360 check, 9 Nov 2026
Ryanair on the pay layer: the 360 agent-readiness check
In short
Ryanair scores 42 of 100 on Ora's agent-readiness scan, a D, read 14 Nov 2026. The six payment checks did not apply to ryanair.com on this read, which is how Ora treats a site it does not read as a shop. A live MCP gateway in production, behind a home page of seven characters.
On 14 Nov 2026 the public site at ryanair.com scored 42 of 100 on Ora's agent-readiness scan, a D, in Ora's Travel & Hospitality category. Ryanair is Europe's largest airline by passengers, selling only direct, so this check reads the Payments layer first: the six checks that look for x402, MPP, UCP, ACP and AP2 on the domain, the same protocols this site's matrix tracks row by row. The other layers follow, with every check Ora ran and what it saw. Ora's one-line summary: Leaves agents almost nothing to work with: no OpenAPI spec, no developer portal.
The score
| Layer | Points | Share | What the layer asks |
|---|---|---|---|
| Discovery | 7.5 of 16 | 47% | Can agents find and recommend it |
| Access | 7.17 of 41 | 17% | Can agents read it |
| Usability | 65.15 of 112 | 58% | Can agents use it |
| Payments | 0 of 0 | none apply | Can agents pay |
| Total | 42 of 100 | 42% | Grade D |
The pay layer
Ora did not run the six payment checks against ryanair.com on this read: it marks them not applicable on a site it does not read as a shop, so the layer has no maximum and costs nothing. A travel seller that sells online can still publish any of the five protocols; the matrix says which processors and platforms carry each one. Each protocol links to its matrix row, where the processors and platforms that carry it are dated and sourced.
| Payment check | Result | Points | Matrix row | What Ora saw |
|---|---|---|---|---|
| x402 | Does not apply | 0 of 2 | x402 in the matrix | No x402 payment protocol support detected. No commerce signals detected - agent-payment protocols are optional for non-commerce sites |
| MPP | Does not apply | 0 of 2 | MPP in the matrix | No MPP (Machine Payments Protocol) support detected. No commerce signals detected - agent-payment protocols are optional for non-commerce sites |
| UCP | Does not apply | 0 of 3 | UCP in the matrix | no UCP (Universal Commerce Protocol) signals detected. No commerce signals detected - agent-payment protocols are optional for non-commerce sites |
| ACP | Does not apply | 0 of 3 | ACP in the matrix | no ACP (Agentic Commerce Protocol) signals detected. No commerce signals detected - agent-payment protocols are optional for non-commerce sites |
The other layers, check by check
Every check Ora ran on ryanair.com, grouped by layer, with the result, the points and what Ora recorded where its wording passes this site's gate.
Discovery: 7.5 of 16
| Check | Result | Points | What Ora saw |
|---|---|---|---|
| ARD discovery | Partial | 0 of 1 | /.well-known/ard.json exists but is not valid JSON |
| AI Catalog discovery | Partial | 0 of 1 | /.well-known/ai-catalog.json exists but is not valid JSON |
| Developer resource discoverability | Fail | 0 of 4 | In a search for your API docs, none of the 10 results is your official docs. In a search for your MCP server, SDK or CLI, none of the 10 results is your own, although the scan found one on your site |
| Brand name discoverability | Pass | 3 of 3 | ryanair.com ranks #4 for "Ryanair" (searched your brand name alone: no main product term from your homepage qualified) |
| robots.txt AI crawler policy | Partial | 0.5 of 1 | robots.txt answered an HTML page instead of rules. Crawlers find no rules in it and read the whole site, so your AI crawler policy is not stated. Serve a plain-text robots.txt |
| Listed in MCP registries | Fail | 0 of 3 | No verified entry in the official MCP Registry or on Smithery, and no npm or PyPI package of yours that runs as an MCP server. To pass |
| NPM/PyPI SDK package | Pass | 1 of 1 | Pass, no detail recorded. |
| Agent platform configs | Fail | 0 of 1 | Could not locate a public repo containing agent configs or rules. If our probes missed it, AI coding agents likely will too - link the repo from your homepage or docs so it's discoverable. |
| Agent Plugins manifest | Fail | 0 of 1 | No Agent Plugins manifest (plugin.json) found in discovered repos |
| Registry branding | Fail | 0 of 2 | No registry branding (name, icon, description) found |
| ChatGPT app listed | Pass | 2 of 2 | Pass, no detail recorded. |
| Homepage not hidden from search | Pass | 1 of 1 | No noindex on the homepage: no robots, googlebot or bingbot meta tag and no X-Robots-Tag header hides it from search. |
Access: 7.17 of 41
| Check | Result | Points | What Ora saw |
|---|---|---|---|
| Sitemap exists | Fail | 0 of 1 | No sitemap found |
| Content without JavaScript | Partial | 1.67 of 5 | Homepage: The homepage has little text without JavaScript (7 chars), though nothing in it shows it needs JavaScript to render. No inner pages checked: the scan found none to sample. |
| Not blocked by bot detection | Pass | 2 of 2 | Site accessible to 4 agent user-agents (ChatGPT-User, OAI-SearchBot, Claude-User, PerplexityBot). |
| Agent discovery file | Fail | 0 of 2 | No agent discovery file found |
| A2A / agent-card | Fail | 0 of 2 | No A2A agent card found at /.well-known/agent-card.json |
| Listed on skills.sh | Fail | 0 of 1 | No official skills self-published on skills.sh (5 community skills with potential relation to this domain found, but only self-published official skills count) |
| pricing.md exists | Partial | 1 of 2 | pricing.md found at /pricing.md (1 line), but it has fewer than 5 lines and it does not open with a # heading - add plan tiers, prices, and feature breakdowns; start it with a # title so agents read it as markdown |
| NLWeb Schema Feeds | Fail | 0 of 1 | No schemamap: directive in robots.txt |
| MCP well-known discovery | Partial | 1 of 2 | MCP server at https://mcp.ryanair.com/mcp - list its server card, hosted on your own domain, in /.well-known/ai-catalog.json so MCP clients can discover it |
| HTTP Link headers (RFC 8288) | Fail | 0 of 1 | No HTTP Link response headers (RFC 8288) found |
| Markdown URL fallback | Fail | 0 of 2 | Homepage does not support the .md suffix. Probed https://ryanair.com/index.md and it did not return markdown (expected text/markdown content-type or a heading-led non-HTML body). |
| Modular llms.txt per product area | Fail | 0 of 1 | No section-level llms.txt found. Tried /docs/llms.txt, /api/llms.txt, /developers/llms.txt, /guides/llms.txt, /reference/llms.txt. This is a bonus check: it can add a point and never costs one. |
| llms.txt exists | Partial | 0 of 1 | A file is present at https://ryanair.com/llms.txt, but it returns an HTML page rather than a plain-text llms.txt. |
| llms.txt formatting | Fail | 0 of 2 | No llms.txt found to evaluate quality |
| JSON-LD structured data | Fail | 0 of 2 | No JSON-LD structured data found on homepage |
| Pricing info accessible | Fail | 0 of 3 | No pricing page or pricing data found |
| Public API/docs linked from homepage | Fail | 0 of 4 | No public API or documentation page linked from homepage |
| Agent instruction / when-to-use | Fail | 0 of 1 | No agent instruction file with when-to-use guidance found |
| Skills.sh skill quality | Fail | 0 of 2 | No official skills on skills.sh to evaluate |
| JSON-LD entity linking (sameAs) | Fail | 0 of 1 | No JSON-LD found - no entity linking possible |
| Metadata completeness | Partial | 0.5 of 1 | Only 1/4 metadata signals present - missing: canonical URL, og:image, og:type |
| Organization schema completeness | Fail | 0 of 1 | No JSON-LD found - Organization schema missing |
| Trust anchor pages | Fail | 0 of 1 | No trust anchor pages found with sufficient content (About, Contact, Privacy) |
| Markdown alternate link | Fail | 0 of 1 | No sampled page advertises a markdown alternate. Add <link rel="alternate" type="text/markdown" href="..."> (or the equivalent Link response header) pointing at a markdown twin of the page. |
| Redirect hygiene | Pass | 1 of 1 | Pass, no detail recorded. |
| Page token budget | Pass | 1 of 1 | All 1 measured page fit an agent context budget (largest ~1K tokens) |
| OpenAPI spec published | Fail | 0 of 8 | No OpenAPI/Swagger specification found |
| Developer portal | Fail | 0 of 5 | No developer portal found |
| API catalog (RFC 9727) | Partial | 1 of 2 | api-catalog responded but body is not valid JSON |
| Markdown agent docs | Fail | 0 of 1 | Missing markdown content negotiation. Homepage returned text/html when probed with Accept: text/markdown (expected text/markdown), and none of the well-known root paths (/llms.md, /auth.md, /agents.md, /developers.md |
| Markdown content negotiation (acceptmarkdown.com) | Fail | 0 of 1 | Homepage https://ryanair.com does not meet the Markdown negotiation requirements: Accept: text/markdown returned text/html; Vary header missing Accept (got "accept-encoding") |
| Bot-UA markdown serving | Fail | 0 of 1 | No probed bot User-Agent (ChatGPT-User, Claude-User, Perplexity-User) receives markdown when requesting HTML. Optional: detect AI-bot UAs server-side and serve them a markdown representation directly. |
| Agent crawler reachability | Pass | 1 of 1 | Reachable to every agent we tested - ChatGPT-User: reachable, OAI-SearchBot: reachable, Claude-User: reachable, PerplexityBot: reachable |
Usability: 65.15 of 112
| Check | Result | Points | What Ora saw |
|---|---|---|---|
| MCP tool descriptions | Partial | 3.8 of 4 | All 6 tools on product MCP have detailed descriptions (>= 20 chars). Descriptions grade 95/100 for depth: an agent picks well when each one runs 80 characters or more and says when to use the tool and what it returns. |
| MCP parameter schemas | Pass | 3 of 3 | Pass, no detail recorded. |
| MCP server identity | Pass | 1 of 1 | Pass, no detail recorded. |
| MCP tool listing | Partial | 2.85 of 3 | product MCP exposes 6 tools - substantial tool surface. The tool list costs about 2,860 tokens of an agent's context, 477 per tool across 6 tools; up to 400 per tool leaves room for the task. |
| MCP tool naming | Fail | 0 of 2 | Mixed naming conventions across tools |
| Public API with reachable endpoints | Pass | 8 of 8 | GraphQL endpoint at https://ryanair.com/graphql is reachable; introspection requires authentication (API key / OAuth), which is expected for agent access. Best-of-protocols score: 7/7. |
| OAuth 2.0 support | Pass | 5 of 5 | OAuth authorization server metadata at https://help.ryanair.com/mcp/oauth |
| Scoped permissions | Fail | 0 of 5 | No declared OAuth scopes, security schemes, or scoped-permission documentation found |
| Agent onboarding friction | Fail | 0 of 2 | High onboarding friction - no free tier, self-serve keys, or sandbox detected |
| Web Bot Auth directory | Partial | 1 of 2 | Web Bot Auth directory found but body is not valid JSON |
| OAuth Protected Resource metadata (RFC 9728) | Fail | 0 of 2 | No /.well-known/oauth-protected-resource found (RFC 9728) |
| auth.md exists | Fail | 0 of 2 | Path https://ryanair.com/auth.md returned HTML (SPA / 404 fallback), not an auth.md document |
| auth.md structure | Fail | 0 of 2 | No /auth.md found at site root |
| Agent auth discovery metadata | Partial | 1 of 3 | Only PRM present; spec calls for both PRM and AS metadata |
| Agent auth WWW-Authenticate hint | Fail | 0 of 1 | No 401 with WWW-Authenticate: Bearer resource_metadata=... found. Probed [https://ryanair.com/api, https://ryanair.com/api/v1, https://ryanair.com/v1, https://ryanair.com/v2, https://ryanair.com/agent/identity |
| agent_auth endpoints reachable | Fail | 0 of 2 | No agent_auth endpoint URIs found in AS metadata or /auth.md prose; nothing to probe |
| MCP server / manifest | Pass | 10 of 10 | MCP server connected via Streamable HTTP - MCP-GATEWAY-PUBLIC-PROD v1.0.0 (protocol 2025-11-25; extensions: io.modelcontextprotocol/tasks) |
| MCP error handling | Pass | 2 of 2 | Pass, no detail recorded. |
| MCP modern transport | Pass | 1 of 1 | Pass, no detail recorded. |
| WebMCP support | Fail | 0 of 8 | No WebMCP support detected - no document.modelContext / navigator.modelContext usage found (scanned 3 of 3 same-origin script bundle(s) for modelContext registrations) |
| Rate limit response headers | Fail | 0 of 2 | GraphQL introspection auth-gated and no header convention documented on GraphQL-tagged pages |
| Idempotency-Key support | Fail | 0 of 3 | GraphQL introspection auth-gated and no idempotency documentation found on GraphQL-tagged pages |
| JSON error responses | Fail | 0 of 3 | API does not return JSON error responses (or no API detected) |
| CLI tool available | Fail | 0 of 3 | No CLI tool found |
| NLWeb /ask endpoint | Pass | 1 of 1 | NLWeb /ask endpoint exists but requires authentication (HTTP 403, via POST) |
| NLWeb streaming support | Fail | 0 of 1 | NLWeb /ask requires authentication - cannot verify streaming |
| MCP tool annotations | Pass | 3 of 3 | Pass, no detail recorded. |
| MCP server instructions | Pass | 1 of 1 | Pass, no detail recorded. |
| MCP tools are distinguishable | Pass | 2 of 2 | Pass, no detail recorded. |
| MCP tool output schemas | Fail | 0 of 3 | 0 of 6 tools on product MCP declare an outputSchema that describes their result fields |
| MCP server-card.json | Fail | 0 of 2 | No MCP server card found for https://mcp.ryanair.com/mcp (checked /.well-known/mcp/server-card.json, the site's ai-catalog.json, servers[].card in mcp.json, and <server>/server-card) |
| Product + docs MCP coverage | Fail | 0 of 2 | You run an MCP server for your product, but not one for your documentation. This bonus needs two MCP servers: one for your product so agents can take actions |
| Sandbox / test environment | Fail | 0 of 2 | No sandbox or test environment found |
| MCP resources exposed | Pass | 3 of 3 | Pass, no detail recorded. |
| GraphQL typed error model | Fail | 0 of 3 | GraphQL introspection auth-gated and no typed graphql error model documentation found on GraphQL-tagged pages |
| GraphQL versioning / deprecation policy | Fail | 0 of 2 | GraphQL introspection auth-gated and no graphql versioning / deprecation policy documentation found on GraphQL-tagged pages |
| GraphQL pagination pattern | Fail | 0 of 2 | GraphQL introspection auth-gated and no graphql pagination pattern documentation found on GraphQL-tagged pages |
| GraphQL async-job pattern | Fail | 0 of 2 | GraphQL introspection auth-gated and no graphql async-job pattern documentation found on GraphQL-tagged pages |
| Agent-friendly 404s | Fail | 0 of 2 | Nonexistent paths return HTTP 200 with the app shell (soft-404). Agents probing for resources conclude every path exists. Return a real HTTP 404 status for unknown paths. |
| Accessibility-tree injection safety (bonus) | Pass | 2 of 2 | Pass, no detail recorded. |
| MCP Apps support | Pass | 4 of 4 | Pass, no detail recorded. |
| A2UI / generative UI support | Pass | 2 of 2 | Pass, no detail recorded. |
| MCP Apps UI quality | Partial | 3 of 4 | Good: correct MIME type, valid HTML5. Missing: no color-scheme meta tag |
| MCP App view reachable | Pass | 4 of 4 | Pass, no detail recorded. |
| MCP App view CSP | Pass | 4 of 4 | Pass, no detail recorded. |
| API schema complexity analysis | Partial | 0.5 of 2 | REST: OpenAPI spec found but failed to parse for complexity analysis | GraphQL: introspection auth-gated and no schema evidence in docs | Combined score: 0.5/2 |
| Function calling compatibility | Partial | 1 of 2 | API spec found but couldn't validate function calling compatibility |
| MCP resource quality | Pass | 3 of 3 | Pass, no detail recorded. |
The fixes worth most points
Ora attaches an estimate to each failing or partial check: how many points the site would gain by passing it. These are the 5 with the largest estimates for Ryanair.
- OpenAPI spec published
- Fail, 0 of 8, about 6.5 points to gain. Ora saw:
No OpenAPI/Swagger specification found
. - Developer resource discoverability
- Fail, 0 of 4, about 5.6 points to gain. Ora saw:
In a search for your API docs, none of the 10 results is your official docs. In a search for your MCP server, SDK or CLI, none of the 10 results is your own, although the scan found one on your site
. - Listed in MCP registries
- Fail, 0 of 3, about 4.2 points to gain. Ora saw:
No verified entry in the official MCP Registry or on Smithery, and no npm or PyPI package of yours that runs as an MCP server. To pass
. - Developer portal
- Fail, 0 of 5, about 4.1 points to gain. Ora saw:
No developer portal found
. - Public API/docs linked from homepage
- Fail, 0 of 4, about 3.3 points to gain. Ora saw:
No public API or documentation page linked from homepage
.
Our read
Ryanair has a live MCP server and a home page of seven characters. Ora connected to MCP-GATEWAY-PUBLIC-PROD version 1.0.0 over Streamable HTTP on the 2025-11-25 protocol, found OAuth authorization server metadata at help.ryanair.com/mcp/oauth, a published SDK and a ChatGPT app listing, which is why the Usability layer reads 64.5 of 104. The reading side is the opposite: seven characters of home page text, robots.txt answering with an HTML page instead of rules, an llms.txt at /.well-known/llms.txt that is an HTML page too, no JSON-LD and no sitemap, so the Access layer reads 10 of 54. Ora found no commerce signals, so the six payment checks did not apply on this read, on the airline that carries more passengers in Europe than any other. Ora found neither an OpenAPI specification nor a developer portal, and no declared scopes. The domain ranks fifth for its own name. The server is ready for the agent; the page the agent lands on is not.
Test your own checkout
The scan above is free and needs no account: enter a domain at ora.ai and read the same layers for your own site, with the six payment checks mapped to this matrix on the Ora Payments page. The command below runs the same audit from a terminal and exits with 1 under the score you set, so it can gate a deploy. Why Ora, and its limits.
npx ax@0.10 audit https://example.com --min-score 70All 360 checks, one company a day. Corrections to the corrections page.
Sources
- ora.ai/api/score/ryanair.com, Ora's scan (vendor), read 14 Nov 2026
- Ora's scoring rules, version 3 (vendor), read 14 Nov 2026
- Ora check catalog (GET /api/checks), read 14 Nov 2026
- ryanair.com, the company's site, read 14 Nov 2026
Last reviewed