# Tonal: -15 point Door Gap
- Site: tonal.com
- Scanned: 2026-09-08
- Scan type: Basic scan
- Business type: hybrid
- Report: https://www.seconddoor.io/r/tonal-fwct36
- Scanner version: 12
A fitness hardware and apparel storefront with a software adoption funnel that routes all visitors through sales, blocking direct product evaluation.
## Scores
| Measure | Score |
| --- | --- |
| Humans | 48/100 |
| Agents | 63/100 |
| Composite | 56/100 |
| Door Gap | -15 points |
The human score is the mean of the four human dimensions, the agent score the mean of the six agent dimensions, and the Door Gap the difference between them.
## What the machine actually did
The agent got through 10 of 18 requests, but could not find a contact route for machines. It came up empty on 7 other checks too.
- ok      reach the site at all
- ok      find out whether machines are welcome
- ok      ask whether the door opens for requests carrying the AI crawlers' names
- ok      read the site's own guide for language models
- ok      find out what pages exist
- missing find a contact route for machines
- missing find a published agent interface
- missing find an agent plugin manifest
- missing find out whether verified agents are recognised
- ok      read the homepage as data rather than as a page
- missing find a machine readable API spec
- missing read the developer documentation
- ok      read the prices without running JavaScript
- ok      read the product catalogue as data
- ok      read a product page as data
- missing read the returns and shipping terms
- ok      find a comparison page worth citing
- missing walk the way a visitor would, to a signup form or a product
## Top issues
1. **Reviews load from Trustpilot by script, so a client that reads raw HTML sees the products without a single review.** (pricing_legibility)
2. **No returns or shipping policy page reads as text at the usual paths, so an assistant has no terms to quote beside the price.** (machine_fetchable_trust)
3. **The only route to an account is a sales conversation, so nobody signs up without talking to a person.** (steps_to_first_value)
The evidence and the recommended fix for each are on the report page: https://www.seconddoor.io/r/tonal-fwct36
## Files generated from this scan
- **Product markup for Pilates Loops + Ankle Straps Bundle** at `/products/loops-straps-bundle`, 30 minutes, developer. Verify: The next scan reads price, currency and availability in the Product markup of at least one product page, with the structured price matching the catalogue feed.
- **Product markup for Pilates Loops - Colors** at `/products/pilates-loops-colors`, 30 minutes, developer. Verify: The next scan reads price, currency and availability in the Product markup of at least one product page, with the structured price matching the catalogue feed.
- **Product markup for Tonal Grip Socks** at `/products/tonal-grip-socks`, 30 minutes, developer. Verify: The next scan reads price, currency and availability in the Product markup of at least one product page, with the structured price matching the catalogue feed.
- **Product markup snippet for every product page** at `snippets/seconddoor-product-jsonld.liquid`, 30 minutes, developer. Verify: The next scan reads price, currency and availability in the Product markup of every product page it samples, with the structured price matching the catalogue feed.
- **Put Trustpilot reviews in the page** at `notes`, 10 minutes, no developer needed. Verify: The next scan finds review text in the server HTML of a product page.
- **robots.txt rules for AI crawlers** at `/robots.txt`, 10 minutes, no developer needed. Verify: The next scan reads robots.txt and finds every search and agent crawler allowed, none of them kept off product or pricing paths.
- **Returns and refunds page** at `/policies/refund-policy`, 30 minutes, no developer needed. Verify: The next scan reads the returns policy page as text without JavaScript and finds it linked from a product page.
- **Shipping and delivery page** at `/policies/shipping-policy`, 30 minutes, no developer needed. Verify: The next scan reads the shipping policy page as text without JavaScript and finds it linked from a product page.
- **Variants missing a GTIN or a brand** at `catalog-identifiers.csv`, 5 minutes, no developer needed. Verify: The next scan reads the catalogue feed and finds a valid GTIN on at least nine in ten variants and a brand on at least nine in ten products.
- **Machine interfaces: where you stand** at `notes`, 10 minutes, no developer needed. Verify: The next scan finds the interface you published answering at its well-known path, and that check passes.
- **pricing.md** at `/pricing.md`, 20 minutes, no developer needed. Verify: The next scan fetches /pricing.md as text and records pricing as machine readable.
- **security.txt** at `/.well-known/security.txt`, 10 minutes, no developer needed. Verify: The next scan fetches /.well-known/security.txt as text and the security.txt check passes.
Each file is written from what this scan found on the site. The content is in the JSON once the evidence is opened: https://www.seconddoor.io/api/reports/tonal-fwct36
## The agent door
- **machine_discoverability** 100/100. No AI crawler is blocked; a real browser is served normally. Sitemap lists 45 URLs including products. Three schema.org types published on the homepage. Catalogue answers as data at /products.json. llms.txt is published.
- **programmatic_onboarding** 7/100. No API documentation is linked from the homepage or published at standard paths. OAuth authorization metadata is published, which signals how a remote MCP server would authenticate, but there is no API surface to onboard to.
- **pricing_legibility** 90/100. 23 prices appear in the homepage HTML. 66 prices across 3 product pages without JavaScript. Product structured data publishes price, currency and availability. An agent can parse cost and stock status without scraping.
- **agent_aware_instrumentation** 69/100. No MCP manifest at the 3 standard paths. A Universal Commerce Protocol manifest is published at version 2026-08-25, declaring 8 capabilities and 2 payment handlers. A storefront MCP endpoint answers agent calls.
- **machine_fetchable_trust** 40/100. No security.txt file is published at /.well-known/security.txt. The homepage answers automated requests normally. No Web Bot Auth signals are present. The site publishes no machine-readable trust claims.
- **commercial_rails** 72/100. Product markup carries price, currency, identifier and brand on each item. Catalogue answers as data at /products.json with 12 products. Shopify platform supports standard agent checkout protocols.
## The human door
- **steps_to_first_value** 20/100. The primary call to action is 'Book a Demo', a sales route. It takes 2 steps from the homepage to reach the form. No product purchase path is discoverable without entering the sales funnel.
- **required_fields** 25/100. The entry point is a sales form with 1 field, 1 required: email address. No account system is needed to browse products, but the only path to adoption or purchase is gated by this single required field.
- **verification_walls** 65/100. No verification requirement appears on the signup page. The email field carries validation rules but no CAPTCHA, phone verification or email confirmation step is enforced before the form submits.
- **error_recovery** 80/100. 1 of 1 inputs on the entry form carry validation rules. 2 live regions are present to announce errors. No inline error containers are marked up, so error messages may not be associated with fields.
---
Scored by SecondDoor. Method: https://www.seconddoor.io/methodology
Scan another site: https://www.seconddoor.io
Rate an issue or this report: POST https://www.seconddoor.io/api/feedback, or the rate_fix tool on https://www.seconddoor.io/api/mcp