Let Agents In

Agent readiness · namecheap.com

2026-08-12 10:21 UTC · formula v9.2 · 5.4s

Your edge refuses ordinary HTTP from a data centre, agent or not.

GET https://namecheap.com/ answered 403 to LetAgentsIn/1.0 and 403 to a Chrome user-agent. Both were refused, so this is your WAF rejecting the network we scan from rather than a rule about agents. Everything below was measured through that wall.

4/ 8

A dashed column is a stage we could not measure, not a stage you failed.

A · Discovery
2/4
B · Agent entry
2/2
C · Registration
n/m
D · Provisioning
n/m
E · Integration
0/2

of the 8 points that apply to you and we could measure · 9 of 17 were not scored

You 4 · category median 5 · best name.com 10 · 15 deterministic HTTP checks, published formula

Pass it onEmail itLinkedIn

A challenge, not a limit

Your edge answered 403 and asked the caller to run JavaScript to prove it is a browser. A person never sees it. No agent can pass it, because an agent is an HTTP client, so this is the one wall on this page that stops the funnel before any of it starts. We score it rather than excusing it as our own traffic: everything below was measured through it and is a floor, not a ceiling.

Fix this first

+3points, taking 4/8 to 7/8, past inwx.com, dynadot.com, netim.com

This is the whole list: everything we could measure and you do not pass. Another 9 points sit behind checks we could not evaluate on your domain, and each of those lines below says what would make it measurable.

  1. 1
    llms.txt publishedminutes · +1

    Publish /llms.txt: a markdown list linking your quickstart, API reference, pricing and package name. It is the cheapest file on this list.

  2. 2
    Typed SDK on the registryan afternoon · +1

    Ship types with node-vault-client, declared through the exports map. Types are how an agent checks its own work.

  3. 3
    Machine-readable API descriptionan afternoon · +1

    Publish an OpenAPI file at /openapi.json, or serve markdown when a client sends Accept: text/markdown. Either one stops agents guessing your API.

Then, when you have room

  • Answers an agent user-agent a project · +1Your public pages answer 403 to Chrome and 403 to an agent user-agent. Exempt them from that rule and rate limit instead of refusing.

Take it with you

5 of the checks an agent depends on, namecheap.com does not pass.

Send yourself the list above with the checks that cost the most, and a permanent link. Whoever owns the fix is usually not the person who ran the scan.

One email with the report, and one follow-up asking what you did with it. No newsletter, no sequence. Delete on request at hello@letagentsin.com.

None of this tells you whether an agent picked you

Everything above is a file an agent could read. Whether one actually chose you is a different measurement, and we have not run it on namecheap.com. What we have run it on is a rich text editor vendor: six agents, one brief, six isolated copies of a real codebase. All six picked the same competitor, and the vendor being studied was never named, not even on a rejection list, while the runs named and dismissed ten alternatives between them. In an earlier round, run before we isolated the copies, it was named twice and struck off both times in four words: Fully commercial, licence key required. That study is about them, not about you. It is here because it is the difference between a file and a decision.

Read the audits in fullWhat the same run on namecheap.com costs

Against domain registration and dns

You are 5 of 11 in a category where a developer is trying to register a domain and point it somewhere with nobody at the keyboard.

  1. 1
    name.com
    10/13
  2. 2
    inwx.com
    6/11
  3. 3
    porkbun.com
    8/15
  4. 4
    dnsimple.com
    8/16
  5. 5
    namecheap.comyou
    4/8
  6. 6
    dynadot.com
    6/13
  7. 7
    netim.com
    5/11
  8. 8
    gandi.net
    5/13
  9. 9
    njal.la
    5/13
  10. 10
    godaddy.com
    3/8
  11. 11
    hover.com
    3/11

Where competitors pass and namecheap.com does not

  • Answers an agent user-agentporkbun.com · dynadot.com · name.com · gandi.net · dnsimple.com · hover.com · inwx.com · netim.com · njal.la
  • llms.txt publishedporkbun.com · dynadot.com · name.com · godaddy.com · inwx.com
  • Typed SDK on the registryname.com · gandi.net · dnsimple.com · inwx.com
  • Machine-readable API descriptionporkbun.com · name.com · godaddy.com

Only domains we have actually scanned appear here, so the ranking is a floor: a competitor missing from the list has not been measured, not beaten.

By stage

A
DiscoveryCan an agent find and read you?
2/4
B
Agent entryIs there a door built for a machine?
2/2
C
RegistrationCan an agent get an account?
not measured
D
ProvisioningCan it get credentials without a human?
not measured
E
IntegrationCan it ship working code?
0/2

Every check

Each line is one HTTP observation with a published rule, so you can rerun any of them yourself. Most are the same tomorrow if you are: the two that are not are the bot gate and the pricing page, which answer inconsistently on their own, which is why those run more than once and say so when the tries disagreed. PASS and PART are counted. UNMEASURED means we could not evaluate it, N/A means it does not apply to a product like yours, and neither is in the score or its denominator. See the formula

A · Discovery

  • FAIL
    Answers an agent user-agentAnswered 403 to LetAgentsIn/1.0 (+https://letagentsin.com/methodology) with a JavaScript challenge from your edge, so no agent reaches the site at allAn agent sends HTTP with its own user-agent, not a browser fingerprint. A 403 here ends the funnel before any of it starts.
  • FAIL
    llms.txt publishedNo llms.txt at any of the 3 locations probedA curated map of your docs is the cheapest way to control what an agent reads first. Worth one point and not more: in eighteen isolated agent runs across four categories, not one cited llms.txt among its sources, and an independent ninety-day measurement published by Otterly in February 2026 found it served 84 requests against 62,100 AI-bot visits.
  • UNMEASURED
    Docs readable without JavaScriptUnmeasurable: no documentation page could be found to readLink your documentation from your home page or list it in llms.txt.
  • PASS
    On-demand agents not blockedNo on-demand agent is blocked
  • N/A
    Paths robots.txt points at answerrobots.txt names no concrete path, only patterns or nothing, so there is no claim to check
  • PASS
    No punishing crawl delayNo Crawl-delay applies to the agents we check

B · Agent entry

  • UNMEASURED
    Agent entry pointUnmeasurable: 5 of the 9 known agent entry paths answered with a refusal rather than a file or a 404, so what you publish there is not something we measuredLet ordinary HTTP reach these paths and this becomes measurable.
  • PASS
    OAuth dynamic client registrationregistration_endpoint published, but none of the 2 advertised grants (authorization_code, refresh_token) finishes without a person at a browser
  • PASS
    MCP surfaceLive MCP endpoint at https://mcp.namecheap.com/mcp, answered 401 with an auth challenge

C · Registration

  • UNMEASURED
    No CAPTCHA in the signup HTMLUnmeasurable: the signup form at https://namecheap.com/signup is not in the server HTML, so its gates are not eitherServer-render the form, or tell us the endpoint it posts to, and the gates become visible to us and to an agent.
  • UNMEASURED
    Signup reachable without a browserUnmeasurable: https://namecheap.com/signup answers 403 to an agent and 403 to a Chrome user-agent, so nothing gets in from here and the difference we test for cannot be seenNothing for you to do here. It becomes measurable from a network your edge admits.

D · Provisioning

  • UNMEASURED
    Programmatic key provisioningUnmeasurable: we could not read a single documentation page, so there was nothing to look inLink your API reference from your docs index or from llms.txt and this becomes measurable.
  • UNMEASURED
    Free tier or no-card trial stated in textUnmeasurable: no pricing page could be fetchedLink a pricing page from your home page, or list one in llms.txt.

E · Integration

  • FAIL
    Typed SDK on the registrynode-vault-client ships without bundled types, matched from the registry by who publishes it rather than by a link on your siteTypes are how an agent checks its own work before you ever see the code.
  • FAIL
    Machine-readable API descriptionNo OpenAPI spec at the 5 usual paths, none declared by https://www.namecheap.com, and no markdown negotiationAn OpenAPI file or markdown negotiation lets an agent read your API instead of guessing it.Point at your spec from your docs page with rel="service-desc" and an agent finds it without guessing.

What we discovered on the way

Docs
not found
Pricing
not found
Signup
https://namecheap.com/signup · guessed path
npm package
node-vault-client (registry guess)
GitHub
not found
Package licence
Apache-2.0
Crawl-delay
none
Content-Signal
none
Blocked on-demand agents
none