360 check, 10 Nov 2026
Aldi on the pay layer: the 360 agent-readiness check
In short
Aldi scores 38 of 100 on Ora's agent-readiness scan, a D, read 14 Nov 2026. The six payment checks did not apply to aldi.us on this read, which is how Ora treats a site it does not read as a shop. The grocer challenges six crawlers; the GraphQL endpoint behind them asks for a key.
On 14 Nov 2026 the public site at aldi.us scored 38 of 100 on Ora's agent-readiness scan, a D. Aldi is the German discount grocer's US arm, so this check reads the Payments layer first: the six checks that look for x402, MPP, UCP, ACP and AP2 on the domain, the same protocols this site's matrix tracks row by row. The other layers follow, with every check Ora ran and what it saw. Ora's one-line summary: ALDI.us offers OAuth 2.0 support, but lacks an OpenAPI specification.
The score
| Layer | Points | Share | What the layer asks |
|---|---|---|---|
| Discovery | 6 of 11 | 55% | Can agents find and recommend it |
| Access | 10 of 49 | 20% | Can agents read it |
| Usability | 29 of 68 | 43% | Can agents use it |
| Payments | 0 of 0 | none apply | Can agents pay |
| Total | 38 of 100 | 38% | Grade D |
The pay layer
Ora did not run the six payment checks against aldi.us on this read: it marks them not applicable on a site it does not read as a shop, so the layer has no maximum and costs nothing. A retailer that sells online can still publish any of the five protocols; the matrix says which processors and platforms carry each one. Each protocol links to its matrix row, where the processors and platforms that carry it are dated and sourced.
| Payment check | Result | Points | Matrix row | What Ora saw |
|---|---|---|---|---|
| x402 | Does not apply | 0 of 2 | x402 in the matrix | No x402 payment protocol support detected |
| MPP | Does not apply | 0 of 2 | MPP in the matrix | No MPP (Machine Payments Protocol) support detected |
| UCP | Does not apply | 0 of 3 | UCP in the matrix | no UCP (Universal Commerce Protocol) signals detected |
| ACP | Does not apply | 0 of 3 | ACP in the matrix | no ACP (Agentic Commerce Protocol) signals detected |
| ACP delegate payment | Does not apply | 0 of 3 | ACP in the matrix | No ACP Delegate Payment signals detected |
| AP2 | Does not apply | 0 of 3 | AP2 in the matrix | No AP2 (Agent Payments Protocol) signals detected |
The other layers, check by check
Every check Ora ran on aldi.us, grouped by layer, with the result, the points and what Ora recorded where its wording passes this site's gate.
Discovery: 6 of 11
| Check | Result | Points | What Ora saw |
|---|---|---|---|
| ARD discovery | Fail | 0 of 1 | No /.well-known/ard.json (and no legacy /.well-known/ai-catalog.json) |
| Developer resource discoverability | Fail | 0 of 3 | Agent searched for "aldi" developer resources but found nothing relevant |
| Brand name discoverability | Pass | 3 of 3 | aldi.us appears at position #3 in a clean brand-name search for "ALDI Grocery Stores" (2 total matches) |
| Wikipedia / Wikidata entity presence | Partial | 2 of 4 | Wikipedia "Aldi" verified - create a Wikidata item with P856 (official website) = aldi.us to complete knowledge graph coverage |
| robots.txt AI crawler policy | Partial | 1 of 2 | Training: 0/2. Search: 1/3 page/crawler pairs permitted. robots.txt restricts 4/5 evaluated page/crawler pairs. Checked 5 training and search crawlers (gptbot, claudebot, oai-searchbot, claude-searchbot |
| Agent platform configs | Fail | 0 of 1 | Could not locate a public repo containing agent configs or rules. If our probes missed it, AI coding agents likely will too - link the repo from your homepage or docs so it's discoverable. |
| Agent Plugins manifest | Fail | 0 of 1 | No Agent Plugins manifest (plugin.json) found in discovered repos |
| Listed on skills.sh | Fail | 0 of 1 | No official skills self-published on skills.sh (100 community skills with potential relation to this domain found, but only self-published official skills count) |
| ChatGPT app listed | Fail | 0 of 2 | Not found in ChatGPT app directory |
Access: 10 of 49
| Check | Result | Points | What Ora saw |
|---|---|---|---|
| Sitemap exists | Pass | 2 of 2 | Valid sitemap found at https://www.aldi.us/sitemaps/storefront_pro/www_aldi_us/sitemap.xml with multiple sitemaps entries |
| Content without JavaScript | Partial | 2 of 3 | 1395 chars with H1, but 1.6% content ratio is below the 5% target |
| Not blocked by bot detection | Partial | 0 of 2 | Bot management challenged GPTBot, ClaudeBot, ChatGPT-User, PerplexityBot, Google-Extended, Applebot-Extended. A challenge is an identity check that verified crawlers pass |
| Agent discovery file | Fail | 0 of 2 | No agent discovery file found |
| A2A / agent-card | Fail | 0 of 2 | No A2A agent card found at /.well-known/agent-card.json |
| pricing.md exists | Fail | 0 of 2 | No pricing.md found - agents need machine-readable pricing to compare products and make purchase recommendations |
| NLWeb Schema Feeds | Fail | 0 of 1 | No schemamap: directive in robots.txt |
| MCP well-known discovery | Fail | 0 of 2 | No MCP server URL discovered |
| Agent mode view | Partial | 1 of 2 | Agent mode view found at ?mode=agent (3 signals: api, agent, integration) |
| HTTP Link headers (RFC 8288) | Fail | 0 of 1 | No HTTP Link response headers (RFC 8288) found |
| Markdown URL fallback | Fail | 0 of 2 | Homepage does not support the .md suffix. Probed https://aldi.us/index.md and it did not return markdown (expected text/markdown content-type or a heading-led non-HTML body). |
| Modular llms.txt per product area | Fail | 0 of 1 | No section-level llms.txt files found (optional) |
| Sitemap freshness (lastmod) | Pass | 1 of 1 | Pass, no detail recorded. |
| robots.txt agent-user policy | Partial | 1 of 2 | robots.txt restricts 2/3 evaluated page/crawler pairs. Checked 3 user-triggered agents (chatgpt-user, claude-user, perplexity-user) on 1 public page. Restricted: claude-user at https://aldi.us/ (Disallow: /, line 549) |
| llms.txt exists | Fail | 0 of 1 | No llms.txt found at /llms.txt or /.well-known/llms.txt. |
| llms.txt formatting | Fail | 0 of 2 | No llms.txt found to evaluate quality |
| JSON-LD structured data | Fail | 0 of 4 | No JSON-LD structured data found on homepage |
| Pricing info accessible | Fail | 0 of 3 | No pricing page or pricing data found |
| Public API/docs linked from homepage | Fail | 0 of 3 | No public API or documentation page linked from homepage |
| Agent instruction / when-to-use | Fail | 0 of 3 | No agent instruction file with when-to-use guidance found |
| Skills.sh skill quality | Fail | 0 of 2 | No official skills on skills.sh to evaluate |
| JSON-LD entity linking (sameAs) | Fail | 0 of 2 | No JSON-LD found - no entity linking possible |
| Metadata completeness | Partial | 1 of 2 | 2/4 metadata signals present - missing: og:image, og:type |
| Organization schema completeness | Fail | 0 of 2 | No JSON-LD found - Organization schema missing |
| Schema type breadth | Fail | 0 of 2 | No extended schema types found - AI can only answer basic questions about this entity |
| Trust anchor pages | Partial | 1 of 2 | About, Privacy pages verified - missing: Contact |
| Markdown alternate link | Fail | 0 of 1 | No sampled page advertises a markdown alternate. Add <link rel="alternate" type="text/markdown" href="..."> (or the equivalent Link response header) pointing at a markdown twin of the page. |
| Redirect hygiene | Pass | 1 of 1 | Pass, no detail recorded. |
| Page token budget | Pass | 1 of 1 | All 1 measured page fit an agent context budget (largest ~1K tokens) |
| OpenAPI spec published | Fail | 0 of 7 | No OpenAPI/Swagger specification found |
| API catalog (RFC 9727) | Fail | 0 of 2 | No /.well-known/api-catalog found (RFC 9727) |
| Markdown agent docs | Fail | 0 of 1 | Missing markdown content negotiation. Homepage returned text/html when probed with Accept: text/markdown (expected text/markdown), and none of the well-known root paths (/llms.md, /auth.md, /agents.md, /developers.md |
| Markdown content negotiation (acceptmarkdown.com) | Fail | 0 of 1 | Homepage https://aldi.us does not meet the Markdown negotiation requirements: Accept: text/markdown returned text/html; charset=utf-8; Vary header missing Accept (got "none") |
| Bot-UA markdown serving | Fail | 0 of 1 | No probed bot User-Agent (GPTBot, ClaudeBot, ChatGPT-User, PerplexityBot, Google-Extended, Applebot-Extended, ora-agent, DeepSeekBot) receives markdown when requesting HTML. |
| Agent crawler reachability | Partial | 0 of 2 | Bot management challenged ChatGPT-User, ClaudeBot, Google-Extended - a challenge is an identity check verified crawlers pass, so reachability is undetermined rather than blocked (ChatGPT-User: challenged |
Usability: 29 of 68
| Check | Result | Points | What Ora saw |
|---|---|---|---|
| Public API with reachable endpoints | Pass | 7 of 7 | GraphQL endpoint at https://aldi.us/graphql is reachable; introspection requires authentication (API key / OAuth), which is expected for agent access. Best-of-protocols score: 7/7. |
| OAuth 2.0 support | Pass | 5 of 5 | OAuth endpoint found at https://aldi.us/oauth/authorize |
| Scoped permissions | Fail | 0 of 5 | No declared OAuth scopes, security schemes, or scoped-permission documentation found |
| Agent onboarding friction | Partial | 1 of 2 | Onboarding signals described but not verified live: self-serve key generation |
| Web Bot Auth directory | Fail | 0 of 2 | No /.well-known/http-message-signatures-directory found |
| OAuth Protected Resource metadata (RFC 9728) | Fail | 0 of 2 | No /.well-known/oauth-protected-resource found (RFC 9728) |
| auth.md exists | Fail | 0 of 2 | No /auth.md found at site root |
| auth.md structure | Fail | 0 of 2 | No /auth.md found at site root |
| Agent auth discovery metadata | Fail | 0 of 3 | Neither /.well-known/oauth-protected-resource nor /.well-known/oauth-authorization-server found. Probed: aldi.us, api.aldi.us. |
| Agent auth WWW-Authenticate hint | Fail | 0 of 1 | No 401 with WWW-Authenticate: Bearer resource_metadata=... found. Probed [https://aldi.us/api, https://aldi.us/api/v1, https://aldi.us/v1, https://aldi.us/v2, https://aldi.us/agent/identity, https://aldi.us/agent/auth |
| agent_auth endpoints reachable | Fail | 0 of 2 | No agent_auth endpoint URIs found in AS metadata or /auth.md prose; nothing to probe |
| MCP server / manifest | Fail | 0 of 6 | No MCP server or manifest found |
| WebMCP support | Fail | 0 of 5 | No WebMCP support detected - no tool-attribute forms and no document.modelContext / navigator.modelContext usage found |
| Rate limit response headers | Fail | 0 of 2 | GraphQL introspection auth-gated and no header convention documented on GraphQL-tagged pages |
| Idempotency-Key support | Fail | 0 of 3 | GraphQL introspection auth-gated and no idempotency documentation found on GraphQL-tagged pages |
| JSON error responses | Pass | 4 of 4 | Pass, no detail recorded. |
| NLWeb /ask endpoint | Pass | 1 of 1 | NLWeb /ask endpoint exists but requires authentication (HTTP 403, via POST) |
| NLWeb streaming support | Fail | 0 of 1 | NLWeb /ask requires authentication - cannot verify streaming |
| MCP server-card.json | Fail | 0 of 2 | No MCP server card found at /.well-known/mcp/server-card.json |
| Product + docs MCP coverage | Fail | 0 of 2 | This bonus needs two MCP servers: one for your product so agents can take actions, and a separate one for your documentation so agents can answer questions from your docs. |
| Sandbox / test environment | Fail | 0 of 2 | No sandbox or test environment found |
| GraphQL typed error model | Fail | 0 of 3 | GraphQL introspection auth-gated and no typed graphql error model documentation found on GraphQL-tagged pages |
| GraphQL versioning / deprecation policy | Fail | 0 of 2 | GraphQL introspection auth-gated and no graphql versioning / deprecation policy documentation found on GraphQL-tagged pages |
| GraphQL pagination pattern | Fail | 0 of 2 | GraphQL introspection auth-gated and no graphql pagination pattern documentation found on GraphQL-tagged pages |
| GraphQL async-job pattern | Fail | 0 of 2 | GraphQL introspection auth-gated and no graphql async-job pattern documentation found on GraphQL-tagged pages |
| Accessible document structure | Pass | 3 of 3 | Pass, no detail recorded. |
| Native interactive controls | Pass | 3 of 3 | Pass, no detail recorded. |
| Accessible names on controls | Pass | 2 of 2 | Pass, no detail recorded. |
| Form control labeling | Pass | 2 of 2 | Pass, no detail recorded. |
| Accessibility-tree injection safety (bonus) | Pass | 2 of 2 | Pass, no detail recorded. |
| MCP Apps support | Fail | 0 of 4 | No MCP Apps support detected - this product has an in-agent UI surface but exposes no ui:// resources or tool UI metadata for agents to render. |
| A2UI / generative UI support | Fail | 0 of 2 | No A2UI or generative UI support detected |
| API schema complexity analysis | Fail | 0 of 2 | GraphQL: introspection auth-gated and no schema evidence in docs |
| Function calling compatibility | Fail | 0 of 2 | No API spec found - function calling requires discoverable endpoints |
The fixes worth most points
Ora attaches an estimate to each failing or partial check: how many points the site would gain by passing it. These are the 5 with the largest estimates for Aldi.
- Developer resource discoverability
- Fail, 0 of 3, about 6.1 points to gain. Ora saw:
Agent searched for "aldi" developer resources but found nothing relevant
. - OpenAPI spec published
- Fail, 0 of 7, about 4.8 points to gain. Ora saw:
No OpenAPI/Swagger specification found
. - MCP server / manifest
- Fail, 0 of 6, about 3.9 points to gain. Ora saw:
No MCP server or manifest found
. - Scoped permissions
- Fail, 0 of 5, about 3.3 points to gain. Ora saw:
No declared OAuth scopes, security schemes, or scoped-permission documentation found
. - WebMCP support
- Fail, 0 of 5, about 3.3 points to gain. Ora saw:
No WebMCP support detected - no tool-attribute forms and no document.modelContext / navigator.modelContext usage found
.
Our read
Aldi's US site did not read as a shop to Ora: the six payment checks did not apply on this read, so the pay layer is 0 of 0. The door is the story. Bot management challenged GPTBot, ClaudeBot, ChatGPT-User, PerplexityBot, Google-Extended and Applebot-Extended, and robots.txt permits 1 of 3 search pairs, none of the training pairs, and restricts 2 of 3 pairs for the user-triggered agents. Behind it an agent reads 1,395 characters with an H1 at a 1.6 percent content ratio, a valid sitemap, 2 of 4 metadata signals and no JSON-LD; no content pages were sampled, so those rows are unverified rather than failed. The act layer is better than the door: a GraphQL endpoint at aldi.us/graphql asks for a key, OAuth lives at /oauth/authorize, and an NLWeb /ask endpoint sits behind a 403. A search for Aldi's developer resources found nothing, the fix worth most at about 6 points. A D at 38 that shuts the door on the agents who would read the shelves.
Test your own checkout
The scan above is free and needs no account: enter a domain at ora.ai and read the same layers for your own site, with the six payment checks mapped to this matrix on the Ora Payments page. The command below runs the same audit from a terminal and exits with 1 under the score you set, so it can gate a deploy. Why Ora, and its limits.
npx ax@0.10 audit https://example.com --min-score 70All 360 checks, one company a day. Corrections to the corrections page.
Sources
- ora.ai/api/score/aldi.us, Ora's scan (vendor), read 14 Nov 2026
- Ora check catalog (GET /api/checks), read 14 Nov 2026
- aldi.us, the company's site, read 14 Nov 2026
Last reviewed