360 check, 12 Nov 2026
Gap on the pay layer: the 360 agent-readiness check
Gap scores 40 of 100 on Ora's agent-readiness scan, a D, read 14 Nov 2026. The six payment checks did not apply to gap.com on this read, which is how Ora treats a site it does not read as a shop. 675 characters on the home page, no H1, and an llms.txt that serves HTML.
On 14 Nov 2026 the public site at gap.com scored 40 of 100 on Ora's agent-readiness scan, a D, in Ora's Consumer category. Gap is the US apparel retailer behind Gap, Old Navy and Banana Republic, so this check reads the Payments layer first: the six checks that look for x402, MPP, UCP, ACP and AP2 on the domain, the same protocols this site's matrix tracks row by row. The other layers follow, with every check Ora ran and what it saw. Ora's one-line summary: Gives agents little to work with: no WebMCP, no llms.txt, and product pages with almost no text without JavaScript.
The score
| Layer | Points | Share | What the layer asks |
|---|---|---|---|
| Discovery | 3 of 6 | 50% | Can agents find and recommend it |
| Access | 15.84 of 26 | 61% | Can agents read it |
| Usability | 4 of 17 | 24% | Can agents use it |
| Payments | 0 of 0 | none apply | Can agents pay |
| Total | 40 of 100 | 40% | Grade D |
The pay layer
Ora did not run the six payment checks against gap.com on this read: it marks them not applicable on a site it does not read as a shop, so the layer has no maximum and costs nothing. A retailer that sells online can still publish any of the five protocols; the matrix says which processors and platforms carry each one. Each protocol links to its matrix row, where the processors and platforms that carry it are dated and sourced.
| Payment check | Result | Points | Matrix row | What Ora saw |
|---|---|---|---|---|
| x402 | Does not apply | 0 of 2 | x402 in the matrix | No x402 payment protocol support detected. No commerce signals detected - agent-payment protocols are optional for non-commerce sites |
| MPP | Does not apply | 0 of 2 | MPP in the matrix | No MPP (Machine Payments Protocol) support detected. No commerce signals detected - agent-payment protocols are optional for non-commerce sites |
| UCP | Does not apply | 0 of 3 | UCP in the matrix | no UCP (Universal Commerce Protocol) signals detected. No commerce signals detected - agent-payment protocols are optional for non-commerce sites |
| ACP | Does not apply | 0 of 3 | ACP in the matrix | no ACP (Agentic Commerce Protocol) signals detected. No commerce signals detected - agent-payment protocols are optional for non-commerce sites |
The other layers, check by check
Every check Ora ran on gap.com, grouped by layer, with the result, the points and what Ora recorded where its wording passes this site's gate.
Discovery: 3 of 6
| Check | Result | Points | What Ora saw |
|---|---|---|---|
| ARD discovery | Fail | 0 of 1 | No /.well-known/ard.json, no same-site rel="ard" link, and no legacy /.well-known/ai-catalog.json |
| Brand name discoverability | Partial | 1 of 3 | gap.com ranks #9 for "Gap" (searched your brand name alone: no main product term from your homepage qualified) |
| robots.txt AI crawler policy | Pass | 1 of 1 | AI search crawlers: allowed in 3 of 3 checks (3 crawlers on 1 page). AI training crawlers: allowed in 2 of 2 checks (2 crawlers on 1 page), not scored. |
| Agent platform configs | Fail | 0 of 1 | Could not locate a public repo containing agent configs or rules. If our probes missed it, AI coding agents likely will too - link the repo from your homepage or docs so it's discoverable. |
| Agent Plugins manifest | Fail | 0 of 1 | No Agent Plugins manifest (plugin.json) found in discovered repos |
| ChatGPT app listed | Fail | 0 of 2 | Not found in ChatGPT app directory |
| Homepage not hidden from search | Pass | 1 of 1 | No noindex on the homepage: no robots, googlebot or bingbot meta tag and no X-Robots-Tag header hides it from search. |
Access: 15.84 of 26
| Check | Result | Points | What Ora saw |
|---|---|---|---|
| Sitemap exists | Pass | 1 of 1 | Valid sitemap found at https://www.gap.com/native-sitemap.xml with multiple sitemaps entries |
| Content without JavaScript | Partial | 1.67 of 5 | Homepage: 675 chars of readable text, but no H1 tag. Sampled pages with almost no text without JavaScript (5 of 5): https://www.gap.com/browse/accessories (62 chars) |
| Not blocked by bot detection | Pass | 2 of 2 | Site accessible to 4 agent user-agents (ChatGPT-User, OAI-SearchBot, Claude-User, PerplexityBot). |
| Agent discovery file | Fail | 0 of 2 | No agent discovery file found |
| A2A / agent-card | Fail | 0 of 2 | No A2A agent card found at /.well-known/agent-card.json |
| Listed on skills.sh | Fail | 0 of 1 | No official skills self-published on skills.sh (100 community skills with potential relation to this domain found, but only self-published official skills count) |
| pricing.md exists | Fail | 0 of 2 | No pricing.md found - agents need machine-readable pricing to compare products and make purchase recommendations |
| NLWeb Schema Feeds | Fail | 0 of 1 | No schemamap: directive in robots.txt |
| MCP well-known discovery | Fail | 0 of 2 | No MCP server URL discovered |
| HTTP Link headers (RFC 8288) | Fail | 0 of 1 | Link header present but no agent-relevant rel values (sitemap, describedby, alternate, service-desc) |
| Markdown URL fallback | Fail | 0 of 2 | Homepage does not support the .md suffix. Probed https://gap.com/index.md and it did not return markdown (expected text/markdown content-type or a heading-led non-HTML body). |
| Modular llms.txt per product area | Fail | 0 of 1 | No section-level llms.txt found. Tried /docs/llms.txt, /api/llms.txt, /developers/llms.txt, /guides/llms.txt, /reference/llms.txt. This is a bonus check: it can add a point and never costs one. |
| robots.txt agent-user policy | Pass | 1 of 1 | No applicable crawl or usage restriction found for 3 user-triggered agents (chatgpt-user, claude-user, perplexity-user) on 1 public page: https://gap.com/. Declared policy only |
| llms.txt exists | Partial | 0 of 1 | A file is present at https://gap.com/llms.txt, but it returns an HTML page rather than a plain-text llms.txt. |
| llms.txt formatting | Fail | 0 of 2 | No llms.txt found to evaluate quality |
| JSON-LD structured data | Partial | 1 of 2 | JSON-LD Organization found - missing description on this entity |
| Pricing info accessible | Pass | 3 of 3 | Pass, no detail recorded. |
| Agent instruction / when-to-use | Partial | 0.67 of 1 | Agent instruction file at /agent.txt but no explicit when-to-use guidance |
| Skills.sh skill quality | Fail | 0 of 2 | No official skills on skills.sh to evaluate |
| JSON-LD entity linking (sameAs) | Partial | 0.5 of 1 | Entity linking to linkedin.com - add more authority profiles (Wikipedia, Wikidata, LinkedIn, GitHub) |
| Metadata completeness | Partial | 0.5 of 1 | 2/4 metadata signals present - missing: og:image, og:type |
| Organization schema completeness | Partial | 0.5 of 1 | Organization schema found but missing: address |
| Trust anchor pages | Fail | 0 of 1 | No trust anchor pages found with sufficient content (About, Contact, Privacy) |
| Markdown alternate link | Fail | 0 of 1 | No sampled page advertises a markdown alternate. Add <link rel="alternate" type="text/markdown" href="..."> (or the equivalent Link response header) pointing at a markdown twin of the page. |
| Redirect hygiene | Pass | 1 of 1 | Pass, no detail recorded. |
| Page token budget | Pass | 1 of 1 | All 6 measured pages fit an agent context budget (largest ~1K tokens) |
| Content starts near the top | Pass | 1 of 1 | Pass, no detail recorded. |
| Content behind auth | Pass | 1 of 1 | All 5 sampled pages are publicly readable (0 with substantive content) |
| API catalog (RFC 9727) | Fail | 0 of 2 | No /.well-known/api-catalog found (RFC 9727) |
| Markdown agent docs | Fail | 0 of 1 | Missing markdown content negotiation. Homepage returned text/html when probed with Accept: text/markdown (expected text/markdown), and none of the well-known root paths (/llms.md, /auth.md, /agents.md, /developers.md |
| Markdown content negotiation (acceptmarkdown.com) | Fail | 0 of 1 | Homepage https://gap.com does not meet the Markdown negotiation requirements: Accept: text/markdown returned text/html; charset=utf-8; Vary header missing Accept (got "sec-ch-dpr, sec-ch-viewport-width, sec-ch-width") |
| Bot-UA markdown serving | Fail | 0 of 1 | No probed bot User-Agent (ChatGPT-User, Claude-User, Perplexity-User) receives markdown when requesting HTML. Optional: detect AI-bot UAs server-side and serve them a markdown representation directly. |
| Agent crawler reachability | Pass | 1 of 1 | Reachable to every agent we tested - ChatGPT-User: reachable, OAI-SearchBot: reachable, Claude-User: reachable, PerplexityBot: reachable |
Usability: 4 of 17
| Check | Result | Points | What Ora saw |
|---|---|---|---|
| Web Bot Auth directory | Fail | 0 of 2 | No /.well-known/http-message-signatures-directory found |
| auth.md exists | Fail | 0 of 2 | No /auth.md found at site root |
| auth.md structure | Fail | 0 of 2 | No /auth.md found at site root |
| Agent auth discovery metadata | Fail | 0 of 3 | Neither /.well-known/oauth-protected-resource nor /.well-known/oauth-authorization-server found. Probed: gap.com, api.gap.com. |
| Agent auth WWW-Authenticate hint | Fail | 0 of 1 | No 401 with WWW-Authenticate: Bearer resource_metadata=... found. Probed [https://gap.com/api, https://gap.com/api/v1, https://gap.com/v1, https://gap.com/v2, https://gap.com/agent/identity, https://gap.com/agent/auth |
| agent_auth endpoints reachable | Fail | 0 of 2 | No agent_auth endpoint URIs found in AS metadata or /auth.md prose; nothing to probe |
| WebMCP support | Fail | 0 of 8 | No WebMCP support detected - no document.modelContext / navigator.modelContext usage found (scanned 38 of 38 same-origin script bundle(s) for modelContext registrations) |
| JSON error responses | Pass | 3 of 3 | Pass, no detail recorded. |
| NLWeb /ask endpoint | Pass | 1 of 1 | NLWeb /ask endpoint exists but requires authentication (HTTP 403, via POST) |
| MCP server-card.json | Fail | 0 of 2 | No MCP server card found (checked /.well-known/mcp/server-card.json, the site's ai-catalog.json, servers[].card in mcp.json, and <server>/server-card) |
| Product + docs MCP coverage | Fail | 0 of 2 | This bonus needs two MCP servers: one for your product so agents can take actions, and a separate one for your documentation so agents can answer questions from your docs. |
| Agent-friendly 404s | Partial | 1 of 2 | The nonexistent path https://gap.com/__ora-404-probe-ip1cvjrb correctly returns HTTP 404. Partial credit: no Markdown error body was detected. |
| Accessibility-tree injection safety (bonus) | Pass | 2 of 2 | Pass, no detail recorded. |
| MCP Apps support | Fail | 0 of 4 | No MCP Apps support detected - this product has an in-agent UI surface but exposes no ui:// resources or tool UI metadata for agents to render. |
| A2UI / generative UI support | Fail | 0 of 2 | No A2UI or generative UI support detected |
The fixes worth most points
Ora attaches an estimate to each failing or partial check: how many points the site would gain by passing it. These are the 5 with the largest estimates for Gap.
- WebMCP support
- Fail, 0 of 8, about 17.8 points to gain. Ora saw:
No WebMCP support detected - no document.modelContext / navigator.modelContext usage found (scanned 38 of 38 same-origin script bundle(s) for modelContext registrations)
. - MCP Apps support
- Fail, 0 of 4, about 8.9 points to gain. Ora saw:
No MCP Apps support detected - this product has an in-agent UI surface but exposes no ui:// resources or tool UI metadata for agents to render
. - Brand name discoverability
- Partial, 1 of 3, about 7.4 points to gain. Ora saw:
gap.com ranks #9 for "Gap" (searched your brand name alone: no main product term from your homepage qualified)
. - Product + docs MCP coverage
- Fail, 0 of 2, about 4.4 points to gain. Ora saw:
This bonus needs two MCP servers: one for your product so agents can take actions, and a separate one for your documentation so agents can answer questions from your docs
. - Content without JavaScript
- Partial, 1.67 of 5, about 4.3 points to gain. Ora saw:
Homepage: 675 chars of readable text, but no H1 tag. Sampled pages with almost no text without JavaScript (5 of 5): https://www.gap.com/browse/accessories (62 chars), https://www.gap.com/browse/back-to-school-shop (62 chars)
.
Our read
Gap sells three apparel brands online, yet Ora found no commerce signals on gap.com, so the payment checks did not apply on this read and the Payments layer reads 0 of 0. The rest decides the score. The door is open: all four test agents reached the home page, and robots.txt allows the AI search crawlers in 3 of 3 checks. Inside there is little to read: 675 characters of text without an H1, an llms.txt address that returns an HTML page, an Organization block with no description and metadata at 2 of 4, though the sitemap is valid. The brand search put gap.com eighth for its own name. Access reads 14.84 of 25. The act layer is bare, with neither a public API nor an MCP server, and the OAuth row is unverified rather than failed because a bot shield answered at auth.gap.com. WebMCP is the fix worth most, about 17.8 points. A D at 40: the shop window holds 675 characters and the till is out of sight.
Test your own checkout
The scan above is free and needs no account: enter a domain at ora.ai and read the same layers for your own site, with the six payment checks mapped to this matrix on the Ora Payments page. The command below runs the same audit from a terminal and exits with 1 under the score you set, so it can gate a deploy. Why Ora, and its limits.
npx ax@0.10 audit https://example.com --min-score 70All 360 checks, one company a day. Corrections to the corrections page.
Sources
- ora.ai/api/score/gap.com, Ora's scan (vendor), read 14 Nov 2026
- Ora's scoring rules, version 3 (vendor), read 14 Nov 2026
- Ora check catalog (GET /api/checks), read 14 Nov 2026
- gap.com, the company's site, read 14 Nov 2026
Last reviewed