360 check, 9 Nov 2026
JD.com on the pay layer: the 360 agent-readiness check
JD.com scores 33 of 100 on Ora's agent-readiness scan, a D, read 14 Nov 2026. The six payment checks did not apply to jd.com on this read, which is how Ora treats a site it does not read as a shop. A React root with nothing in it, read by agents that run no scripts.
On 14 Nov 2026 the public site at jd.com scored 33 of 100 on Ora's agent-readiness scan, a D. JD.com is China's largest retailer by revenue, selling online with its own logistics, so this check reads the Payments layer first: the six checks that look for x402, MPP, UCP, ACP and AP2 on the domain, the same protocols this site's matrix tracks row by row. The other layers follow, with every check Ora ran and what it saw. Ora's one-line summary: Turns agents away at the door: the homepage renders its content with JavaScript, so agents that run none see an empty page.
The score
| Layer | Points | Share | What the layer asks |
|---|---|---|---|
| Discovery | 8 of 15 | 53% | Can agents find and recommend it |
| Access | 19 of 55 | 35% | Can agents read it |
| Usability | 10 of 45 | 22% | Can agents use it |
| Payments | 0 of 0 | none apply | Can agents pay |
| Total | 33 of 100 | 33% | Grade D |
The pay layer
Ora did not run the six payment checks against jd.com on this read: it marks them not applicable on a site it does not read as a shop, so the layer has no maximum and costs nothing. A marketplace that sells online can still publish any of the five protocols; the matrix says which processors and platforms carry each one. Each protocol links to its matrix row, where the processors and platforms that carry it are dated and sourced.
| Payment check | Result | Points | Matrix row | What Ora saw |
|---|---|---|---|---|
| x402 | Does not apply | 0 of 2 | x402 in the matrix | No commerce signals detected - agent-payment protocols are optional for non-commerce sites |
| MPP | Does not apply | 0 of 2 | MPP in the matrix | No commerce signals detected - agent-payment protocols are optional for non-commerce sites |
| UCP | Does not apply | 0 of 3 | UCP in the matrix | No commerce signals detected - agent-payment protocols are optional for non-commerce sites |
| ACP | Does not apply | 0 of 3 | ACP in the matrix | No commerce signals detected - agent-payment protocols are optional for non-commerce sites |
| ACP delegate payment | Does not apply | 0 of 3 | ACP in the matrix | No commerce signals detected - agent-payment protocols are optional for non-commerce sites |
| AP2 | Does not apply | 0 of 3 | AP2 in the matrix | No commerce signals detected - agent-payment protocols are optional for non-commerce sites |
The other layers, check by check
Every check Ora ran on jd.com, grouped by layer, with the result, the points and what Ora recorded where its wording passes this site's gate.
Discovery: 8 of 15
| Check | Result | Points | What Ora saw |
|---|---|---|---|
| ARD discovery | Partial | 0 of 1 | /.well-known/ard.json exists but is not valid JSON |
| AI Catalog discovery | Partial | 0 of 1 | /.well-known/ai-catalog.json exists but is not valid JSON |
| Developer resource discoverability | Fail | 0 of 3 | In a search for your API docs, none of the 10 results is your official docs |
| Brand name discoverability | Fail | 0 of 3 | jd.com was not in the top 10 for "JoyGen" (searched your brand name alone: no main product term from your homepage qualified) |
| Wikipedia / Wikidata entity presence | Pass | 4 of 4 | Wikipedia "JD.com" and Wikidata Q3598926 both verified - domain confirmed on both sources |
| robots.txt AI crawler policy | Pass | 2 of 2 | AI search crawlers: allowed in 3 of 3 checks (3 crawlers on 1 page). AI training crawlers: allowed in 2 of 2 checks (2 crawlers on 1 page), not scored. |
| NPM/PyPI SDK package | Pass | 1 of 1 | Pass, no detail recorded. |
| Agent platform configs | Fail | 0 of 1 | Could not locate a public repo containing agent configs or rules. If our probes missed it, AI coding agents likely will too - link the repo from your homepage or docs so it's discoverable. |
| Agent Plugins manifest | Fail | 0 of 1 | No Agent Plugins manifest (plugin.json) found in discovered repos |
| ChatGPT app listed | Fail | 0 of 2 | Not found in ChatGPT app directory |
| Homepage not hidden from search | Pass | 1 of 1 | No noindex on the homepage: no robots, googlebot or bingbot meta tag and no X-Robots-Tag header hides it from search. |
Access: 19 of 55
| Check | Result | Points | What Ora saw |
|---|---|---|---|
| Sitemap exists | Fail | 0 of 2 | No sitemap found |
| Content without JavaScript | Fail | 0 of 3 | Homepage: Very little text content (6 chars), and the app mount node <div id="root"> is empty and the page loads 2 scripts: the content is rendered by JavaScript, so AI crawlers that run none see an empty page. |
| Not blocked by bot detection | Pass | 2 of 2 | Site accessible to 3 agent user-agents (ChatGPT-User, Claude-User, PerplexityBot). Can't verify OAI-SearchBot. A bot shield, rate limit, or timeout stopped our test request. |
| Agent discovery file | Fail | 0 of 2 | No agent discovery file found |
| A2A / agent-card | Fail | 0 of 2 | No A2A agent card found at /.well-known/agent-card.json |
| Listed on skills.sh | Pass | 1 of 1 | Pass, no detail recorded. |
| pricing.md exists | Partial | 1 of 2 | pricing.md found at /pricing.md (1 line), but it has no pricing words such as price, plan, tier or cost, it has fewer than 5 lines, and it does not open with a # heading - add plan tiers, prices, and feature breakdowns |
| NLWeb Schema Feeds | Fail | 0 of 1 | No schemamap: directive in robots.txt |
| MCP well-known discovery | Fail | 0 of 2 | No MCP server URL discovered |
| Agent mode view | Fail | 0 of 2 | ?mode=agent returns same content as homepage (no dedicated agent view) |
| HTTP Link headers (RFC 8288) | Fail | 0 of 1 | No HTTP Link response headers (RFC 8288) found |
| Markdown URL fallback | Fail | 0 of 2 | Homepage does not support the .md suffix. Probed https://jd.com/index.md and it did not return markdown (expected text/markdown content-type or a heading-led non-HTML body). |
| Modular llms.txt per product area | Fail | 0 of 1 | No section-level llms.txt found. Tried /docs/llms.txt, /api/llms.txt, /developers/llms.txt, /guides/llms.txt, /reference/llms.txt. This is a bonus check: it can add a point and never costs one. |
| robots.txt agent-user policy | Pass | 2 of 2 | No applicable crawl or usage restriction found for 3 user-triggered agents (chatgpt-user, claude-user, perplexity-user) on 1 public page: https://jd.com/. Declared policy only |
| llms.txt exists | Partial | 0 of 1 | A file is present at https://www.jd.com/.well-known/llms.txt, but it returns an HTML page rather than a plain-text llms.txt. |
| llms.txt formatting | Fail | 0 of 2 | No llms.txt found to evaluate quality |
| JSON-LD structured data | Fail | 0 of 4 | No JSON-LD structured data found on homepage |
| Pricing info accessible | Fail | 0 of 3 | No pricing page or pricing data found |
| Public API/docs linked from homepage | Pass | 3 of 3 | Documentation site found at https://www.jd.com |
| Agent instruction / when-to-use | Fail | 0 of 3 | No agent instruction file with when-to-use guidance found |
| Skills.sh skill quality | Pass | 2 of 2 | Pass, no detail recorded. |
| JSON-LD entity linking (sameAs) | Fail | 0 of 2 | No JSON-LD found - no entity linking possible |
| Metadata completeness | Partial | 1 of 2 | Only 1/4 metadata signals present - missing: canonical URL, og:image, og:type |
| Organization schema completeness | Fail | 0 of 2 | No JSON-LD found - Organization schema missing |
| Schema type breadth | Fail | 0 of 2 | No extended schema types found - AI can only answer basic questions about this entity |
| Trust anchor pages | Fail | 0 of 2 | No trust anchor pages found with sufficient content (About, Contact, Privacy) |
| Markdown alternate link | Fail | 0 of 1 | No sampled page advertises a markdown alternate. Add <link rel="alternate" type="text/markdown" href="..."> (or the equivalent Link response header) pointing at a markdown twin of the page. |
| Redirect hygiene | Pass | 1 of 1 | Pass, no detail recorded. |
| Page token budget | Pass | 1 of 1 | All 1 measured page fit an agent context budget (largest ~1K tokens) |
| OpenAPI spec published | Fail | 0 of 7 | No OpenAPI/Swagger specification found |
| Developer portal | Pass | 6 of 6 | Developer documentation portal found at https://www.jd.com |
| API catalog (RFC 9727) | Partial | 1 of 2 | api-catalog responded but body is not valid JSON |
| Markdown agent docs | Fail | 0 of 1 | Missing markdown content negotiation. Homepage returned text/html when probed with Accept: text/markdown (expected text/markdown), and none of the well-known root paths (/llms.md, /auth.md, /agents.md, /developers.md |
| Markdown content negotiation (acceptmarkdown.com) | Fail | 0 of 1 | Homepage https://jd.com does not meet the Markdown negotiation requirements: Accept: text/markdown returned text/html; Vary header missing Accept (got "none") |
| Bot-UA markdown serving | Fail | 0 of 1 | No probed bot User-Agent (ChatGPT-User, Claude-User, Perplexity-User) receives markdown when requesting HTML. Optional: detect AI-bot UAs server-side and serve them a markdown representation directly. |
| Agent crawler reachability | Pass | 2 of 2 | Reachable to ChatGPT-User, Claude-User, PerplexityBot. A bot shield, rate limit, or timeout stopped our test request. Real crawlers come from their own networks and may get through. (ChatGPT-User: reachable |
Usability: 10 of 45
| Check | Result | Points | What Ora saw |
|---|---|---|---|
| Public API with reachable endpoints | Partial | 3 of 7 | Documentation site found at https://www.jd.com but API content unclear. Best-of-protocols score: 3/7. |
| OAuth 2.0 support | Fail | 0 of 5 | No OAuth 2.0 or OpenID Connect support detected |
| Scoped permissions | Fail | 0 of 5 | No declared OAuth scopes, security schemes, or scoped-permission documentation found |
| Agent onboarding friction | Fail | 0 of 2 | High onboarding friction - no free tier, self-serve keys, or sandbox detected |
| Web Bot Auth directory | Partial | 1 of 2 | Web Bot Auth directory found but body is not valid JSON |
| OAuth Protected Resource metadata (RFC 9728) | Fail | 0 of 2 | No /.well-known/oauth-protected-resource found (RFC 9728) |
| auth.md exists | Fail | 0 of 2 | Path https://jd.com/auth.md returned HTML (SPA / 404 fallback), not an auth.md document |
| auth.md structure | Fail | 0 of 2 | No /auth.md found at site root |
| Agent auth discovery metadata | Fail | 0 of 3 | Neither /.well-known/oauth-protected-resource nor /.well-known/oauth-authorization-server found. Probed: jd.com, api.jd.com. |
| Agent auth WWW-Authenticate hint | Fail | 0 of 1 | No 401 with WWW-Authenticate: Bearer resource_metadata=... found. Probed [https://jd.com/api, https://jd.com/api/v1, https://jd.com/v1, https://jd.com/v2, https://jd.com/agent/identity, https://jd.com/agent/auth, https://api.jd.com/api |
| agent_auth endpoints reachable | Fail | 0 of 2 | No agent_auth endpoint URIs found in AS metadata or /auth.md prose; nothing to probe |
| MCP server / manifest | Fail | 0 of 6 | No MCP server or manifest found |
| WebMCP support | Fail | 0 of 5 | No WebMCP support detected - no document.modelContext / navigator.modelContext usage found |
| JSON error responses | Fail | 0 of 4 | API does not return JSON error responses (or no API detected) |
| CLI tool available | Pass | 3 of 3 | CLI package found on npm: jd-minigame-ci |
| NLWeb /ask endpoint | Fail | 0 of 1 | No NLWeb-conformant /ask endpoint found via GET or POST |
| NLWeb streaming support | Fail | 0 of 1 | NLWeb /ask does not support SSE streaming via GET or POST |
| MCP server-card.json | Fail | 0 of 2 | No MCP server card found (checked /.well-known/mcp/server-card.json, the site's ai-catalog.json, servers[].card in mcp.json, and <server>/server-card) |
| Product + docs MCP coverage | Fail | 0 of 2 | This bonus needs two MCP servers: one for your product so agents can take actions, and a separate one for your documentation so agents can answer questions from your docs. |
| Sandbox / test environment | Fail | 0 of 2 | No sandbox or test environment found |
| Agent-friendly 404s | Fail | 0 of 2 | Nonexistent paths return HTTP 200 with the app shell (soft-404). Agents probing for resources conclude every path exists. Return a real HTTP 404 status for unknown paths. |
| Accessibility-tree injection safety (bonus) | Pass | 2 of 2 | Pass, no detail recorded. |
| API schema complexity analysis | Partial | 1 of 2 | REST: OpenAPI spec found but failed to parse for complexity analysis |
| Function calling compatibility | Partial | 1 of 2 | API spec found but couldn't validate function calling compatibility |
The fixes worth most points
Ora attaches an estimate to each failing or partial check: how many points the site would gain by passing it. These are the 5 with the largest estimates for JD.com.
- MCP server / manifest
- Fail, 0 of 6, about 5.9 points to gain. Ora saw:
No MCP server or manifest found
. - OAuth 2.0 support
- Fail, 0 of 5, about 4.9 points to gain. Ora saw:
No OAuth 2.0 or OpenID Connect support detected
. - Scoped permissions
- Fail, 0 of 5, about 4.9 points to gain. Ora saw:
No declared OAuth scopes, security schemes, or scoped-permission documentation found
. - WebMCP support
- Fail, 0 of 5, about 4.9 points to gain. Ora saw:
No WebMCP support detected - no document.modelContext / navigator.modelContext usage found
. - Developer resource discoverability
- Fail, 0 of 3, about 4.4 points to gain. Ora saw:
In a search for your API docs, none of the 10 results is your official docs
.
Our read
JD.com's home page is an empty mount node: six characters of text, a React root with nothing in it and the content rendered by JavaScript, so the content row fails and the six payment checks did not apply because no commerce signal could be read, on the site of China's largest retailer by revenue. The door is mostly open, with ChatGPT-User, Claude-User and PerplexityBot admitted and OAI-SearchBot unverified, and robots.txt allows the search and training crawlers. The files around the page are the wrong kind or missing: the llms.txt at /.well-known/llms.txt returns an HTML page, there is no sitemap and no JSON-LD, and the developer documentation Ora found is the home page itself. Ora found no MCP server, no OpenAPI specification and no OAuth discovery, and its search for the API documentation returned none of the official pages in ten results. The brand search ran on a product term the scan read off the page, JoyGen, and found nothing. The template is the fix.
Test your own checkout
The scan above is free and needs no account: enter a domain at ora.ai and read the same layers for your own site, with the six payment checks mapped to this matrix on the Ora Payments page. The command below runs the same audit from a terminal and exits with 1 under the score you set, so it can gate a deploy. Why Ora, and its limits.
npx ax@0.10 audit https://example.com --min-score 70All 360 checks, one company a day. Corrections to the corrections page.
Sources
- ora.ai/api/score/jd.com, Ora's scan (vendor), read 14 Nov 2026
- Ora check catalog (GET /api/checks), read 14 Nov 2026
- jd.com, the company's site, read 14 Nov 2026
Last reviewed