Basic scanSoftware and storefront · Storefront property/Scanned 1 Sept 2026, 23:12 UTC/1 browser pass
seconddoor.io
A storefront and SaaS platform with strong machine discoverability but no published path for agents to complete purchases.
No issues were written
This scan did not gather enough evidence to rank what is costing you most. The dimension scores below reflect only what was actually observed. Running the scan again usually fixes it.
We sent a buying agent
14 requests, in order
The agent got through 13 of 14 requests, but could not find out whether verified agents are recognised.
- 01reached
www.seconddoor.io
reach the site at all
- 02reached
/robots.txt
find out whether machines are welcome
- 03reached
www.seconddoor.io
ask whether the door opens for requests carrying the AI crawlers' names
- 04reached
/llms.txt
read the site's own guide for language models
- 05reached
/sitemap.xml
find out what pages exist
- 06reached
/.well-known/security.txt
find a contact route for machines
- 07reached
/.well-known/mcp.json
find a published agent interface
- 08reached
/.well-known/ai-plugin.json
find an agent plugin manifest
- 09not found
www.seconddoor.io
find out whether verified agents are recognised
- 10reached
www.seconddoor.io
read the homepage as data rather than as a page
- 11reached
/openapi.json
find a machine readable API spec
- 12reached
www.seconddoor.io
read the developer documentation
- 13reached
/pricing
read the prices without running JavaScript
- 14reached
/signup
walk the way a visitor would, to a signup form or a product
Deep scans need an account. Accounts are free.
A deep scan walks the site with two agents, records cited evidence and screenshots, and keeps a mission timeline. It comes with the paid plans. Making an account costs nothing and gives you one basic scan a month.
Ten dimensions
Not measured is not zero.
The agent door
72 of 100What a machine can do on your site with nobody watching.
Machine discoverability
Whether a retrieval system can find and read you at all.
Robots.txt names 14 AI crawlers and allows them all. A real browser is served the page normally. No user agent rule refuses declared crawler names. Sitemap lists 59 URLs. Homepage carries 6 schema.org types. llms.txt is published.
4 observations recorded.
Programmatic onboarding
Whether an agent can get working access without a human.
A machine readable API spec is published.
3 observations recorded.
Pricing legibility
Whether total cost can be computed from published numbers.
6 prices are readable without JavaScript on the pricing page: $0, $29, $99, $249, $2,500, and one more. No tier is gated behind a sales contact. Prices are legible to machines and humans alike.
1 observation recorded.
Agent-aware instrumentation
Whether you publish anything built for machine callers.
MCP manifest published at /.well-known/mcp.json. AI plugin manifest published at /.well-known/ai-plugin.json. Robots.txt names 14 AI crawlers and allows them. OpenAPI spec published.
4 observations recorded.
Machine-fetchable trust
Whether terms, security and status are readable as text.
Security.txt is published at /.well-known/security.txt with a contact route for machines. The homepage answers automated requests with a 200 status in 474ms. Trust signals are present and accessible.
2 observations recorded.
Commercial rails
Whether a purchase can complete without a sales call.
No UCP manifest at /.well-known/ucp. No commerce platform or payment processor detected on the homepage. No published route for agents to complete a purchase. An agent can discover the product and read the prices but cannot transact.
2 observations recorded.
The human door
83 of 100What a first time visitor meets between landing and first value.
Steps to first value
How far a new visitor travels before something useful happens.
The primary call to action, 'Sign up for free', is 2 steps from the homepage and leads to a 2-field signup form. A human can reach the form quickly. What happens after submission was not observed.
1 observation recorded.
Required fields
How much you ask for before you give anything back.
The signup form has 2 fields, both required: Work email and Password. Google single sign-on is offered as an alternative. 2 of 2 inputs carry validation rules. The form is minimal and direct.
1 observation recorded.
Verification walls
How many gates stand between intent and access.
No verification requirement appears on the signup page itself. Google single sign-on avoids email verification entirely. The form does not block progress with a second factor or email confirmation step.
1 observation recorded.
Error recovery
What happens when someone gets it wrong.
Both inputs on the signup form carry validation rules, so a user can correct mistakes before submission. Inline error handling was not observed on the page, but validation attributes are present.
1 observation recorded.
Show the score
The badge always shows the latest scores for this domain and links back to the report. Put it in a README or a footer.
This number moves every time you deploy
SecondDoor rescans on a schedule and tells you the day a release closes a door. Watch the trend on the dashboard, or scan another site now.