Basic scanSoftware business · Marketing site/Scanned 3 Sept 2026, 19:31 UTC/1 browser pass
zapier.com
Zapier publishes prices and API documentation but blocks programmatic access to API keys, forcing agents into a manual signup flow.
Two issues, in priority order
Each one is drawn from evidence recorded during the walks.
2 pieces of evidence and the recommended fix are recorded for this issue.
We sent a buying agent
15 requests, in order
The agent got through 11 of 15 requests, but could not find a contact route for machines. It came up empty on 3 other checks too.
- 01reached
zapier.com
reach the site at all
- 02reached
/robots.txt
find out whether machines are welcome
- 03reached
zapier.com
ask whether the door opens for requests carrying the AI crawlers' names
- 04reached
/llms.txt
read the site's own guide for language models
- 05reached
/uag6x9zaeydnbfy75xsggcsb37h8cgzf-two-service-sitemap.xml
find out what pages exist
- 06not found
/.well-known/security.txt
find a contact route for machines
- 07reached
//docs.zapier.com/.well-known/mcp.json
find a published agent interface
- 08not found
/.well-known/ai-plugin.json
find an agent plugin manifest
- 09not found
zapier.com
find out whether verified agents are recognised
- 10reached
zapier.com
read the homepage as data rather than as a page
- 11not found
zapier.com
find a machine readable API spec
- 12reached
zapier.com
read the developer documentation
- 13reached
/pricing
read the prices without running JavaScript
- 14reached
zapier.com
find a comparison page worth citing
- 15reached
/sign-up
walk the way a visitor would, to a signup form or a product
Deep scans need an account. Accounts are free.
A deep scan walks the site with two agents, records cited evidence and screenshots, and keeps a mission timeline. It comes with the paid plans. Making an account costs nothing and gives you one basic scan a month.
Ten dimensions
Not measured is not zero.
The agent door
71 of 100What a machine can do on your site with nobody watching.
Machine discoverability
Whether a retrieval system can find and read you at all.
Robots.txt names 8 AI crawlers and allows them all. A real browser is served the page normally. Key pages (home, pricing, docs) are readable without JavaScript. Sitemap lists 1228 URLs. 8 schema.org types on the homepage.
4 observations recorded.
Programmatic onboarding
Whether an agent can get working access without a human.
Authentication is documented, endpoint examples are shown, code samples are provided.
3 observations recorded.
Pricing legibility
Whether total cost can be computed from published numbers.
3 prices are readable without JavaScript on the pricing page: Free, Professional at $19.99, and Team at $69. An enterprise tier routes to sales, which is standard practice. Prices are published as Offer structured data. Currency is USD.
1 observation recorded.
Agent-aware instrumentation
Whether you publish anything built for machine callers.
An MCP manifest is published at https://docs.zapier.com/.well-known/mcp.json. Robots.txt names 8 AI crawlers and allows them. Pricing.md publishes prices in machine readable form.
4 observations recorded.
Machine-fetchable trust
Whether terms, security and status are readable as text.
No security.txt is published at /.well-known/security.txt (404). The homepage answers automated requests normally. Structured data is present on the homepage. No Web Bot Auth signals are published.
2 observations recorded.
Commercial rails
Whether a purchase can complete without a sales call.
Prices are published in raw HTML on the pricing page. A self serve signup form is reachable from the homepage in 2 steps. Pricing.md is machine readable. Plans are published as Offer structured data.
2 observations recorded.
The human door
73 of 100What a first time visitor meets between landing and first value.
Steps to first value
How far a new visitor travels before something useful happens.
The primary call to action is 'Start free' on the homepage. The signup form is 2 steps away. The form contains 4 fields with 0 required. A visitor can enter an email and password or sign in with Google without friction.
1 observation recorded.
Required fields
How much you ask for before you give anything back.
The signup form contains 4 fields with 0 required. One sign in option is offered: Google. Of 13 total inputs on the form, 0 carry validation rules such as minlength, pattern, or required attributes.
1 observation recorded.
Verification walls
How many gates stand between intent and access.
No verification requirement appears on the signup page itself. Single sign on via Google avoids email verification entirely. The form does not ask for phone, credit card, or proof of identity.
1 observation recorded.
Error recovery
What happens when someone gets it wrong.
Of 13 inputs on the signup form, 0 carry validation rules. No inline error containers are present. 3 live regions are present on the page. A visitor who enters invalid data will not receive client side feedback before submission.
1 observation recorded.
Show the score
The badge always shows the latest scores for this domain and links back to the report. Put it in a README or a footer.
This number moves every time you deploy
SecondDoor rescans on a schedule and tells you the day a release closes a door. Watch the trend on the dashboard, or scan another site now.