360 check, 9 Nov 2026
Shein on the pay layer: the 360 agent-readiness check
Shein scores 36 of 100 on Ora's agent-readiness scan, a D, read 14 Nov 2026. Ora probed the six payment checks on shein.com and found no x402, MPP, UCP, ACP or AP2 signal, so the pay layer reads 0 of 0. An llms.txt and markdown on request, in front of a pay layer with nothing on it.
On 14 Nov 2026 the public site at shein.com scored 36 of 100 on Ora's agent-readiness scan, a D, in Ora's E-commerce category. Shein is the online fashion retailer that ships from China to more than 150 countries, so this check reads the Payments layer first: the six checks that look for x402, MPP, UCP, ACP and AP2 on the domain, the same protocols this site's matrix tracks row by row. The other layers follow, with every check Ora ran and what it saw. Ora's one-line summary: Shein has a robots.txt AI crawler policy, but lacks an OpenAPI specification.
The score
| Layer | Points | Share | What the layer asks |
|---|---|---|---|
| Discovery | 10 of 14 | 71% | Can agents find and recommend it |
| Access | 17 of 52 | 33% | Can agents read it |
| Usability | 11 of 53 | 21% | Can agents use it |
| Payments | 0 of 0 | none apply | Can agents pay |
| Total | 36 of 100 | 36% | Grade D |
The pay layer
Ora reads shein.com as a shop, probed all six payment checks and found none of the five protocols. The checks are bonus checks: a protocol found would have scored the layer, and none found costs nothing, which is why the layer reads 0 of 0. A shopper's agent has no protocol to pay this retailer through from the domain itself. Each protocol links to its matrix row, where the processors and platforms that carry it are dated and sourced.
| Payment check | Result | Points | Matrix row | What Ora saw |
|---|---|---|---|---|
| x402 | Not found | 0 of 2 | x402 in the matrix | No x402 payment protocol support detected |
| MPP | Not found | 0 of 2 | MPP in the matrix | No MPP (Machine Payments Protocol) support detected |
| UCP | Not found | 0 of 3 | UCP in the matrix | no UCP (Universal Commerce Protocol) signals detected |
| ACP | Not found | 0 of 3 | ACP in the matrix | no ACP (Agentic Commerce Protocol) signals detected |
| ACP delegate payment | Not found | 0 of 3 | ACP in the matrix | No ACP Delegate Payment signals detected |
| AP2 | Not found | 0 of 3 | AP2 in the matrix | No AP2 (Agent Payments Protocol) signals detected |
The other layers, check by check
Every check Ora ran on shein.com, grouped by layer, with the result, the points and what Ora recorded where its wording passes this site's gate.
Discovery: 10 of 14
| Check | Result | Points | What Ora saw |
|---|---|---|---|
| ARD discovery | Fail | 0 of 1 | No /.well-known/ard.json (and no legacy /.well-known/ai-catalog.json) |
| Developer resource discoverability | Fail | 0 of 3 | Agent searched for "shein" developer resources but found nothing relevant |
| Brand name discoverability | Pass | 3 of 3 | shein.com ranks #1 for "SHEIN USA online fashion" |
| Wikipedia / Wikidata entity presence | Pass | 4 of 4 | Wikipedia "Shein" and Wikidata Q107377209 both verified - domain confirmed on both sources |
| robots.txt AI crawler policy | Pass | 2 of 2 | Training: 2/2. Search: 3/3 page/crawler pairs permitted. No applicable crawl or usage restriction found for 5 training and search crawlers (gptbot, claudebot, oai-searchbot, claude-searchbot |
| NPM/PyPI SDK package | Pass | 1 of 1 | Pass, no detail recorded. |
| Agent platform configs | Fail | 0 of 1 | Could not locate a public repo containing agent configs or rules. If our probes missed it, AI coding agents likely will too - link the repo from your homepage or docs so it's discoverable. |
| Agent Plugins manifest | Fail | 0 of 1 | No Agent Plugins manifest (plugin.json) found in discovered repos |
| ChatGPT app listed | Fail | 0 of 2 | Not found in ChatGPT app directory |
Access: 17 of 52
| Check | Result | Points | What Ora saw |
|---|---|---|---|
| Sitemap exists | Fail | 0 of 2 | No sitemap found |
| Content without JavaScript | Partial | 1 of 3 | 648 chars of readable text, but no H1 tag |
| Not blocked by bot detection | Pass | 2 of 2 | Site accessible to 6 AI agent user-agents |
| Agent discovery file | Fail | 0 of 2 | No agent discovery file found |
| A2A / agent-card | Fail | 0 of 2 | No A2A agent card found at /.well-known/agent-card.json |
| Listed on skills.sh | Fail | 0 of 1 | No official skills self-published on skills.sh (100 community skills with potential relation to this domain found, but only self-published official skills count) |
| pricing.md exists | Fail | 0 of 2 | No pricing.md found - agents need machine-readable pricing to compare products and make purchase recommendations |
| NLWeb Schema Feeds | Fail | 0 of 1 | No schemamap: directive in robots.txt |
| MCP well-known discovery | Fail | 0 of 2 | No MCP server URL discovered |
| Agent mode view | Partial | 1 of 2 | Agent mode view found at ?mode=agent (3 signals: api, agent, sdk) |
| HTTP Link headers (RFC 8288) | Fail | 0 of 1 | No HTTP Link response headers (RFC 8288) found |
| Markdown URL fallback | Fail | 0 of 2 | Homepage does not support the .md suffix. Probed https://shein.com/index.md and it did not return markdown (expected text/markdown content-type or a heading-led non-HTML body). |
| Modular llms.txt per product area | Fail | 0 of 1 | No section-level llms.txt files found (optional) |
| robots.txt agent-user policy | Pass | 2 of 2 | No applicable crawl or usage restriction found for 3 user-triggered agents (chatgpt-user, claude-user, perplexity-user) on 1 public page: https://shein.com/. Declared policy only |
| llms.txt exists | Pass | 1 of 1 | Found the llms.txt at https://shein.com/llms.txt. |
| llms.txt formatting | Partial | 1 of 2 | The llms.txt is well-formatted with markdown links, but at 63,743 characters it exceeds the 30,000-character recommendation for a navigation index. |
| JSON-LD structured data | Partial | 1 of 4 | JSON-LD found (1 block(s)) but no identity type - use SoftwareApplication, Product, Organization, Person, or Article so agents can tell what this site is |
| Pricing info accessible | Fail | 0 of 3 | No pricing page or pricing data found |
| Public API/docs linked from homepage | Fail | 0 of 3 | No public API or documentation page linked from homepage |
| Agent instruction / when-to-use | Fail | 0 of 3 | No agent instruction file with when-to-use guidance found |
| Skills.sh skill quality | Fail | 0 of 2 | No official skills on skills.sh to evaluate |
| JSON-LD entity linking (sameAs) | Fail | 0 of 2 | No sameAs entity linking in JSON-LD - agents cannot disambiguate your brand |
| Metadata completeness | Partial | 1 of 2 | 2/4 metadata signals present - missing: og:image, og:type |
| Organization schema completeness | Fail | 0 of 2 | No Organization type found in JSON-LD |
| Schema type breadth | Fail | 0 of 2 | No extended schema types found - AI can only answer basic questions about this entity |
| Trust anchor pages | Fail | 0 of 2 | No trust anchor pages found with sufficient content (About, Contact, Privacy) |
| llms.txt links resolve | Pass | 2 of 2 | Pass, no detail recorded. |
| Markdown alternate link | Fail | 0 of 1 | No sampled page advertises a markdown alternate. Add <link rel="alternate" type="text/markdown" href="..."> (or the equivalent Link response header) pointing at a markdown twin of the page. |
| Redirect hygiene | Pass | 1 of 1 | Pass, no detail recorded. |
| Page token budget | Pass | 1 of 1 | All 6 measured pages fit an agent context budget (largest ~1K tokens) |
| Code fence validity | Pass | 1 of 1 | Pass, no detail recorded. |
| Content behind auth | Pass | 2 of 2 | All 5 sampled pages are publicly readable (0 with substantive content) |
| OpenAPI spec published | Fail | 0 of 7 | No OpenAPI/Swagger specification found |
| API catalog (RFC 9727) | Fail | 0 of 2 | No /.well-known/api-catalog found (RFC 9727) |
| Markdown agent docs | Pass | 1 of 1 | Returns markdown when requested via Accept header |
| Markdown content negotiation (acceptmarkdown.com) | Fail | 0 of 1 | Homepage https://shein.com does not meet the Markdown negotiation requirements: Accept: text/markdown returned text/html; charset=utf-8; Vary header missing Accept (got "none") |
| Bot-UA markdown serving | Fail | 0 of 1 | No probed bot User-Agent (GPTBot, ClaudeBot, ChatGPT-User, PerplexityBot, Google-Extended, Applebot-Extended, ora-agent, DeepSeekBot) receives markdown when requesting HTML. |
| Agent crawler reachability | Pass | 2 of 2 | Reachable to all major AI crawlers - ChatGPT-User: reachable, ClaudeBot: reachable, Google-Extended: reachable, ora-agent: reachable, DeepSeekBot: reachable |
Usability: 11 of 53
| Check | Result | Points | What Ora saw |
|---|---|---|---|
| Public API with reachable endpoints | Fail | 0 of 7 | No publicly reachable API surface detected (REST and GraphQL both absent or auth-gated) |
| OAuth 2.0 support | Fail | 0 of 5 | No OAuth 2.0 or OpenID Connect support detected |
| Scoped permissions | Fail | 0 of 5 | No declared OAuth scopes, security schemes, or scoped-permission documentation found |
| Agent onboarding friction | Partial | 1 of 2 | Onboarding signals described but not verified live: sandbox/test environment |
| Web Bot Auth directory | Fail | 0 of 2 | No /.well-known/http-message-signatures-directory found |
| OAuth Protected Resource metadata (RFC 9728) | Fail | 0 of 2 | No /.well-known/oauth-protected-resource found (RFC 9728) |
| auth.md exists | Fail | 0 of 2 | No /auth.md found at site root |
| auth.md structure | Fail | 0 of 2 | No /auth.md found at site root |
| Agent auth discovery metadata | Fail | 0 of 3 | Neither /.well-known/oauth-protected-resource nor /.well-known/oauth-authorization-server found. Probed: shein.com, api.shein.com. |
| Agent auth WWW-Authenticate hint | Fail | 0 of 1 | No 401 with WWW-Authenticate: Bearer resource_metadata=... found. Probed [https://shein.com/api, https://shein.com/api/v1, https://shein.com/v1, https://shein.com/v2, https://shein.com/agent/identity, https://shein.com/agent/auth |
| agent_auth endpoints reachable | Fail | 0 of 2 | No agent_auth endpoint URIs found in AS metadata or /auth.md prose; nothing to probe |
| MCP server / manifest | Fail | 0 of 6 | No MCP server or manifest found |
| WebMCP support | Fail | 0 of 5 | No WebMCP support detected - no tool-attribute forms and no document.modelContext / navigator.modelContext usage found |
| JSON error responses | Fail | 0 of 4 | API does not return JSON error responses (or no API detected) |
| CLI tool available | Pass | 3 of 3 | CLI package found on npm: shein-open-cli |
| NLWeb /ask endpoint | Fail | 0 of 1 | No NLWeb-conformant /ask endpoint found via GET or POST |
| NLWeb streaming support | Fail | 0 of 1 | NLWeb /ask does not support SSE streaming via GET or POST |
| MCP server-card.json | Fail | 0 of 2 | No MCP server card found (checked /.well-known/mcp/server-card.json, the site's ai-catalog.json, servers[].card in mcp.json, and <server>/server-card) |
| Product + docs MCP coverage | Fail | 0 of 2 | This bonus needs two MCP servers: one for your product so agents can take actions, and a separate one for your documentation so agents can answer questions from your docs. |
| Sandbox / test environment | Fail | 0 of 2 | No sandbox or test environment found |
| Agent-friendly 404s | Partial | 1 of 2 | The nonexistent path https://shein.com/__ora-404-probe-oc09a5ak correctly returns HTTP 404. Partial credit: no Markdown error body was detected. |
| Accessible names on controls | Pass | 2 of 2 | Pass, no detail recorded. |
| Form control labeling | Pass | 2 of 2 | Pass, no detail recorded. |
| Accessibility-tree injection safety (bonus) | Pass | 2 of 2 | Pass, no detail recorded. |
| MCP Apps support | Fail | 0 of 4 | No MCP Apps support detected - this product has an in-agent UI surface but exposes no ui:// resources or tool UI metadata for agents to render. |
| A2UI / generative UI support | Fail | 0 of 2 | No A2UI or generative UI support detected |
| API schema complexity analysis | Fail | 0 of 2 | No API schema detected |
| Function calling compatibility | Fail | 0 of 2 | No API spec found - function calling requires discoverable endpoints |
The fixes worth most points
Ora attaches an estimate to each failing or partial check: how many points the site would gain by passing it. These are the 5 with the largest estimates for Shein.
- Public API with reachable endpoints
- Fail, 0 of 7, about 5.9 points to gain. Ora saw:
No publicly reachable API surface detected (REST and GraphQL both absent or auth-gated)
. - MCP server / manifest
- Fail, 0 of 6, about 5 points to gain. Ora saw:
No MCP server or manifest found
. - Developer resource discoverability
- Fail, 0 of 3, about 4.8 points to gain. Ora saw:
Agent searched for "shein" developer resources but found nothing relevant
. - OpenAPI spec published
- Fail, 0 of 7, about 4.5 points to gain. Ora saw:
No OpenAPI/Swagger specification found
. - OAuth 2.0 support
- Fail, 0 of 5, about 4.2 points to gain. Ora saw:
No OAuth 2.0 or OpenID Connect support detected
.
Our read
Shein publishes an llms.txt at shein.com/llms.txt and returns markdown when an agent asks for it with an Accept header, two rows most retailers here miss, and robots.txt states a policy that permits the five training and three search crawlers Ora checked. The six payment checks were probed on a site Ora reads as a shop and found no x402, MPP, UCP, ACP or AP2 signal, so the pay layer reads 0 of 0. The rest is thin: 648 characters of home page with no H1, a JSON-LD block with no identity type, no sitemap, and an act layer with neither a publicly reachable API nor an OpenAPI specification, and neither an MCP server nor OAuth discovery, where Ora's search for Shein developer resources found nothing relevant. The domain ranks first for its own product term. A fashion retailer that ships to 150 countries and has written the agent text file would be a natural first adopter of a checkout protocol; the matrix shows which platforms carry each one.
Test your own checkout
The scan above is free and needs no account: enter a domain at ora.ai and read the same layers for your own site, with the six payment checks mapped to this matrix on the Ora Payments page. The command below runs the same audit from a terminal and exits with 1 under the score you set, so it can gate a deploy. Why Ora, and its limits.
npx ax@0.10 audit https://example.com --min-score 70All 360 checks, one company a day. Corrections to the corrections page.
Sources
- ora.ai/api/score/shein.com, Ora's scan (vendor), read 14 Nov 2026
- Ora check catalog (GET /api/checks), read 14 Nov 2026
- shein.com, the company's site, read 14 Nov 2026
Last reviewed