360 check, 9 Nov 2026
Kroger on the pay layer: the 360 agent-readiness check
Kroger scores 20 of 100 on Ora's agent-readiness scan, an F, read 14 Nov 2026. The six payment checks did not apply to kroger.com on this read, which is how Ora treats a site it does not read as a shop. A scan that could not fetch the site, so nothing here is a verdict yet.
On 14 Nov 2026 the public site at kroger.com scored 20 of 100 on Ora's agent-readiness scan, an F. Kroger is the largest supermarket operator in the United States, selling groceries online for pickup and delivery, so this check reads the Payments layer first: the six checks that look for x402, MPP, UCP, ACP and AP2 on the domain, the same protocols this site's matrix tracks row by row. The other layers follow, with every check Ora ran and what it saw. Ora's one-line summary: Kroger offers strong developer resource discoverability, but lacks WebMCP support implementation.
The score
| Layer | Points | Share | What the layer asks |
|---|---|---|---|
| Discovery | 10 of 11 | 91% | Can agents find and recommend it |
| Access | 0 of 29 | 0% | Can agents read it |
| Usability | 0 of 7 | 0% | Can agents use it |
| Payments | 0 of 0 | none apply | Can agents pay |
| Total | 20 of 100 | 20% | Grade F |
The pay layer
Ora did not run the six payment checks against kroger.com on this read: it marks them not applicable on a site it does not read as a shop, so the layer has no maximum and costs nothing. A retailer that sells online can still publish any of the five protocols; the matrix says which processors and platforms carry each one. Each protocol links to its matrix row, where the processors and platforms that carry it are dated and sourced.
| Payment check | Result | Points | Matrix row | What Ora saw |
|---|---|---|---|---|
| x402 | Does not apply | 0 of 2 | x402 in the matrix | No commerce signals detected - agent-payment protocols are optional for non-commerce sites |
| MPP | Does not apply | 0 of 2 | MPP in the matrix | No commerce signals detected - agent-payment protocols are optional for non-commerce sites |
| UCP | Does not apply | 0 of 3 | UCP in the matrix | No commerce signals detected - agent-payment protocols are optional for non-commerce sites |
| ACP | Does not apply | 0 of 3 | ACP in the matrix | No commerce signals detected - agent-payment protocols are optional for non-commerce sites |
| ACP delegate payment | Does not apply | 0 of 3 | ACP in the matrix | No commerce signals detected - agent-payment protocols are optional for non-commerce sites |
| AP2 | Does not apply | 0 of 3 | AP2 in the matrix | No commerce signals detected - agent-payment protocols are optional for non-commerce sites |
The other layers, check by check
Every check Ora ran on kroger.com, grouped by layer, with the result, the points and what Ora recorded where its wording passes this site's gate.
Discovery: 10 of 11
| Check | Result | Points | What Ora saw |
|---|---|---|---|
| ARD discovery | Fail | 0 of 1 | No /.well-known/ard.json, no same-site rel="ard" link, and no legacy /.well-known/ai-catalog.json |
| Developer resource discoverability | Pass | 3 of 3 | Pass, no detail recorded. |
| Brand name discoverability | Pass | 3 of 3 | kroger.com ranks #3 for "kroger" |
| Wikipedia / Wikidata entity presence | Pass | 4 of 4 | Wikipedia "Kroger" and Wikidata Q153417 both verified - domain confirmed on both sources |
| Agent platform configs | Fail | 0 of 1 | Could not locate a public repo containing agent configs or rules. If our probes missed it, AI coding agents likely will too - link the repo from your homepage or docs so it's discoverable. |
| Agent Plugins manifest | Fail | 0 of 1 | No Agent Plugins manifest (plugin.json) found in discovered repos |
| ChatGPT app listed | Fail | 0 of 2 | Not found in ChatGPT app directory |
Access: 0 of 29
| Check | Result | Points | What Ora saw |
|---|---|---|---|
| Sitemap exists | Fail | 0 of 2 | No sitemap found |
| Content without JavaScript | Not run | 0 of 3 | Could not fetch homepage |
| Not blocked by bot detection | Not run | 0 of 2 | Could not test bot user agents |
| Agent discovery file | Fail | 0 of 2 | No agent discovery file found |
| A2A / agent-card | Fail | 0 of 2 | No A2A agent card found at /.well-known/agent-card.json |
| Listed on skills.sh | Fail | 0 of 1 | No official skills self-published on skills.sh (7 community skills with potential relation to this domain found, but only self-published official skills count) |
| NLWeb Schema Feeds | Fail | 0 of 1 | No robots.txt found - cannot check for Schema Feeds |
| MCP well-known discovery | Fail | 0 of 2 | No MCP server URL discovered |
| Agent mode view | Fail | 0 of 2 | No agent mode view detected at ?mode=agent (optional) |
| HTTP Link headers (RFC 8288) | Fail | 0 of 1 | No HTTP Link response headers (RFC 8288) found |
| Markdown URL fallback | Fail | 0 of 2 | Homepage does not support the .md suffix. Probed https://kroger.com/index.md and it did not return markdown (expected text/markdown content-type or a heading-led non-HTML body). |
| Modular llms.txt per product area | Fail | 0 of 1 | No section-level llms.txt found. Tried /docs/llms.txt, /api/llms.txt, /developers/llms.txt, /guides/llms.txt, /reference/llms.txt. This is a bonus check: it can add a point and never costs one. |
| llms.txt exists | Fail | 0 of 1 | No llms.txt found at /llms.txt or /.well-known/llms.txt. |
| llms.txt formatting | Fail | 0 of 2 | No llms.txt found to evaluate quality |
| JSON-LD structured data | Not run | 0 of 4 | Could not fetch homepage |
| Agent instruction / when-to-use | Fail | 0 of 3 | No agent instruction file with when-to-use guidance found |
| Skills.sh skill quality | Fail | 0 of 2 | No official skills on skills.sh to evaluate |
| JSON-LD entity linking (sameAs) | Not run | 0 of 2 | Not run, no detail recorded. |
| Metadata completeness | Not run | 0 of 2 | Could not fetch homepage |
| Organization schema completeness | Not run | 0 of 2 | Not run, no detail recorded. |
| Schema type breadth | Not run | 0 of 2 | Not run, no detail recorded. |
| Trust anchor pages | Fail | 0 of 2 | No trust anchor pages found with sufficient content (About, Contact, Privacy) |
| API catalog (RFC 9727) | Fail | 0 of 2 | No /.well-known/api-catalog found (RFC 9727) |
| Markdown agent docs | Not run | 0 of 1 | Could not fetch with Accept: text/markdown |
| Markdown content negotiation (acceptmarkdown.com) | Fail | 0 of 1 | Could not probe both Accept: text/markdown and Accept: text/html on the homepage https://kroger.com |
| Bot-UA markdown serving | Fail | 0 of 1 | No probed bot User-Agent (ChatGPT-User, Claude-User, Perplexity-User) receives markdown when requesting HTML. Optional: detect AI-bot UAs server-side and serve them a markdown representation directly. |
Usability: 0 of 7
| Check | Result | Points | What Ora saw |
|---|---|---|---|
| Web Bot Auth directory | Fail | 0 of 2 | No /.well-known/http-message-signatures-directory found |
| OAuth Protected Resource metadata (RFC 9728) | Fail | 0 of 2 | No /.well-known/oauth-protected-resource found (RFC 9728) |
| auth.md exists | Fail | 0 of 2 | No /auth.md found at site root |
| auth.md structure | Fail | 0 of 2 | No /auth.md found at site root |
| Agent auth discovery metadata | Fail | 0 of 3 | Neither /.well-known/oauth-protected-resource nor /.well-known/oauth-authorization-server found. Probed: kroger.com, api.kroger.com. |
| Agent auth WWW-Authenticate hint | Fail | 0 of 1 | No 401 with WWW-Authenticate: Bearer resource_metadata=... found. Probed [https://kroger.com/api, https://kroger.com/api/v1, https://kroger.com/v1, https://kroger.com/v2, https://kroger.com/agent/identity, https://kroger.com/agent/auth |
| agent_auth endpoints reachable | Fail | 0 of 2 | No agent_auth endpoint URIs found in AS metadata or /auth.md prose; nothing to probe |
| WebMCP support | Fail | 0 of 5 | No WebMCP support detected - no document.modelContext / navigator.modelContext usage found |
| NLWeb /ask endpoint | Fail | 0 of 1 | No response from /ask endpoint |
| NLWeb streaming support | Fail | 0 of 1 | No response from /ask endpoint for streaming request |
| MCP server-card.json | Fail | 0 of 2 | No MCP server card found (checked /.well-known/mcp/server-card.json, the site's ai-catalog.json, servers[].card in mcp.json, and <server>/server-card) |
| Product + docs MCP coverage | Fail | 0 of 2 | This bonus needs two MCP servers: one for your product so agents can take actions, and a separate one for your documentation so agents can answer questions from your docs. |
| Sandbox / test environment | Fail | 0 of 2 | No sandbox or test environment found |
| Agent-friendly 404s | Not run | 0 of 2 | Not run, no detail recorded. |
The fixes worth most points
Ora attaches an estimate to each failing or partial check: how many points the site would gain by passing it. These are the 5 with the largest estimates for Kroger.
- WebMCP support
- Fail, 0 of 5, about 31.7 points to gain. Ora saw:
No WebMCP support detected - no document.modelContext / navigator.modelContext usage found
. - Agent auth discovery metadata
- Fail, 0 of 3, about 13.3 points to gain. Ora saw:
Neither /.well-known/oauth-protected-resource nor /.well-known/oauth-authorization-server found. Probed: kroger.com, api.kroger.com
. - agent_auth endpoints reachable
- Fail, 0 of 2, about 9.9 points to gain. Ora saw:
No agent_auth endpoint URIs found in AS metadata or /auth.md prose; nothing to probe
. - auth.md exists
- Fail, 0 of 2, about 9.9 points to gain. Ora saw:
No /auth.md found at site root
. - auth.md structure
- Fail, 0 of 2, about 9.9 points to gain. Ora saw:
No /auth.md found at site root
.
Our read
Kroger's 20 is a read that never got started. Ora could not fetch the home page, could not test the agent user agents, could not read robots.txt and found no sitemap, so every row from the door to the structured data is unverified on this scan rather than failed by the site, and the Access and Usability layers read 0 of 29 and 0 of 7 because almost nothing could be probed. With so few checks applicable the estimates are enormous, 31.7 points for WebMCP alone, and should be ignored. The six payment checks did not apply because no commerce signal could be read, and the act layer shows no API, no developer portal and no MCP server, which on a scan that could not fetch the site means nothing either way. Whether the grocer rate-limited the scanner, timed out or turned it away is for a second scan on another day; nothing on this page should be acted on before that.
Test your own checkout
The scan above is free and needs no account: enter a domain at ora.ai and read the same layers for your own site, with the six payment checks mapped to this matrix on the Ora Payments page. The command below runs the same audit from a terminal and exits with 1 under the score you set, so it can gate a deploy. Why Ora, and its limits.
npx ax@0.10 audit https://example.com --min-score 70All 360 checks, one company a day. Corrections to the corrections page.
Sources
- ora.ai/api/score/kroger.com, Ora's scan (vendor), read 14 Nov 2026
- Ora check catalog (GET /api/checks), read 14 Nov 2026
- kroger.com, the company's site, read 14 Nov 2026
Last reviewed