How we score

Grades

• 90–100AAgent-native
• 75–89BMostly ready
• 60–74CVisible but losing deals
• 40–59DPartially invisible
• 0–39FInvisible to agents

A Structured product data 25 pts

• A1A valid Product JSON-LD block is present on the product page.6
• A2The offer carries both a price and a priceCurrency.5
• A3availability is present and is a real schema.org ItemAvailability value.3
• A4At least one of sku, gtin (any length), isbn or mpn is present.3
• A5A brand is present, as a string or a Brand object.2
• A6At least one image is listed and at least one is an absolute URL.2
• A7A description longer than 50 characters is present.2
• A8An aggregateRating or at least one review is present in the product JSON-LD. Ratings injected by a client-side review widget score zero, because we do not execute JavaScript.1
• A9Variants are exposed via hasVariant or more than one offer.1

B Catalog & feed availability 15 pts

• B1The sitemap is reachable and is a real sitemap — a urlset or sitemapindex document, not an HTML page. We read the one /robots.txt declares, or /sitemap.xml when it declares none.3
• B2A product-specific sitemap exists, identified by its filename.3
• B3A machine-readable catalogue endpoint responds — /products.json or /collections/all/products.json. A Sitemap: line in robots.txt does not count.5
• B4The newest lastmod in the sitemap is within 30 days of the scan time.2
• B5At least one product URL is discoverable from the sitemap.2

C Agent access policy 20 pts

• C1robots.txt is reachable and parses.2
• C2Five points scaled by how many of the twelve AI shopping agents are allowed, plus three bonus points scaled by how many are named in an explicit Allow. Capped at eight. An agent that is both allowed and blocked counts as blocked.8
• C3Product URL paths are not disallowed for User-agent: *.4
• C4An llms.txt file is present at the site root.3
• C5The homepage returns real HTML to a plain request — not a 403, a bot challenge or a captcha.3

D Commerce signals 15 pts

• D1OfferShippingDetails structured data is present on the offer.4
• D2MerchantReturnPolicy structured data is present on the offer.4
• D3Shipping and returns policy pages are both linked from the homepage and reachable.3
• D4Stock status is machine-readable at product level.2
• D5At least one currency or region signal is present: priceCurrency, hreflang alternates, or areaServed.2

E Protocol & checkout readiness 10 pts

• E1An agentic commerce protocol marker is present — ACP, UCP, MPP or x402 — in a header, meta tag or link.4
• E2A UCP discovery document is published — /.well-known/ucp responds, or your robots.txt advertises it. That is the only agent discovery path we request; we do not probe for payment discovery endpoints.2
• E3The store runs on a recognised agent-connected platform (Shopify, BigCommerce, WooCommerce, Wix or Salesforce), on strong evidence such as a vendor CDN host or platform header.2
• E4An MCP endpoint is ADVERTISED — named in your UCP document, or /.well-known/mcp.json responds, or the homepage links to a documented developer or agent API. We read the advertisement and do not fetch the endpoint, because it commonly sits on a different domain that we will not crawl.2

F Non-JS accessibility 10 pts

• F1Product name AND price appear in the raw HTML from a source other than JSON-LD — microdata, a meta tag, or visible text.6
• F2The homepage returns 200 within at most two redirect hops.3
• F4The product page carries a canonical tag.1

G Identity & trust 5 pts

• G1Organization JSON-LD is present with both a name and a logo.2
• G2The homepage is served over valid HTTPS with no TLS error and no mixed content.1
• G3Contact information is discoverable — a mailto, a tel link, a contact page, or a schema.org contactPoint.1
• G4The brand name agrees across Organization.name, og:site_name and the page title.1

Confidence

Every result carries a confidence level, because a store we could not fully read should never be presented as if we had.

• High — we reached your homepage, robots.txt, sitemap and a product page, and nothing else failed.
• Medium — we reached the essentials but something non-critical failed.
• Low — we could not reach a product page or your homepage, or more than two things failed. The result page names exactly what.

A file that simply is not there — an llms.txt that returns 404, for example — is an absence, not a failure. We successfully determined it does not exist. The check scores zero; our confidence in the scan is unaffected.

Known limitations

Stated here rather than left to be discovered by whoever is disputing a score.

• A9 penalises genuinely simple products. A product with one size and one colour cannot expose variants, so it cannot earn this point. The check reflects product complexity as much as agent readiness. It is worth 1 point and we have kept it, but it is not clean and we are not pretending otherwise.
• E3 rewards your platform, not you. It credits running on a platform whose vendor is doing agent work. That is a procurement decision, not something your team built.
• On Shopify, C4 reflects the platform rather than you. Shopify generates an llms.txt for every store automatically. In our sample it was present on all six Shopify stores and absent from every other platform except one, so a Shopify merchant earns those 3 points without having done anything, and a merchant elsewhere who wrote one by hand earns the same 3. We have kept the check because one non-Shopify store in the sample did publish its own, which makes it a real merchant signal at least some of the time — but it is the same kind of compromise E3 is, and we would rather say so than let you find out.
• Some stores get no grade at all. If your site answers us normally and we still cannot find a product page — not blocked, not erroring, simply not discoverable in your sitemap, your product feed, or your homepage links — we show the category scores and no letter. A grade there would be us reporting the limits of our own crawler as a judgement about your store.
• A store that refuses the request keeps its grade. Some sites answer a 403 or serve a bot challenge instead of a page — including on robots.txt itself, which means they are not marked as blocking crawlers in the usual way. We report that plainly as a store we could not read, and the grade stands, because an AI shopping agent meets the same refusal we did. We show you how to unblock us and nothing else: a list of other fixes would be a list of work no agent will ever see.
• Category E measures emerging agentic commerce protocols. Most stores score 0 here today. This is expected. It means a realistic ceiling today is around 92 rather than 100, which is deliberate: an A should be hard.
• We do not execute JavaScript. A store whose products only appear after hydration scores as an agent would see it, because many agents do not run JavaScript either. That is the measurement, not a gap in it.
• Agent names are matched exactly. BlockingApplebot does not count as blockingApplebot-Extended; they are different tokens and we will not attribute a block you did not make.
• One retired check. F3 measured server response time. We removed it because a network latency measurement cannot be reproducible — the same store either side of the threshold would score differently. Its points moved to F1 and F2. We still measure response time and show it, clearly marked as not scored.

Platform points and your points

Some of your score is earned by your platform rather than by you. Shopify generates your sitemap and product feed, and ships an llms.txt to every store; a merchant on a custom stack has to build all of that. Those points are real — an agent genuinely reads a Shopify store more easily — but you did not do anything to earn them, and you cannot lose them without moving platform.

So your result separates them. From your platform is what your stack provides by default. From your store is what you built. Available to you is what you could still earn without replatforming.

Which checks count as platform-provided depends on the platform, not on the check. A machine-readable product feed is free on Shopify and real work on a custom stack, so the same check is attributed differently for two different stores — and our list of what each platform provides is verified against real captured stores rather than assumed. Where we cannot identify your platform, every point is attributed to you.

“Available to you” is deliberately conservative. We never offer a point your platform would have to provide, and we exclude checks whose applicability we cannot determine from the outside — a product with one size and one colour cannot expose variants, and a store with no reviews has none to mark up. If we cannot establish that anything is winnable, we show the fix list and no total rather than a number we cannot stand behind.

We withhold the whole breakdown for a store we could not read — one that blocks crawlers, or refuses our request with a 403 or a bot challenge. A total of points you could win is a promise that the work pays off, and until an agent can reach your store it is a promise about work nobody will ever see.

This is presentation, not scoring. The score itself is unchanged, and the number on your result page is the whole score including platform points. If our public leaderboard ever ranks on a different basis — for example on what each store earned itself, so a ranking cannot move because someone else’s vendor shipped a feature — the leaderboard will say so plainly.

How we crawl

We honour robots.txt strictly. If your robots.txt disallows us, we fetch robots.txt and nothing else from your domain. A store that blocks all crawlers is scored only on what is readable without visiting it, is labelled as blocked rather than simply scored badly, and is excluded from our public leaderboard entirely — ranking it against a fully-scanned store would compare different amounts of evidence.

Cartiq fetches only from the store’s own domain and its subdomains, and reads robots.txt for every host it touches. A link that leaves the store’s domain is never followed, so a store is never scored on a page that is not its own.

A scan makes at most 14 requests, spaced 500ms apart, within a 20 second budget. We respect Crawl-delay up to a 2 second cap; beyond that the 20 second budget wins and the result says so rather than silently scoring the dropped checks zero. Full crawler details and how to opt out.

Scores reflect public data only. Cartiq has no affiliation with, and no relationship to, the brands it scores.