360 check, 10 Nov 2026
Sam's Club on the pay layer: the 360 agent-readiness check
In short
Sam's Club scores 51 of 100 on Ora's agent-readiness scan, a C, read 14 Nov 2026. The six payment checks did not apply to samsclub.com on this read, which is how Ora treats a site it does not read as a shop. An open door, an HTML llms.txt, and a checkout that answered 403.
On 14 Nov 2026 the public site at samsclub.com scored 51 of 100 on Ora's agent-readiness scan, a C. Sam's Club is the Walmart-owned warehouse club, so this check reads the Payments layer first: the six checks that look for x402, MPP, UCP, ACP and AP2 on the domain, the same protocols this site's matrix tracks row by row. The other layers follow, with every check Ora ran and what it saw. Ora's one-line summary: Samsclub.com offers developer resource discoverability, but lacks an OpenAPI specification.
The score
| Layer | Points | Share | What the layer asks |
|---|---|---|---|
| Discovery | 11 of 13 | 85% | Can agents find and recommend it |
| Access | 27 of 54 | 50% | Can agents read it |
| Usability | 23 of 68 | 34% | Can agents use it |
| Payments | 0 of 0 | none apply | Can agents pay |
| Total | 51 of 100 | 51% | Grade C |
The pay layer
Ora did not run the six payment checks against samsclub.com on this read: it marks them not applicable on a site it does not read as a shop, so the layer has no maximum and costs nothing. A retailer that sells online can still publish any of the five protocols; the matrix says which processors and platforms carry each one. Each protocol links to its matrix row, where the processors and platforms that carry it are dated and sourced.
| Payment check | Result | Points | Matrix row | What Ora saw |
|---|---|---|---|---|
| x402 | Does not apply | 0 of 2 | x402 in the matrix | Can't verify: a bot shield answered our request to samsclub.com/checkout_sessions (HTTP 403); samsclub.com/agentic_commerce/delegate_payment (HTTP 403); api.samsclub.com/agentic_commerce/delegate_payment (HTTP 403) |
| MPP | Does not apply | 0 of 2 | MPP in the matrix | Can't verify: a bot shield answered our request to samsclub.com/checkout_sessions (HTTP 403); samsclub.com/agentic_commerce/delegate_payment (HTTP 403); api.samsclub.com/agentic_commerce/delegate_payment (HTTP 403) |
| UCP | Does not apply | 0 of 3 | UCP in the matrix | Can't verify: a bot shield answered our request to samsclub.com/checkout_sessions (HTTP 403); samsclub.com/agentic_commerce/delegate_payment (HTTP 403); api.samsclub.com/agentic_commerce/delegate_payment (HTTP 403) |
| ACP | Does not apply | 0 of 3 | ACP in the matrix | Can't verify: a bot shield answered our request to samsclub.com/checkout_sessions (HTTP 403); samsclub.com/agentic_commerce/delegate_payment (HTTP 403); api.samsclub.com/agentic_commerce/delegate_payment (HTTP 403) |
| ACP delegate payment | Does not apply | 0 of 3 | ACP in the matrix | Can't verify: a bot shield answered our request to samsclub.com/checkout_sessions (HTTP 403); samsclub.com/agentic_commerce/delegate_payment (HTTP 403); api.samsclub.com/agentic_commerce/delegate_payment (HTTP 403) |
| AP2 | Does not apply | 0 of 3 | AP2 in the matrix | Can't verify: a bot shield answered our request to samsclub.com/checkout_sessions (HTTP 403); samsclub.com/agentic_commerce/delegate_payment (HTTP 403); api.samsclub.com/agentic_commerce/delegate_payment (HTTP 403) |
The other layers, check by check
Every check Ora ran on samsclub.com, grouped by layer, with the result, the points and what Ora recorded where its wording passes this site's gate.
Discovery: 11 of 13
| Check | Result | Points | What Ora saw |
|---|---|---|---|
| ARD discovery | Fail | 0 of 1 | No /.well-known/ard.json (and no legacy /.well-known/ai-catalog.json) |
| Developer resource discoverability | Pass | 3 of 3 | Pass, no detail recorded. |
| Brand name discoverability | Pass | 3 of 3 | samsclub.com ranks #4 for "Sam’s Club" (searched your brand name alone: no main product term from your homepage qualified) |
| Wikipedia / Wikidata entity presence | Partial | 2 of 4 | Wikidata Q1972120 (Sam's Club) verified - draft a Wikipedia page with cited references to complete knowledge graph coverage |
| robots.txt AI crawler policy | Pass | 2 of 2 | AI search crawlers: allowed in 3 of 3 checks (3 crawlers on 1 page). AI training crawlers: allowed in 2 of 2 checks (2 crawlers on 1 page), not scored. |
| NPM/PyPI SDK package | Fail | 0 of 1 | No NPM or PyPI SDK package found |
| Agent platform configs | Fail | 0 of 1 | Could not locate a public repo containing agent configs or rules. If our probes missed it, AI coding agents likely will too - link the repo from your homepage or docs so it's discoverable. |
| Agent Plugins manifest | Fail | 0 of 1 | No Agent Plugins manifest (plugin.json) found in discovered repos |
| ChatGPT app listed | Fail | 0 of 2 | Not found in ChatGPT app directory |
| Homepage not hidden from search | Pass | 1 of 1 | No noindex on the homepage: no robots, googlebot or bingbot meta tag and no X-Robots-Tag header hides it from search. |
Access: 27 of 54
| Check | Result | Points | What Ora saw |
|---|---|---|---|
| Sitemap exists | Pass | 2 of 2 | Valid sitemap found at https://www.samsclub.com/sitemap.xml with multiple sitemaps entries |
| Content without JavaScript | Partial | 2 of 3 | 1667 chars with H1, but 2.7% content ratio is below the 5% target |
| Not blocked by bot detection | Pass | 2 of 2 | Site accessible to 4 agent user-agents (ChatGPT-User, OAI-SearchBot, Claude-User, PerplexityBot). |
| Agent discovery file | Fail | 0 of 2 | No agent discovery file found |
| A2A / agent-card | Fail | 0 of 2 | No A2A agent card found at /.well-known/agent-card.json |
| Listed on skills.sh | Fail | 0 of 1 | No official skills self-published on skills.sh (2 community skills with potential relation to this domain found, but only self-published official skills count) |
| pricing.md exists | Partial | 1 of 2 | pricing.md found at /pricing.md (450 lines), but it has no pricing words such as price, plan, tier or cost and it does not open with a # heading - add plan tiers, prices, and feature breakdowns |
| NLWeb Schema Feeds | Fail | 0 of 1 | No schemamap: directive in robots.txt |
| MCP well-known discovery | Fail | 0 of 2 | No MCP server URL discovered |
| Agent mode view | Partial | 1 of 2 | Agent mode view detected at ?mode=agent but limited agent-specific content |
| HTTP Link headers (RFC 8288) | Fail | 0 of 1 | No HTTP Link response headers (RFC 8288) found |
| Markdown URL fallback | Fail | 0 of 2 | Homepage does not support the .md suffix. Probed https://samsclub.com/index.md and it did not return markdown (expected text/markdown content-type or a heading-led non-HTML body). |
| Modular llms.txt per product area | Fail | 0 of 1 | No section-level llms.txt found. Tried /docs/llms.txt, /api/llms.txt, /developers/llms.txt, /guides/llms.txt, /reference/llms.txt, /all-departments/llms.txt, /buy-it-again/llms.txt, /account/llms.txt, /orders/llms.txt. |
| Sitemap freshness (lastmod) | Fail | 0 of 1 | None of the 500 sampled sitemap entries carries a lastmod date. Add <lastmod> (W3C datetime) so agents can prioritize fresh content. |
| robots.txt agent-user policy | Pass | 2 of 2 | No applicable crawl or usage restriction found for 3 user-triggered agents (chatgpt-user, claude-user, perplexity-user) on 1 public page: https://samsclub.com/. Declared policy only |
| llms.txt exists | Partial | 0 of 1 | A file is present at https://samsclub.com/llms.txt, but it returns an HTML page rather than a plain-text llms.txt. |
| llms.txt formatting | Fail | 0 of 2 | No llms.txt found to evaluate quality |
| JSON-LD structured data | Partial | 2 of 4 | JSON-LD Organization found - missing description on this entity |
| Pricing info accessible | Fail | 0 of 3 | No pricing page or pricing data found |
| Public API/docs linked from homepage | Pass | 3 of 3 | Documentation site found at https://developer.samsclub.com |
| Agent instruction / when-to-use | Fail | 0 of 3 | No agent instruction file with when-to-use guidance found |
| Skills.sh skill quality | Fail | 0 of 2 | No official skills on skills.sh to evaluate |
| JSON-LD entity linking (sameAs) | Fail | 0 of 2 | No sameAs entity linking in JSON-LD - agents cannot disambiguate your brand |
| Metadata completeness | Pass | 2 of 2 | All metadata signals present: canonical URL, lang="en-US", og:image, og:type |
| Organization schema completeness | Partial | 1 of 2 | Organization schema found but missing: contactPoint, address |
| Schema type breadth | Fail | 0 of 2 | No extended schema types found - AI can only answer basic questions about this entity |
| Trust anchor pages | Partial | 1 of 2 | Only Privacy page verified - missing: About, Contact |
| Markdown alternate link | Fail | 0 of 1 | No sampled page advertises a markdown alternate. Add <link rel="alternate" type="text/markdown" href="..."> (or the equivalent Link response header) pointing at a markdown twin of the page. |
| Redirect hygiene | Pass | 1 of 1 | Pass, no detail recorded. |
| Page token budget | Pass | 1 of 1 | All 1 measured page fit an agent context budget (largest ~1K tokens) |
| OpenAPI spec published | Fail | 0 of 7 | No OpenAPI/Swagger specification found |
| Developer portal | Pass | 6 of 6 | Developer documentation portal found at https://developer.samsclub.com |
| API catalog (RFC 9727) | Fail | 0 of 2 | No /.well-known/api-catalog found (RFC 9727) |
| Markdown agent docs | Fail | 0 of 1 | Missing markdown content negotiation. Homepage returned text/html when probed with Accept: text/markdown (expected text/markdown), and none of the well-known root paths (/llms.md, /auth.md, /agents.md, /developers.md |
| Markdown content negotiation (acceptmarkdown.com) | Fail | 0 of 1 | Homepage https://samsclub.com does not meet the Markdown negotiation requirements: Accept: text/markdown returned text/html; charset=utf-8; Vary header missing Accept (got "accept-encoding") |
| Bot-UA markdown serving | Fail | 0 of 1 | No probed bot User-Agent (GPTBot, ClaudeBot, ChatGPT-User, PerplexityBot, Google-Extended, Applebot-Extended, ora-agent, DeepSeekBot) receives markdown when requesting HTML. |
| Agent crawler reachability | Pass | 2 of 2 | Reachable to every agent we tested - ChatGPT-User: reachable, OAI-SearchBot: reachable, Claude-User: reachable, PerplexityBot: reachable |
Usability: 23 of 68
| Check | Result | Points | What Ora saw |
|---|---|---|---|
| Public API with reachable endpoints | Pass | 7 of 7 | API described in documentation at https://developer.samsclub.com but no machine-verifiable API surface confirmed. GraphQL endpoint at https://api.samsclub.com/graphql is reachable |
| OAuth 2.0 support | Partial | 2 of 5 | OAuth mentioned on homepage but no standard endpoints found |
| Scoped permissions | Fail | 0 of 5 | No declared OAuth scopes, security schemes, or scoped-permission documentation found |
| Agent onboarding friction | Pass | 2 of 2 | Pass, no detail recorded. |
| Web Bot Auth directory | Fail | 0 of 2 | No /.well-known/http-message-signatures-directory found |
| auth.md exists | Fail | 0 of 2 | Path https://samsclub.com/auth.md returned HTML (SPA / 404 fallback), not an auth.md document |
| auth.md structure | Fail | 0 of 2 | No /auth.md found at site root |
| MCP server / manifest | Fail | 0 of 6 | No MCP server or manifest found |
| WebMCP support | Fail | 0 of 5 | No WebMCP support detected - no tool-attribute forms and no document.modelContext / navigator.modelContext usage found (scanned 1 of 1 same-origin script bundle(s) for modelContext registrations) |
| Rate limit response headers | Fail | 0 of 2 | GraphQL introspection auth-gated and no header convention documented on GraphQL-tagged pages |
| Idempotency-Key support | Fail | 0 of 3 | GraphQL introspection auth-gated and no idempotency documentation found on GraphQL-tagged pages |
| CLI tool available | Fail | 0 of 3 | No CLI tool found |
| Multi-language SDK packages | Fail | 0 of 3 | No SDK packages found across language ecosystems |
| NLWeb /ask endpoint | Fail | 0 of 1 | No NLWeb-conformant /ask endpoint found via GET or POST |
| NLWeb streaming support | Fail | 0 of 1 | NLWeb /ask does not support SSE streaming via GET or POST |
| MCP server-card.json | Fail | 0 of 2 | No MCP server card found (checked /.well-known/mcp/server-card.json, the site's ai-catalog.json, servers[].card in mcp.json, and <server>/server-card) |
| Product + docs MCP coverage | Fail | 0 of 2 | This bonus needs two MCP servers: one for your product so agents can take actions, and a separate one for your documentation so agents can answer questions from your docs. |
| Sandbox / test environment | Fail | 0 of 2 | No sandbox or test environment found |
| GraphQL typed error model | Fail | 0 of 3 | GraphQL introspection auth-gated and no typed graphql error model documentation found on GraphQL-tagged pages |
| GraphQL versioning / deprecation policy | Fail | 0 of 2 | GraphQL introspection auth-gated and no graphql versioning / deprecation policy documentation found on GraphQL-tagged pages |
| GraphQL pagination pattern | Fail | 0 of 2 | GraphQL introspection auth-gated and no graphql pagination pattern documentation found on GraphQL-tagged pages |
| GraphQL async-job pattern | Fail | 0 of 2 | GraphQL introspection auth-gated and no graphql async-job pattern documentation found on GraphQL-tagged pages |
| Agent-friendly 404s | Fail | 0 of 2 | Nonexistent paths return HTTP 200 with the app shell (soft-404). Agents probing for resources conclude every path exists. Return a real HTTP 404 status for unknown paths. |
| Accessible document structure | Pass | 3 of 3 | Pass, no detail recorded. |
| Native interactive controls | Pass | 3 of 3 | Pass, no detail recorded. |
| Accessible names on controls | Pass | 2 of 2 | Pass, no detail recorded. |
| Form control labeling | Pass | 2 of 2 | Pass, no detail recorded. |
| Accessibility-tree injection safety (bonus) | Pass | 2 of 2 | Pass, no detail recorded. |
| API schema complexity analysis | Fail | 0 of 2 | GraphQL: introspection auth-gated and no schema evidence in docs |
| Function calling compatibility | Fail | 0 of 2 | No API spec found - function calling requires discoverable endpoints |
The fixes worth most points
Ora attaches an estimate to each failing or partial check: how many points the site would gain by passing it. These are the 5 with the largest estimates for Sam's Club.
- OpenAPI spec published
- Fail, 0 of 7, about 4.3 points to gain. Ora saw:
No OpenAPI/Swagger specification found
. - MCP server / manifest
- Fail, 0 of 6, about 3.9 points to gain. Ora saw:
No MCP server or manifest found
. - Scoped permissions
- Fail, 0 of 5, about 3.3 points to gain. Ora saw:
No declared OAuth scopes, security schemes, or scoped-permission documentation found
. - WebMCP support
- Fail, 0 of 5, about 3.3 points to gain. Ora saw:
No WebMCP support detected - no tool-attribute forms and no document.modelContext / navigator.modelContext usage found (scanned 1 of 1 same-origin script bundle(s) for modelContext registrations)
. - CLI tool available
- Fail, 0 of 3, about 2 points to gain. Ora saw:
No CLI tool found
.
Our read
Sam's Club gives Ora an open door and a shielded till. The six payment checks did not apply on this read, and Ora's note on each is the same: a bot shield answered 403 at samsclub.com/checkout_sessions and at /agentic_commerce/delegate_payment, so the pay layer is unverified rather than failed and reads 0 of 0. The door itself is clear: all four test agents reached the home page, robots.txt allows every AI crawler checked, and no restriction applies to the user-triggered agents. What they can read is 1,667 characters with an H1 at a 2.7 percent content ratio, a valid sitemap, complete metadata, an Organization block without a description, and an llms.txt path that returns HTML instead of plain text. The act layer has a developer portal at developer.samsclub.com, an API described there without a verifiable surface, and OAuth mentioned on the home page with no standard endpoints; neither an MCP server nor an OpenAPI specification, about 4 points each. A C at 51: the shelves are open, the checkout answered 403.
Test your own checkout
The scan above is free and needs no account: enter a domain at ora.ai and read the same layers for your own site, with the six payment checks mapped to this matrix on the Ora Payments page. The command below runs the same audit from a terminal and exits with 1 under the score you set, so it can gate a deploy. Why Ora, and its limits.
npx ax@0.10 audit https://example.com --min-score 70All 360 checks, one company a day. Corrections to the corrections page.
Sources
- ora.ai/api/score/samsclub.com, Ora's scan (vendor), read 14 Nov 2026
- Ora check catalog (GET /api/checks), read 14 Nov 2026
- samsclub.com, the company's site, read 14 Nov 2026
Last reviewed