Basic scanSoftware and storefront · Storefront property/Scanned 1 Sept 2026, 22:55 UTC/1 browser pass
seconddoor.io
A storefront and SaaS platform with strong machine discoverability but no published route for agents to complete a purchase.
One issues, in priority order
Each one is drawn from evidence recorded during the walks.
3 pieces of evidence and the recommended fix are recorded for this issue.
We sent a buying agent
14 requests, in order
The agent got through 13 of 14 requests, but could not find out whether verified agents are recognised.
- 01reached
www.seconddoor.io
reach the site at all
- 02reached
/robots.txt
find out whether machines are welcome
- 03reached
www.seconddoor.io
ask whether the door opens for requests carrying the AI crawlers' names
- 04reached
/llms.txt
read the site's own guide for language models
- 05reached
/sitemap.xml
find out what pages exist
- 06reached
/.well-known/security.txt
find a contact route for machines
- 07reached
/.well-known/mcp.json
find a published agent interface
- 08reached
/.well-known/ai-plugin.json
find an agent plugin manifest
- 09not found
www.seconddoor.io
find out whether verified agents are recognised
- 10reached
www.seconddoor.io
read the homepage as data rather than as a page
- 11reached
/openapi.json
find a machine readable API spec
- 12reached
www.seconddoor.io
read the developer documentation
- 13reached
/pricing
read the prices without running JavaScript
- 14reached
/signup
walk the way a visitor would, to a signup form or a product
Deep scans need an account. Accounts are free.
A deep scan walks the site with two agents, records cited evidence and screenshots, and keeps a mission timeline. It comes with the paid plans. Making an account costs nothing and gives you one basic scan a month.
Ten dimensions
Not measured is not zero.
The agent door
72 of 100What a machine can do on your site with nobody watching.
Machine discoverability
Whether a retrieval system can find and read you at all.
Robots.txt names 14 AI crawlers and allows them all. A real browser is served the page normally. No user agent rule refuses declared crawler names. Sitemap lists 58 URLs. Homepage carries 6 schema.org types. llms.txt is published.
4 observations recorded.
Programmatic onboarding
Whether an agent can get working access without a human.
A machine readable API spec is published.
3 observations recorded.
Pricing legibility
Whether total cost can be computed from published numbers.
6 prices are readable without JavaScript on the pricing page, with no tier routed to sales. Sample prices are $0, $29, $99, $249, and $2,500. All tiers are published and transparent.
1 observation recorded.
Agent-aware instrumentation
Whether you publish anything built for machine callers.
MCP manifest published at /.well-known/mcp.json. AI-plugin.json published. Robots.txt names 14 AI crawlers and allows them. OpenAPI spec published. The site declares itself to machines across multiple standards.
4 observations recorded.
Machine-fetchable trust
Whether terms, security and status are readable as text.
Security.txt is published with a contact route for machines. The homepage answers automated requests normally. Trust signals are present but limited to security contact and basic availability.
2 observations recorded.
Commercial rails
Whether a purchase can complete without a sales call.
No UCP manifest at /.well-known/ucp. No commerce platform or payment processor detected on the homepage. No published route for an agent to complete a purchase. The storefront is visible to machines but closed to them.
2 observations recorded.
The human door
83 of 100What a first time visitor meets between landing and first value.
Steps to first value
How far a new visitor travels before something useful happens.
Signup form is 2 steps from the homepage. The primary CTA is 'Sign up for free' and leads directly to the form. A human reaches the signup page quickly.
1 observation recorded.
Required fields
How much you ask for before you give anything back.
The signup form has 2 fields, both required: Work email and Password. One sign-in option is offered: Google. Both inputs carry validation rules. Friction is minimal.
1 observation recorded.
Verification walls
How many gates stand between intent and access.
No verification requirement appears on the signup page itself. Google sign-in avoids email verification entirely. The form does not block entry with a second factor or email confirmation step.
1 observation recorded.
Error recovery
What happens when someone gets it wrong.
Both of 2 inputs carry validation rules, so a user sees constraints before submission. No inline error containers or live regions were detected, so recovery feedback after submission cannot be confirmed from this scan.
1 observation recorded.
Show the score
The badge always shows the latest scores for this domain and links back to the report. Put it in a README or a footer.
This number moves every time you deploy
SecondDoor rescans on a schedule and tells you the day a release closes a door. Watch the trend on the dashboard, or scan another site now.