse Gift** at `/products/mini-lip-pulse-gift`, 30 minutes, developer. Verify: The next scan reads price, currency and availability in the Product markup of at least one product page, with the structured price matching the catalogue feed.
- **Product markup for Tinted Skincare Lineup™ Set** at `/products/tinted-skincare-lineup-dreambeam`, 30 minutes, developer. Verify: The next scan reads price, currency and availability in the Product markup of at least one product page, with the structured price matching the catalogue feed.
- **Product markup snippet for every product page** at `snippets/seconddoor-product-jsonld.liquid`, 30 minutes, developer. Verify: The next scan reads price, currency and availability in the Product markup of every product page it samples, with the structured price matching the catalogue feed.
- **Put Okendo reviews in the page** at `notes`, 10 minutes, no developer needed. Verify: The next scan finds review text in the server HTML of a product page.
- **robots.txt rules for AI crawlers** at `/robots.txt`, 10 minutes, no developer needed. Verify: The next scan reads robots.txt and finds every search and agent crawler allowed, none of them kept off product or pricing paths.
- **Return policy and shipping structured data** at `product page`, 30 minutes, developer. Verify: The next scan reads a MerchantReturnPolicy on the product pages, and OfferShippingDetails when the shipping node was published.
- **Variants missing a GTIN or a brand** at `catalog-identifiers.csv`, 5 minutes, no developer needed. Verify: The next scan reads the catalogue feed and finds a valid GTIN on at least nine in ten variants and a brand on at least nine in ten products.
- **OpenAI product feed** at `openai-product-feed.tsv`, 20 minutes, no developer needed. Verify: The next scan finds a valid GTIN and a brand on the sampled variants and the product pages carry the fields a feed listing needs.
- **security.txt** at `/.well-known/security.txt`, 10 minutes, no developer needed. Verify: The next scan fetches /.well-known/security.txt as text and the security.txt check passes.
- **Machine interfaces: where you stand** at `notes`, 10 minutes, no developer needed. Verify: The next scan finds the interface you published answering at its well-known path, and that check passes.
Each file is written from what this scan found on the site. The content is in the JSON once the evidence is opened: https://www.seconddoor.io/api/reports/kosas-5x2jap
## The agent door
- **machine_discoverability** 100/100. No AI crawler is blocked by robots.txt or user agent rules. The site publishes llms.txt, a sitemap with 71 URLs including product pages, and serves all key pages to automated clients without JavaScript.
- **programmatic_onboarding** 10/100. No API documentation is linked from the homepage or published at standard paths. The site offers no OpenAPI spec, no developer guide, and no way for an agent to learn how to transact without reading the UCP manifest directly.
- **pricing_legibility** 45/100. Prices appear in raw HTML on product pages: 53 prices across the 3 pages checked. However, no Product structured data carries price, currency, or availability on any page read.
- **agent_aware_instrumentation** 49/100. A Universal Commerce Protocol manifest at version 2026-08-25 is published, declaring 8 capabilities and 3 payment handlers. A storefront MCP endpoint answers agent calls.
- **machine_fetchable_trust** 65/100. The returns policy and shipping policy both read as plain text and are linked from product pages. No security.txt is published at /.well-known/security.txt. The homepage and product pages serve to automated clients without blocking.
- **commercial_rails** 35/100. The catalogue at /products.json includes brand and product handles, enabling feed construction. A UCP manifest publishes checkout capabilities. Returns and shipping policies read as text.
## The human door
- **steps_to_first_value** 95/100. A product with visible price ($80) and an add-to-cart control is reachable in 2 steps from the homepage. No account is required to proceed to checkout. PayPal and Afterpay wallets are available.
- **required_fields** 80/100. The product page does not require an account before adding to cart. Two express wallet options (PayPal, Afterpay) allow checkout without filling any form fields at all.
- **verification_walls** 75/100. No sign-in requirement blocks access to the product page or the add-to-cart action. The page does not demand email verification or account creation before purchase.
- **error_recovery** 58/100. Of 2 form inputs observed on the product page, 1 carries a validation constraint. No inline error containers or live regions guide correction. Recovery from validation failure is not instrumented.
---
Scored by SecondDoor. Method: https://www.seconddoor.io/methodology
Scan another site: https://www.seconddoor.io
Rate an issue or this report: POST https://www.seconddoor.io/api/feedback, or the rate_fix tool on https://www.seconddoor.io/api/mcp