360 check, 9 Nov 2026
Lowe's on the pay layer: the 360 agent-readiness check
Lowe's scores 42 of 100 on Ora's agent-readiness scan, a D, read 14 Nov 2026. The six payment checks did not apply to lowes.com on this read, which is how Ora treats a site it does not read as a shop. A page titled Access Denied, which the scan read as the brand name.
On 14 Nov 2026 the public site at lowes.com scored 42 of 100 on Ora's agent-readiness scan, a D, in Ora's E-commerce category. Lowe's is the second home improvement chain in the United States, selling online and in store, so this check reads the Payments layer first: the six checks that look for x402, MPP, UCP, ACP and AP2 on the domain, the same protocols this site's matrix tracks row by row. The other layers follow, with every check Ora ran and what it saw. Ora's one-line summary: Bot detection turns agents away at the door, and the homepage shows only 207 characters of text without JavaScript.
The score
| Layer | Points | Share | What the layer asks |
|---|---|---|---|
| Discovery | 6 of 10 | 60% | Can agents find and recommend it |
| Access | 13.67 of 25 | 55% | Can agents read it |
| Usability | 9 of 39 | 23% | Can agents use it |
| Payments | 0 of 0 | none apply | Can agents pay |
| Total | 42 of 100 | 42% | Grade D |
The pay layer
Ora did not run the six payment checks against lowes.com on this read: it marks them not applicable on a site it does not read as a shop, so the layer has no maximum and costs nothing. A retailer that sells online can still publish any of the five protocols; the matrix says which processors and platforms carry each one. Each protocol links to its matrix row, where the processors and platforms that carry it are dated and sourced.
| Payment check | Result | Points | Matrix row | What Ora saw |
|---|---|---|---|---|
| x402 | Does not apply | 0 of 2 | x402 in the matrix | No x402 payment protocol support detected. No commerce signals detected - agent-payment protocols are optional for non-commerce sites |
| MPP | Does not apply | 0 of 2 | MPP in the matrix | No MPP (Machine Payments Protocol) support detected. No commerce signals detected - agent-payment protocols are optional for non-commerce sites |
| UCP | Does not apply | 0 of 3 | UCP in the matrix | no UCP (Universal Commerce Protocol) signals detected. No commerce signals detected - agent-payment protocols are optional for non-commerce sites |
| ACP | Does not apply | 0 of 3 | ACP in the matrix | no ACP (Agentic Commerce Protocol) signals detected. No commerce signals detected - agent-payment protocols are optional for non-commerce sites |
The other layers, check by check
Every check Ora ran on lowes.com, grouped by layer, with the result, the points and what Ora recorded where its wording passes this site's gate.
Discovery: 6 of 10
| Check | Result | Points | What Ora saw |
|---|---|---|---|
| ARD discovery | Fail | 0 of 1 | No /.well-known/ard.json, no same-site rel="ard" link, and no legacy /.well-known/ai-catalog.json |
| Developer resource discoverability | Pass | 4 of 4 | Pass, no detail recorded. |
| Brand name discoverability | Fail | 0 of 3 | lowes.com was not in the top 10 for "Access Denied" (searched your brand name alone: no main product term from your homepage qualified) |
| NPM/PyPI SDK package | Pass | 1 of 1 | Pass, no detail recorded. |
| Agent platform configs | Fail | 0 of 1 | Could not locate a public repo containing agent configs or rules. If our probes missed it, AI coding agents likely will too - link the repo from your homepage or docs so it's discoverable. |
| Agent Plugins manifest | Fail | 0 of 1 | No Agent Plugins manifest (plugin.json) found in discovered repos |
| ChatGPT app listed | Fail | 0 of 2 | Not found in ChatGPT app directory |
| Homepage not hidden from search | Pass | 1 of 1 | No noindex on the homepage: no robots, googlebot or bingbot meta tag and no X-Robots-Tag header hides it from search. |
Access: 13.67 of 25
| Check | Result | Points | What Ora saw |
|---|---|---|---|
| Sitemap exists | Fail | 0 of 1 | No sitemap found |
| Content without JavaScript | Partial | 1.67 of 5 | Homepage: Only 207 chars of text content - agents see limited content. No inner pages checked: the scan found none to sample. |
| Not blocked by bot detection | Partial | 1 of 2 | Some agents blocked: ChatGPT-User, OAI-SearchBot, PerplexityBot. A normal browser visit from us got in. |
| Listed on skills.sh | Fail | 0 of 1 | No official skills self-published on skills.sh (100 community skills with potential relation to this domain found, but only self-published official skills count) |
| NLWeb Schema Feeds | Partial | 0 of 1 | robots.txt blocked by WAF/bot protection - cannot check for Schema Feeds |
| MCP well-known discovery | Fail | 0 of 2 | No MCP server URL discovered |
| HTTP Link headers (RFC 8288) | Fail | 0 of 1 | Link header present but no agent-relevant rel values (sitemap, describedby, alternate, service-desc) |
| JSON-LD structured data | Fail | 0 of 2 | No JSON-LD structured data found on homepage |
| Public API/docs linked from homepage | Pass | 4 of 4 | Documentation site found at https://developer.lowes.com |
| Skills.sh skill quality | Fail | 0 of 2 | No official skills on skills.sh to evaluate |
| JSON-LD entity linking (sameAs) | Fail | 0 of 1 | No JSON-LD found - no entity linking possible |
| Metadata completeness | Fail | 0 of 1 | No metadata signals found - missing: canonical URL, HTML lang attribute, og:image, og:type |
| Organization schema completeness | Fail | 0 of 1 | No JSON-LD found - Organization schema missing |
| Markdown alternate link | Fail | 0 of 1 | No sampled page advertises a markdown alternate. Add <link rel="alternate" type="text/markdown" href="..."> (or the equivalent Link response header) pointing at a markdown twin of the page. |
| Redirect hygiene | Pass | 1 of 1 | Pass, no detail recorded. |
| Page token budget | Pass | 1 of 1 | All 1 measured page fit an agent context budget (largest ~1K tokens) |
| Developer portal | Pass | 5 of 5 | Developer documentation portal found at https://developer.lowes.com |
| API catalog (RFC 9727) | Fail | 0 of 2 | No /.well-known/api-catalog found (RFC 9727) |
| Markdown agent docs | Fail | 0 of 1 | Missing markdown content negotiation. Homepage returned text/html when probed with Accept: text/markdown (expected text/markdown), and none of the well-known root paths (/llms.md, /auth.md, /agents.md, /developers.md |
| Markdown content negotiation (acceptmarkdown.com) | Fail | 0 of 1 | Homepage https://lowes.com does not meet the Markdown negotiation requirements: Accept: text/markdown returned text/html; Vary header missing Accept (got "accept-encoding") |
| Agent crawler reachability | Partial | 0 of 1 | Some agents are blocked - ChatGPT-User: blocked, OAI-SearchBot: blocked, Claude-User: reachable, PerplexityBot: blocked. A normal browser visit from us got in. |
Usability: 9 of 39
| Check | Result | Points | What Ora saw |
|---|---|---|---|
| Public API with reachable endpoints | Pass | 8 of 8 | API described in documentation at https://developer.lowes.com but no machine-verifiable API surface confirmed. GraphQL endpoint at https://api.lowes.com/graphql is reachable |
| Agent onboarding friction | Partial | 1 of 2 | Onboarding signals described but not verified live: self-serve key generation, sandbox/test environment |
| auth.md structure | Fail | 0 of 2 | No /auth.md found at site root |
| WebMCP support | Fail | 0 of 8 | No WebMCP support detected - no document.modelContext / navigator.modelContext usage found |
| Rate limit response headers | Fail | 0 of 2 | GraphQL introspection auth-gated and no header convention documented on GraphQL-tagged pages |
| Idempotency-Key support | Fail | 0 of 3 | GraphQL introspection auth-gated and no idempotency documentation found on GraphQL-tagged pages |
| CLI tool available | Fail | 0 of 3 | No CLI tool found |
| NLWeb /ask endpoint | Pass | 1 of 1 | NLWeb /ask endpoint exists but requires authentication (HTTP 403, via GET) |
| MCP server-card.json | Fail | 0 of 2 | No MCP server card found (checked /.well-known/mcp/server-card.json, the site's ai-catalog.json, servers[].card in mcp.json, and <server>/server-card) |
| Product + docs MCP coverage | Fail | 0 of 2 | This bonus needs two MCP servers: one for your product so agents can take actions, and a separate one for your documentation so agents can answer questions from your docs. |
| GraphQL typed error model | Fail | 0 of 3 | GraphQL introspection auth-gated and no typed graphql error model documentation found on GraphQL-tagged pages |
| GraphQL versioning / deprecation policy | Fail | 0 of 2 | GraphQL introspection auth-gated and no graphql versioning / deprecation policy documentation found on GraphQL-tagged pages |
| GraphQL pagination pattern | Fail | 0 of 2 | GraphQL introspection auth-gated and no graphql pagination pattern documentation found on GraphQL-tagged pages |
| GraphQL async-job pattern | Fail | 0 of 2 | GraphQL introspection auth-gated and no graphql async-job pattern documentation found on GraphQL-tagged pages |
| Accessibility-tree injection safety (bonus) | Pass | 2 of 2 | Pass, no detail recorded. |
| MCP Apps support | Fail | 0 of 4 | No MCP Apps support detected - this product has an in-agent UI surface but exposes no ui:// resources or tool UI metadata for agents to render. |
The fixes worth most points
Ora attaches an estimate to each failing or partial check: how many points the site would gain by passing it. These are the 5 with the largest estimates for Lowe's.
- WebMCP support
- Fail, 0 of 8, about 9.1 points to gain. Ora saw:
No WebMCP support detected - no document.modelContext / navigator.modelContext usage found
. - Brand name discoverability
- Fail, 0 of 3, about 6.7 points to gain. Ora saw:
lowes.com was not in the top 10 for "Access Denied" (searched your brand name alone: no main product term from your homepage qualified)
. - MCP Apps support
- Fail, 0 of 4, about 4.6 points to gain. Ora saw:
No MCP Apps support detected - this product has an in-agent UI surface but exposes no ui:// resources or tool UI metadata for agents to render
. - Content without JavaScript
- Partial, 1.67 of 5, about 4.4 points to gain. Ora saw:
Homepage: Only 207 chars of text content - agents see limited content. No inner pages checked: the scan found none to sample
. - CLI tool available
- Fail, 0 of 3, about 3.4 points to gain. Ora saw:
No CLI tool found
.
Our read
Lowe's answered Ora with a page titled Access Denied, and the scan read that title as the brand: the brand search ran on the words Access Denied, found nothing, and costs 6.7 points that say more about the probe than the retailer. Bot management challenged GPTBot, ChatGPT-User and PerplexityBot, robots.txt answered with a 403 challenge, and the home page gave 207 characters of text, so the door and the content rows read as shut. Ora found no commerce signals past that, so the six payment checks did not apply on this read, which for the second home improvement chain in the United States is the wall rather than the shop. developer.lowes.com exists and describes an API with no machine-verifiable surface, its llms.txt returns an HTML page, and there is no OpenAPI specification, no MCP server and no OAuth discovery. Ora matched a Wikidata item without a Wikipedia article. Letting the named agents through fixes the door, the brand search and the content row in one setting.
Test your own checkout
The scan above is free and needs no account: enter a domain at ora.ai and read the same layers for your own site, with the six payment checks mapped to this matrix on the Ora Payments page. The command below runs the same audit from a terminal and exits with 1 under the score you set, so it can gate a deploy. Why Ora, and its limits.
npx ax@0.10 audit https://example.com --min-score 70All 360 checks, one company a day. Corrections to the corrections page.
Sources
- ora.ai/api/score/lowes.com, Ora's scan (vendor), read 14 Nov 2026
- Ora's scoring rules, version 3 (vendor), read 14 Nov 2026
- Ora check catalog (GET /api/checks), read 14 Nov 2026
- lowes.com, the company's site, read 14 Nov 2026
Last reviewed