Agentic Readiness Scanner
Enter your store's domain. You get a score from 0 to 100 for what AI agents can read and act on from outside your store, what to fix, and a poppy.json you can publish today.
Requires server-side or edge telemetry
These can't be checked from outside a store, by this scanner or any other.
- Agent browsers that don't name themselves. They load pages like a person in an ordinary browser. Telling them apart takes their behaviour on your pages, which only a script on your store sees.
- Web Bot Auth signatures. A signed agent signs each request it sends to your store, so the signature can only be checked in your store's request path.
- Orders placed in an agent's own checkout. They never load your storefront. They show up in your order data, which no outside scanner can read.
Meta's Muse is one of the agents in the first group: Amazon blocked Meta's Muse agent from shopping on Amazon.com in September, saying it doesn't identify itself when it browses.
Tactical runs on your store. Agent browsers that don't name themselves are scored on behaviour, and AI crawlers are recorded page by page once you add the WooCommerce plugin, the Cloudflare connection or the Node middleware. Scout is free.
What it checks
| Check | What it looks for | Points |
|---|---|---|
| Personal Agent Protocol | A discovery document at /.well-known/poppy.json that meets draft 0.1 |
20 |
| Agent checkout profile | A UCP profile at /.well-known/ucp with a checkout capability |
15 |
| AI crawler access | Whether robots.txt lets AI search and user-triggered crawlers read your homepage and a product page | 20 |
| llms.txt | A /llms.txt with a title and links |
10 |
| Product structured data | Product JSON-LD with price, currency, availability, rating, brand and a GTIN or MPN | 20 |
| Product page without JavaScript | The price, name and reviews in the HTML your server sends | 15 |
The score counts the checks that could run. If we can't find or load a product page, or a file doesn't answer within 5 seconds, that check is left out rather than scored as zero. The exception is robots.txt: crawlers treat one that doesn't answer as "keep out", so that counts.
Blocking AI training crawlers doesn't cost points: that's your choice to make, and it doesn't stop you being cited in AI answers.
How a scan works
- Up to eight requests from our server: robots.txt, poppy.json, the UCP profile, llms.txt, your homepage, one product page, and your sitemap if the homepage doesn't link to a product we recognise.
- The scanner identifies itself as
TacticalScanner/1.0and follows your robots.txt for your homepage and product page. - HTTPS only, at most 2 redirects, and 5 seconds and 1 MB per file. It never submits a form or adds anything to a cart.
- A domain scanned in the last 24 hours gets the same result back.
About poppy.json
The Personal Agent Protocol is a draft open standard from Sierra and Meta for how a person's AI assistant signs in to a business and gets a task done. Its discovery document lives at /.well-known/poppy.json. Under draft 0.1, organization.domain must be the host that serves the file, after any redirects, and every redirect must stay on HTTPS.
The document the scanner generates is the minimal valid one: your store's name and domain, and an empty web object. It tells agents they may browse as signed-out visitors, and it needs no sign-in server. Signing agents in to customer accounts takes an OAuth issuer, which a static file can't provide. The draft may change before version 1.0.
What we keep
The domain, the result and the generated document, for 180 days. Nothing about who ran the scan: the rate limit uses a one-way hash of your IP address, held for the length of the limit window and never written to our database.