The signup and credential path, measured
When a developer says “add file uploads”, an agent picks the provider, reads the docs, and writes the integration. Google and Cloudflare will both tell you for free whether your documentation is machine readable. Neither asks the next question, which is the one all eighteen of our agent runs died on: can an unattended client register and get a key?
Of 170 vendors we have scanned, 88 serve a signup form that renders nothing without JavaScript, which an agent reads as a page with no way in. Outright refusals aimed at agents are rarer than the noise around them suggests, and we say so rather than counting every 403 our data centre collects.
Your scan gets a permanent link you can forward. It is never added to the published corpus, and we do not post it anywhere.
Free. No account. Reads only what you publish.
Eighteen runs in isolated copies of a real application, across the four categories we have run agents in. In the three that need an account, every run stopped at the signup form and said so in its own words. In the fourth no account was needed and the barrier still appeared, earlier: a required licence key struck vendors off during dependency research, before their product was opened.
In one study the cheaper model fetched no external source in ten runs and said so: own knowledge only. In another, where the choice turned on a licence, every run fetched sources including all of the cheaper ones. A decision that cannot be answered from memory is what makes your documentation get read.
The app already had a session cookie. Adopting that provider meant running a second identity system just to upload a file, and three separate runs rejected it in almost the same words.
One provider was never selected, yet was considered and dismissed in nineteen of twenty runs, always because it assumes a framework the project did not use. One documentation chapter fixes it.
Thirty-eight runs across five studies, with the limits of each one stated. Read the method
170 domains · every result is a live link
Ordered by the share of measurable points each domain earned, which is why a smaller number can sit above a larger one. These are real scans, not examples. Each vendor can open its own scorecard, reproduce every check and tell us where we are wrong. That offer is the whole point of publishing the formula. Scores are out of the points we could measure on each domain, not out of sixteen: a site that refuses our requests scores against a smaller denominator, not a worse number.
6 more in this category, all of them in the data.
5 more in this category, all of them in the data.
4 more in this category, all of them in the data.
3 more in this category, all of them in the data.
2 more in this category, all of them in the data.
2 more in this category, all of them in the data.
2 more in this category, all of them in the data.
2 more in this category, all of them in the data.
2 more in this category, all of them in the data.
2 more in this category, all of them in the data.
1 more in this category, all of them in the data.
1 more in this category, all of them in the data.
1 more in this category, all of them in the data.
1 more in this category, all of them in the data.
1 more in this category, all of them in the data.
1 more in this category, all of them in the data.
1 more in this category, all of them in the data.
1 more in this category, all of them in the data.
1 more in this category, all of them in the data.
1 more in this category, all of them in the data.
1 more in this category, all of them in the data.
1 more in this category, all of them in the data.
1 more in this category, all of them in the data.
1 more in this category, all of them in the data.
1 more in this category, all of them in the data.
Most scanners stop at whether you publish a file. The interesting failures happen further down the funnel, where an agent has already chosen you and still cannot finish.
A dashed column is a stage we could not measure, not a stage you failed.
What the five stages look like on one real domain
name.com 10 / 13 · current leader in domain registration and dns
What a machine can see
15 deterministic checks across the five stages, 17 points on paper. Published formula, reproducible result, no model involved. Runs in under a minute.
You are scored out of what we could measure on your domain, not out of 17. Across the 170 domains scanned here that averages 14 points, and only 1 could be measured in full.
Your scan gets a permanent link you can forward. It is never added to the published corpus, and we do not post it anywhere.
What an agent actually does
Real agents, real runs, recorded. Which provider they pick over you and in which words they reject you. Then the fix list, and a re-measure to prove it moved.
This is the part no scanner can give you, because it is a measurement of behaviour, not of files. One brief costs $2,900 and a full study $11,000, both scoped before you pay.
What the audit includesRun by Krystian Gwizdała. The scanner, the formula, the agent runs and every number on this site are mine, and an audit is run by me rather than by a team you never meet. Four audits are published in full so you can see the work before deciding whether it is worth anything to you.