360 check, 9 Nov 2026
Instacart on the pay layer: the 360 agent-readiness check
In short
Instacart scores 54 of 100 on Ora's agent-readiness scan, a C, read 14 Nov 2026. The six payment checks did not apply to instacart.com on this read, which is how Ora treats a site it does not read as a shop. The highest score among the sellers, with a live MCP handshake and no payment protocol.
On 14 Nov 2026 the public site at instacart.com scored 54 of 100 on Ora's agent-readiness scan, a C, in Ora's E-commerce category. Instacart is the grocery delivery marketplace of the United States, selling from more than 1,500 retail banners, so this check reads the Payments layer first: the six checks that look for x402, MPP, UCP, ACP and AP2 on the domain, the same protocols this site's matrix tracks row by row. The other layers follow, with every check Ora ran and what it saw. Ora's one-line summary: Instacart offers a working MCP and llms.txt presence and a published SDK package, but lacks an OpenAPI specification and WebMCP support for agents.
The score
| Layer | Points | Share | What the layer asks |
|---|---|---|---|
| Discovery | 7.5 of 14 | 54% | Can agents find and recommend it |
| Access | 23.67 of 42 | 56% | Can agents read it |
| Usability | 48.8 of 94 | 52% | Can agents use it |
| Payments | 0 of 0 | none apply | Can agents pay |
| Total | 54 of 100 | 54% | Grade C |
The pay layer
Ora did not run the six payment checks against instacart.com on this read: it marks them not applicable on a site it does not read as a shop, so the layer has no maximum and costs nothing. A marketplace that sells online can still publish any of the five protocols; the matrix says which processors and platforms carry each one. Each protocol links to its matrix row, where the processors and platforms that carry it are dated and sourced.
| Payment check | Result | Points | Matrix row | What Ora saw |
|---|---|---|---|---|
| x402 | Does not apply | 0 of 2 | x402 in the matrix | No x402 payment protocol support detected. No working way for an agent to pay was found, so payments are not scored |
| MPP | Does not apply | 0 of 2 | MPP in the matrix | No MPP (Machine Payments Protocol) support detected. No working way for an agent to pay was found, so payments are not scored |
| UCP | Does not apply | 0 of 3 | UCP in the matrix | no UCP (Universal Commerce Protocol) signals detected. No working way for an agent to pay was found, so payments are not scored |
| ACP | Does not apply | 0 of 3 | ACP in the matrix | no ACP (Agentic Commerce Protocol) signals detected. No working way for an agent to pay was found, so payments are not scored |
The other layers, check by check
Every check Ora ran on instacart.com, grouped by layer, with the result, the points and what Ora recorded where its wording passes this site's gate.
Discovery: 7.5 of 14
| Check | Result | Points | What Ora saw |
|---|---|---|---|
| ARD discovery | Fail | 0 of 1 | No /.well-known/ard.json, no same-site rel="ard" link, and no legacy /.well-known/ai-catalog.json |
| Developer resource discoverability | Pass | 4 of 4 | Pass, no detail recorded. |
| Brand name discoverability | Partial | 1 of 3 | instacart.com ranks #8 for "Instacart" (searched your brand name alone: no main product term from your homepage qualified) |
| robots.txt AI crawler policy | Partial | 0.5 of 1 | AI search crawlers: allowed in 1 of 3 checks (3 crawlers on 1 page). AI training crawlers: allowed in 0 of 2 checks (2 crawlers on 1 page), not scored. robots.txt restricts 2/3 evaluated search page/crawler pairs. |
| Listed in MCP registries | Fail | 0 of 3 | No verified entry in the official MCP Registry or on Smithery, and no npm or PyPI package of yours that runs as an MCP server. To pass |
| NPM/PyPI SDK package | Pass | 1 of 1 | Pass, no detail recorded. |
| Agent platform configs | Fail | 0 of 1 | Could not locate a public repo containing agent configs or rules. If our probes missed it, AI coding agents likely will too - link the repo from your homepage or docs so it's discoverable. |
| Agent Plugins manifest | Fail | 0 of 1 | No Agent Plugins manifest (plugin.json) found in discovered repos |
| Registry branding | Pass | 2 of 2 | Pass, no detail recorded. |
| ChatGPT app listed | Fail | 0 of 2 | Not found in ChatGPT app directory |
| Homepage not hidden from search | Pass | 1 of 1 | No noindex on the homepage: no robots, googlebot or bingbot meta tag and no X-Robots-Tag header hides it from search. |
Access: 23.67 of 42
| Check | Result | Points | What Ora saw |
|---|---|---|---|
| Sitemap exists | Fail | 0 of 1 | No sitemap found |
| Content without JavaScript | Pass | 5 of 5 | Homepage: 5640 chars, semantic headings (1 H1 + 6 H2s + 17 H3s), 14.8% content ratio. 5 of 5 sampled inner pages have text without JavaScript. |
| Not blocked by bot detection | Pass | 2 of 2 | Site accessible to 4 agent user-agents (ChatGPT-User, OAI-SearchBot, Claude-User, PerplexityBot). |
| Agent discovery file | Fail | 0 of 2 | No agent discovery file found |
| A2A / agent-card | Fail | 0 of 2 | No A2A agent card found at /.well-known/agent-card.json |
| Listed on skills.sh | Fail | 0 of 1 | No official skills self-published on skills.sh (26 community skills with potential relation to this domain found, but only self-published official skills count) |
| pricing.md exists | Fail | 0 of 2 | No pricing.md found - agents need machine-readable pricing to compare products and make purchase recommendations |
| NLWeb Schema Feeds | Fail | 0 of 1 | No schemamap: directive in robots.txt |
| MCP well-known discovery | Pass | 2 of 2 | MCP server referenced in llms.txt |
| HTTP Link headers (RFC 8288) | Fail | 0 of 1 | No HTTP Link response headers (RFC 8288) found |
| Markdown URL fallback | Fail | 0 of 2 | Homepage does not support the .md suffix. Probed https://instacart.com/index.md and it did not return markdown (expected text/markdown content-type or a heading-led non-HTML body). |
| Modular llms.txt per product area | Fail | 0 of 1 | No section-level llms.txt found. Tried /docs/llms.txt, /api/llms.txt, /developers/llms.txt, /guides/llms.txt, /reference/llms.txt, /grocery-delivery/llms.txt, /help/llms.txt, /privacy/llms.txt, /terms/llms.txt, /instacart-plus/llms.txt. |
| robots.txt agent-user policy | Partial | 0.5 of 1 | robots.txt restricts 2/3 evaluated page/crawler pairs. Checked 3 user-triggered agents (chatgpt-user, claude-user, perplexity-user) on 1 public page. Restricted: claude-user at https://instacart.com/ (Disallow: / |
| llms.txt exists | Pass | 1 of 1 | Found the llms.txt at https://docs.instacart.com/llms.txt. |
| llms.txt formatting | Fail | 0 of 2 | The llms.txt is 200,532 characters. Agents truncate an llms.txt past 100,000 characters, so the links after that point are never read. Keep it a short index and move the detail to the linked pages. |
| JSON-LD structured data | Partial | 0.5 of 2 | JSON-LD found (1 block(s)) but no identity type - use SoftwareApplication, Product, Organization, Person, or Article so agents can tell what this site is |
| Pricing info accessible | Fail | 0 of 3 | No pricing page or pricing data found |
| Public API/docs linked from homepage | Pass | 4 of 4 | Documentation site found at https://docs.instacart.com |
| Agent instruction / when-to-use | Partial | 0.67 of 1 | When-to-use guidance found at https://docs.instacart.com |
| Skills.sh skill quality | Fail | 0 of 2 | No official skills on skills.sh to evaluate |
| JSON-LD entity linking (sameAs) | Fail | 0 of 1 | No sameAs entity linking in JSON-LD - agents cannot disambiguate your brand |
| Metadata completeness | Pass | 1 of 1 | All metadata signals present: canonical URL, lang="en-US", og:image, og:type |
| Organization schema completeness | Fail | 0 of 1 | No Organization type found in JSON-LD |
| Trust anchor pages | Pass | 1 of 1 | Pass, no detail recorded. |
| Markdown alternate link | Fail | 0 of 1 | No sampled page advertises a markdown alternate. Add <link rel="alternate" type="text/markdown" href="..."> (or the equivalent Link response header) pointing at a markdown twin of the page. |
| Redirect hygiene | Pass | 1 of 1 | Pass, no detail recorded. |
| Page token budget | Pass | 1 of 1 | All 6 measured pages fit an agent context budget (largest ~2K tokens) |
| Content starts near the top | Pass | 1 of 1 | Pass, no detail recorded. |
| Code fence validity | Pass | 1 of 1 | Pass, no detail recorded. |
| OpenAPI spec published | Fail | 0 of 8 | No OpenAPI/Swagger specification found |
| Developer portal | Pass | 5 of 5 | Developer portal found at /docs |
| API catalog (RFC 9727) | Fail | 0 of 2 | No /.well-known/api-catalog found (RFC 9727) |
| Markdown agent docs | Fail | 0 of 1 | Missing markdown content negotiation. Homepage returned text/html when probed with Accept: text/markdown (expected text/markdown), and none of the well-known root paths (/llms.md, /auth.md, /agents.md, /developers.md |
| Markdown content negotiation (acceptmarkdown.com) | Fail | 0 of 1 | Homepage https://instacart.com does not meet the Markdown negotiation requirements: Accept: text/markdown returned text/html; charset=utf-8; Vary header missing Accept (got "none") |
| Bot-UA markdown serving | Fail | 0 of 1 | No probed bot User-Agent (ChatGPT-User, Claude-User, Perplexity-User) receives markdown when requesting HTML. Optional: detect AI-bot UAs server-side and serve them a markdown representation directly. |
| Agent crawler reachability | Pass | 1 of 1 | Reachable to every agent we tested - ChatGPT-User: reachable, OAI-SearchBot: reachable, Claude-User: reachable, PerplexityBot: reachable |
Usability: 48.8 of 94
| Check | Result | Points | What Ora saw |
|---|---|---|---|
| MCP tool descriptions | Partial | 1.8 of 4 | All 2 tools on product MCP have detailed descriptions (>= 20 chars). Descriptions grade 45/100 for depth: an agent picks well when each one runs 80 characters or more and says when to use the tool and what it returns. |
| MCP parameter schemas | Pass | 3 of 3 | Pass, no detail recorded. |
| MCP server identity | Pass | 1 of 1 | Pass, no detail recorded. |
| MCP tool listing | Partial | 2 of 3 | product MCP exposes 2 tool(s) - consider adding more for comprehensive agent coverage |
| MCP tool naming | Pass | 2 of 2 | Pass, no detail recorded. |
| Public API with reachable endpoints | Pass | 8 of 8 | REST API documentation found at /docs/api. GraphQL endpoint at https://api.instacart.com/graphql is reachable; introspection requires authentication (API key / OAuth), which is expected for agent access. |
| OAuth 2.0 support | Pass | 5 of 5 | OAuth endpoint found at https://instacart.com/oauth/authorize |
| Scoped permissions | Fail | 0 of 5 | No declared OAuth scopes, security schemes, or scoped-permission documentation found |
| Agent onboarding friction | Pass | 2 of 2 | Pass, no detail recorded. |
| Web Bot Auth directory | Fail | 0 of 2 | No /.well-known/http-message-signatures-directory found |
| OAuth Protected Resource metadata (RFC 9728) | Fail | 0 of 2 | No /.well-known/oauth-protected-resource found (RFC 9728) |
| auth.md exists | Fail | 0 of 2 | No /auth.md found at site root |
| auth.md structure | Fail | 0 of 2 | No /auth.md found at site root |
| Agent auth discovery metadata | Fail | 0 of 3 | Neither /.well-known/oauth-protected-resource nor /.well-known/oauth-authorization-server found. Probed: instacart.com, mcp.instacart.com, api.instacart.com. |
| Agent auth WWW-Authenticate hint | Fail | 0 of 1 | No 401 with WWW-Authenticate: Bearer resource_metadata=... found. Probed [https://instacart.com/api, https://instacart.com/api/v1, https://instacart.com/v1, https://instacart.com/v2, https://instacart.com/agent/identity |
| agent_auth endpoints reachable | Fail | 0 of 2 | No agent_auth endpoint URIs found in AS metadata or /auth.md prose; nothing to probe |
| MCP server / manifest | Pass | 10 of 10 | MCP server connected via Streamable HTTP - InstacartRecipeServer v1.0.0 (protocol 2024-11-05) |
| MCP error handling | Pass | 2 of 2 | Pass, no detail recorded. |
| MCP modern transport | Pass | 1 of 1 | Pass, no detail recorded. |
| WebMCP support | Fail | 0 of 8 | No WebMCP support detected - no document.modelContext / navigator.modelContext usage found |
| Rate limit response headers | Fail | 0 of 2 | GraphQL introspection auth-gated and no header convention documented on GraphQL-tagged pages |
| Idempotency-Key support | Fail | 0 of 3 | GraphQL introspection auth-gated and no idempotency documentation found on GraphQL-tagged pages |
| JSON error responses | Pass | 3 of 3 | Pass, no detail recorded. |
| CLI tool available | Fail | 0 of 3 | No CLI tool found |
| NLWeb /ask endpoint | Fail | 0 of 1 | No NLWeb-conformant /ask endpoint found via GET or POST |
| NLWeb streaming support | Fail | 0 of 1 | NLWeb /ask does not support SSE streaming via GET or POST |
| MCP tool annotations | Fail | 0 of 3 | product MCP: declared annotations grade 0/100 across the 2 tools whose names say they read, write or delete (readOnlyHint, destructiveHint); 2 declare no readOnlyHint or destructiveHint |
| MCP server instructions | Fail | 0 of 1 | product MCP sends no instructions on initialize |
| MCP tools are distinguishable | Pass | 2 of 2 | Pass, no detail recorded. |
| MCP tool output schemas | Fail | 0 of 3 | 0 of 2 tools on product MCP declare an outputSchema that describes their result fields |
| MCP server-card.json | Fail | 0 of 2 | No MCP server card found for https://mcp.instacart.com/mcp (checked /.well-known/mcp/server-card.json, the site's ai-catalog.json, servers[].card in mcp.json, and <server>/server-card) |
| Product + docs MCP coverage | Fail | 0 of 2 | You run an MCP server for your product, but not one for your documentation. This bonus needs two MCP servers: one for your product so agents can take actions |
| Sandbox / test environment | Pass | 2 of 2 | Pass, no detail recorded. |
| GraphQL typed error model | Fail | 0 of 3 | GraphQL introspection auth-gated and no typed graphql error model documentation found on GraphQL-tagged pages |
| GraphQL versioning / deprecation policy | Partial | 1 of 2 | GraphQL versioning / deprecation policy described in documentation at https://docs.instacart.com/foodstorm/api/changelog; schema not introspectable to verify |
| GraphQL pagination pattern | Fail | 0 of 2 | GraphQL introspection auth-gated and no graphql pagination pattern documentation found on GraphQL-tagged pages |
| GraphQL async-job pattern | Fail | 0 of 2 | GraphQL introspection auth-gated and no graphql async-job pattern documentation found on GraphQL-tagged pages |
| Agent-friendly 404s | Partial | 1 of 2 | Partial, no detail recorded. |
| Accessible document structure | Pass | 3 of 3 | Pass, no detail recorded. |
| Native interactive controls | Pass | 3 of 3 | Pass, no detail recorded. |
| Accessible names on controls | Pass | 2 of 2 | Pass, no detail recorded. |
| Accessibility-tree injection safety (bonus) | Pass | 2 of 2 | Pass, no detail recorded. |
| MCP Apps support | Fail | 0 of 4 | No MCP Apps support detected - this product has an in-agent UI surface but exposes no ui:// resources or tool UI metadata for agents to render. |
| A2UI / generative UI support | Fail | 0 of 2 | No A2UI or generative UI support detected |
| API schema complexity analysis | Pass | 2 of 2 | Pass, no detail recorded. |
| Function calling compatibility | Fail | 0 of 2 | No API spec found - function calling requires discoverable endpoints |
The fixes worth most points
Ora attaches an estimate to each failing or partial check: how many points the site would gain by passing it. These are the 5 with the largest estimates for Instacart.
- OpenAPI spec published
- Fail, 0 of 8, about 6.3 points to gain. Ora saw:
No OpenAPI/Swagger specification found
. - Listed in MCP registries
- Fail, 0 of 3, about 4.8 points to gain. Ora saw:
No verified entry in the official MCP Registry or on Smithery, and no npm or PyPI package of yours that runs as an MCP server. To pass
. - WebMCP support
- Fail, 0 of 8, about 3.8 points to gain. Ora saw:
No WebMCP support detected - no document.modelContext / navigator.modelContext usage found
. - Brand name discoverability
- Partial, 1 of 3, about 3.2 points to gain. Ora saw:
instacart.com ranks #8 for "Instacart" (searched your brand name alone: no main product term from your homepage qualified)
. - Pricing info accessible
- Fail, 0 of 3, about 2.4 points to gain. Ora saw:
No pricing page or pricing data found
.
Our read
Instacart is the highest score among the sellers read here, 63, and the one with a live MCP handshake: Ora connected to InstacartRecipeServer version 1.0.0 over Streamable HTTP, beside REST documentation at /docs/api, a reachable GraphQL endpoint at api.instacart.com, an OAuth endpoint at instacart.com/oauth/authorize and an llms.txt at docs.instacart.com. Ora probed the six payment checks on a site it reads as a shop and found no x402, MPP, UCP, ACP or AP2 signal, so the pay layer reads 0 of 0 on a platform whose product is a checkout made on someone's behalf. The home page is the best written in this batch, 5,640 characters at a 14.8 percent text ratio with a full heading tree. The policy is the odd row: robots.txt admits one of three search crawlers, neither training crawler, and restricts two of three user-triggered agents, while the door is open to all four. There is neither an OpenAPI specification nor a sitemap. A recipe server is a start; a checkout protocol is the product.
Test your own checkout
The scan above is free and needs no account: enter a domain at ora.ai and read the same layers for your own site, with the six payment checks mapped to this matrix on the Ora Payments page. The command below runs the same audit from a terminal and exits with 1 under the score you set, so it can gate a deploy. Why Ora, and its limits.
npx ax@0.10 audit https://example.com --min-score 70All 360 checks, one company a day. Corrections to the corrections page.
Sources
- ora.ai/api/score/instacart.com, Ora's scan (vendor), read 14 Nov 2026
- Ora's scoring rules, version 3 (vendor), read 14 Nov 2026
- Ora check catalog (GET /api/checks), read 14 Nov 2026
- instacart.com, the company's site, read 14 Nov 2026
Last reviewed