# Shopify: 26 point Door Gap
- Site: shopify.com
- Scanned: 2026-09-08
- Scan type: Basic scan
- Business type: hybrid
- Report: https://www.seconddoor.io/r/shopify-xshwde
- Scanner version: 12
A platform that sells software and storefronts but blocks automated signup and publishes no API surface for either funnel.
## Scores
| Measure | Score |
| --- | --- |
| Humans | 80/100 |
| Agents | 54/100 |
| Composite | 67/100 |
| Door Gap | 26 points |
The human score is the mean of the four human dimensions, the agent score the mean of the six agent dimensions, and the Door Gap the difference between them.
## What the machine actually did
The agent got through 13 of 18 requests, but could not find a published agent interface. It came up empty on 4 other checks too.
- ok      reach the site at all
- ok      find out whether machines are welcome
- ok      ask whether the door opens for requests carrying the AI crawlers' names
- ok      read the site's own guide for language models
- ok      find out what pages exist
- ok      find a contact route for machines
- missing find a published agent interface
- missing find an agent plugin manifest
- missing find out whether verified agents are recognised
- ok      read the homepage as data rather than as a page
- missing find a machine readable API spec
- missing read the developer documentation
- ok      read the prices without running JavaScript
- ok      read the product catalogue as data
- ok      read a product page as data
- ok      read the returns and shipping terms
- ok      find a comparison page worth citing
- ok      walk the way a visitor would, to a signup form or a product
## Top issues
1. **The catalogue endpoint at /products.json is closed and no product sitemap replaces it, so an assistant has no list of what this store sells.** (machine_discoverability)
2. **The product catalog is closed to machines, with /products.json returning 404 and no product sitemap published.** (commercial_rails)
3. **No API documentation is linked from the homepage and no OpenAPI spec is published at any standard path.** (programmatic_onboarding)
The evidence and the recommended fix for each are on the report page: https://www.seconddoor.io/r/shopify-xshwde
## Files generated from this scan
- **Pricing as Offer structured data** at `pricing page`, 20 minutes, developer. Verify: The next scan reads Offer structured data with a price and currency on the pricing page, and the pricing check credits it.
- **robots.txt rules for AI crawlers** at `/robots.txt`, 10 minutes, no developer needed. Verify: The next scan reads robots.txt and finds every search and agent crawler allowed, none of them kept off product or pricing paths.
- **Returns and refunds page** at `/policies/refund-policy`, 30 minutes, no developer needed. Verify: The next scan reads the returns policy page as text without JavaScript and finds it linked from a product page.
- **Agent checkout: where you stand** at `notes`, 10 minutes, no developer needed. Verify: The next scan finds a UCP manifest, a storefront MCP endpoint or another discovery file answering, and the checkout check passes.
- **Machine interfaces: where you stand** at `notes`, 10 minutes, no developer needed. Verify: The next scan finds the interface you published answering at its well-known path, and that check passes.
- **pricing.md** at `/pricing.md`, 20 minutes, no developer needed. Verify: The next scan fetches /pricing.md as text and records pricing as machine readable.
- **Organization structured data** at `homepage`, 15 minutes, developer. Verify: The next scan reads Organization and WebSite nodes in the homepage JSON-LD and the structured data check passes.
Each file is written from what this scan found on the site. The content is in the JSON once the evidence is opened: https://www.seconddoor.io/api/reports/shopify-xshwde
## The agent door
- **machine_discoverability** 100/100. No AI crawler is blocked by robots.txt or user agent rules; ChatGPT, Claude, Gemini and Perplexity are explicitly allowed. The homepage serves to a real browser normally.
- **programmatic_onboarding** 10/100. No API documentation is linked from the homepage in raw HTML or after rendering. No OpenAPI spec exists at any of the 6 standard paths checked. The platform supports agent checkout protocols but publishes no manifest.
- **pricing_legibility** 85/100. 10 prices are readable in raw HTML on the pricing page without JavaScript, ranging from $1 to $10,000. No tier is gated behind a sales contact or demo request. The currency is USD and clearly marked.
- **agent_aware_instrumentation** 13/100. No MCP manifest is published at any of the 3 standard paths. Shopify's platform supports agent checkout protocols and payment rails, but no agent checkout manifest has been published yet. The site is ready for it but has not done it.
- **machine_fetchable_trust** 80/100. Security.txt is published with a contact route, no returns policy page reads as text, the shipping policy reads as text, the homepage answers automated requests.
- **commercial_rails** 35/100. Prices are published in raw HTML on the pricing page, so a buyer can see them without running code. The Shopify storefront platform supports wallet payments and agent checkout, but no agent checkout manifest is published.
## The human door
- **steps_to_first_value** 80/100. The signup page is 2 steps from the homepage (home to /pricing, then to signup). The automated browser was refused at the signup form itself, so the form fields and validation could not be counted.
- **required_fields** null/100. Could not verify: this scan did not reach the pages that would show it.
- **verification_walls** null/100. Could not verify: this scan did not reach the pages that would show it.
- **error_recovery** null/100. Could not verify: this scan did not reach the pages that would show it.
---
Scored by SecondDoor. Method: https://www.seconddoor.io/methodology
Scan another site: https://www.seconddoor.io
Rate an issue or this report: POST https://www.seconddoor.io/api/feedback, or the rate_fix tool on https://www.seconddoor.io/api/mcp