Basic scanSoftware and storefront · Storefront property/Scanned 6 Sept 2026, 19:46 UTC/1 browser pass
seconddoor.io
A hybrid storefront and SaaS platform with strong machine discoverability but no published agent checkout path for either funnel.
One issues, in priority order
Each one is drawn from evidence recorded during the walks.
3 pieces of evidence and the recommended fix are recorded for this issue.
We sent a buying agent
18 requests, in order
The agent got through 16 of 18 requests, but could not find out whether verified agents are recognised. It came up empty on 1 other check too.
- 01reached
www.seconddoor.io
reach the site at all
- 02reached
/robots.txt
find out whether machines are welcome
- 03reached
www.seconddoor.io
ask whether the door opens for requests carrying the AI crawlers' names
- 04reached
/llms.txt
read the site's own guide for language models
- 05reached
/sitemap.xml
find out what pages exist
- 06reached
/.well-known/security.txt
find a contact route for machines
- 07reached
/.well-known/mcp.json
find a published agent interface
- 08reached
/.well-known/ai-plugin.json
find an agent plugin manifest
- 09not found
www.seconddoor.io
find out whether verified agents are recognised
- 10reached
www.seconddoor.io
read the homepage as data rather than as a page
- 11reached
/openapi.json
find a machine readable API spec
- 12reached
www.seconddoor.io
read the developer documentation
- 13reached
/pricing
read the prices without running JavaScript
- 14not found
www.seconddoor.io
read the product catalogue as data
- 15reached
www.seconddoor.io
read a product page as data
- 16reached
www.seconddoor.io
read the returns and shipping terms
- 17reached
www.seconddoor.io
find a comparison page worth citing
- 18reached
/signup
walk the way a visitor would, to a signup form or a product
Deep scans need an account. Accounts are free.
A deep scan walks the site with two agents, records cited evidence and screenshots, and keeps a mission timeline. It comes with the paid plans. Making an account costs nothing and gives you one basic scan a month.
Ten dimensions
Not measured is not zero.
The agent door
81 of 100What a machine can do on your site with nobody watching.
Machine discoverability
Whether a retrieval system can find and read you at all.
Robots.txt names and allows 14 AI crawlers including GPT, Claude, Perplexity and Gemini. A real browser is served normally. Sitemap lists 84 URLs. Homepage carries 6 schema.org types.
4 observations recorded.
Programmatic onboarding
Whether an agent can get working access without a human.
A machine readable API spec is published.
3 observations recorded.
Pricing legibility
Whether total cost can be computed from published numbers.
Six prices are readable without JavaScript on the pricing page: $0, $29, $99, $249, $2,500 and an unlabeled tier. No tier is gated behind a demo or contact-sales wall. FAQ markup is present. Currency is USD.
2 observations recorded.
Agent-aware instrumentation
Whether you publish anything built for machine callers.
MCP manifest published at /.well-known/mcp.json. AI-plugin.json published. Robots.txt explicitly names 14 AI crawlers and allows them. OpenAPI spec published. All four major instrumentation channels are active.
4 observations recorded.
Machine-fetchable trust
Whether terms, security and status are readable as text.
Security.txt is published with a contact route for machines. Returns policy reads as text at /refunds. Homepage answers automated requests. Shipping policy was not found at standard paths. Trust signals are present but incomplete.
3 observations recorded.
Commercial rails
Whether a purchase can complete without a sales call.
Prices are published in raw HTML on the pricing page. A self-serve signup form is 2 steps from the homepage with 2 required fields and 1 SSO option. No UCP manifest, storefrontMCP, or payment processor was detected.
4 observations recorded.
The human door
83 of 100What a first time visitor meets between landing and first value.
Steps to first value
How far a new visitor travels before something useful happens.
Signup form is 2 steps from the homepage. The form itself has 2 fields, both required: work email and password. A Google SSO option is available. No payment is asked on signup. The path to account creation is direct.
1 observation recorded.
Required fields
How much you ask for before you give anything back.
The signup form has 2 fields total, both required: work email and password. Google SSO is offered as an alternative. 2 of 2 inputs carry validation rules. Friction is minimal.
1 observation recorded.
Verification walls
How many gates stand between intent and access.
No verification requirement appears on the signup page itself. Google SSO avoids email verification entirely. The form does not ask for phone, identity verification, or payment card. Verification is not a gate to signup.
1 observation recorded.
Error recovery
What happens when someone gets it wrong.
Both form inputs carry validation rules and constraints. 2 of 2 inputs have validation attributes. No inline error containers or live regions were detected on the form, so error messaging clarity could not be verified.
1 observation recorded.
Show the score
The badge always shows the latest scores for this domain and links back to the report. Put it in a README or a footer.
This number moves every time you deploy
SecondDoor rescans on a schedule and tells you the day a release closes a door. Watch the trend on the dashboard, or scan another site now.