360 check, 9 Nov 2026
Trip.com on the pay layer: the 360 agent-readiness check
Trip.com scores 21 of 100 on Ora's agent-readiness scan, an F, read 14 Nov 2026. The six payment checks did not apply to trip.com on this read, which is how Ora treats a site it does not read as a shop. A robots.txt that answers I'm a teapot, and a Discovery layer of 13 of 14.
On 14 Nov 2026 the public site at trip.com scored 21 of 100 on Ora's agent-readiness scan, an F, in Ora's Travel & Hospitality category. Trip.com is the international site of China's largest online travel group, so this check reads the Payments layer first: the six checks that look for x402, MPP, UCP, ACP and AP2 on the domain, the same protocols this site's matrix tracks row by row. The other layers follow, with every check Ora ran and what it saw. Ora's one-line summary: Agents hit a wall at the door: no public API, no MCP server, and no OpenAPI spec leave them nothing to use.
The score
| Layer | Points | Share | What the layer asks |
|---|---|---|---|
| Discovery | 8 of 11 | 73% | Can agents find and recommend it |
| Access | 1 of 34 | 3% | Can agents read it |
| Usability | 4 of 50 | 8% | Can agents use it |
| Payments | 0 of 0 | none apply | Can agents pay |
| Total | 21 of 100 | 21% | Grade F |
The pay layer
Ora did not run the six payment checks against trip.com on this read: it marks them not applicable on a site it does not read as a shop, so the layer has no maximum and costs nothing. A travel seller that sells online can still publish any of the five protocols; the matrix says which processors and platforms carry each one. Each protocol links to its matrix row, where the processors and platforms that carry it are dated and sourced.
| Payment check | Result | Points | Matrix row | What Ora saw |
|---|---|---|---|---|
| x402 | Does not apply | 0 of 2 | x402 in the matrix | No x402 payment protocol support detected. No commerce signals detected - agent-payment protocols are optional for non-commerce sites |
| MPP | Does not apply | 0 of 2 | MPP in the matrix | No MPP (Machine Payments Protocol) support detected. No commerce signals detected - agent-payment protocols are optional for non-commerce sites |
| UCP | Does not apply | 0 of 3 | UCP in the matrix | no UCP (Universal Commerce Protocol) signals detected. No commerce signals detected - agent-payment protocols are optional for non-commerce sites |
| ACP | Does not apply | 0 of 3 | ACP in the matrix | no ACP (Agentic Commerce Protocol) signals detected. No commerce signals detected - agent-payment protocols are optional for non-commerce sites |
The other layers, check by check
Every check Ora ran on trip.com, grouped by layer, with the result, the points and what Ora recorded where its wording passes this site's gate.
Discovery: 8 of 11
| Check | Result | Points | What Ora saw |
|---|---|---|---|
| ARD discovery | Fail | 0 of 1 | No /.well-known/ard.json, no same-site rel="ard" link, and no legacy /.well-known/ai-catalog.json |
| Developer resource discoverability | Pass | 4 of 4 | Pass, no detail recorded. |
| Brand name discoverability | Partial | 1 of 3 | trip.com ranks #6 for "trip" (searched your brand name alone: we could not read a product term from your site) |
| NPM/PyPI SDK package | Pass | 1 of 1 | Pass, no detail recorded. |
| Agent platform configs | Fail | 0 of 1 | Could not locate a public repo containing agent configs or rules. If our probes missed it, AI coding agents likely will too - link the repo from your homepage or docs so it's discoverable. |
| Agent Plugins manifest | Fail | 0 of 1 | No Agent Plugins manifest (plugin.json) found in discovered repos |
| ChatGPT app listed | Pass | 2 of 2 | Pass, no detail recorded. |
Access: 1 of 34
| Check | Result | Points | What Ora saw |
|---|---|---|---|
| Sitemap exists | Fail | 0 of 1 | No sitemap found |
| Not blocked by bot detection | Not run | 0 of 2 | Could not test bot user agents |
| Agent discovery file | Fail | 0 of 2 | No agent discovery file found |
| A2A / agent-card | Fail | 0 of 2 | No A2A agent card found at /.well-known/agent-card.json |
| Listed on skills.sh | Fail | 0 of 1 | No official skills self-published on skills.sh (100 community skills with potential relation to this domain found, but only self-published official skills count) |
| pricing.md exists | Fail | 0 of 2 | No pricing.md found - agents need machine-readable pricing to compare products and make purchase recommendations |
| NLWeb Schema Feeds | Fail | 0 of 1 | No robots.txt found - cannot check for Schema Feeds |
| MCP well-known discovery | Fail | 0 of 2 | No MCP server URL discovered |
| HTTP Link headers (RFC 8288) | Fail | 0 of 1 | No HTTP Link response headers (RFC 8288) found |
| Markdown URL fallback | Fail | 0 of 2 | Homepage does not support the .md suffix. Probed https://trip.com/index.md and it did not return markdown (expected text/markdown content-type or a heading-led non-HTML body). |
| Modular llms.txt per product area | Fail | 0 of 1 | No section-level llms.txt found. Tried /docs/llms.txt, /api/llms.txt, /developers/llms.txt, /guides/llms.txt, /reference/llms.txt. This is a bonus check: it can add a point and never costs one. |
| llms.txt exists | Fail | 0 of 1 | No llms.txt found at https://trip.com/llms.txt. Publish it at the site root, where agents that follow the llms.txt spec look for it. |
| llms.txt formatting | Fail | 0 of 2 | No llms.txt found to evaluate quality |
| JSON-LD structured data | Not run | 0 of 2 | Could not fetch homepage |
| Pricing info accessible | Fail | 0 of 3 | No pricing page or pricing data found |
| Public API/docs linked from homepage | Fail | 0 of 4 | No public API or documentation page linked from homepage |
| Agent instruction / when-to-use | Fail | 0 of 1 | No agent instruction file with when-to-use guidance found |
| Skills.sh skill quality | Fail | 0 of 2 | No official skills on skills.sh to evaluate |
| JSON-LD entity linking (sameAs) | Not run | 0 of 1 | Not run, no detail recorded. |
| Metadata completeness | Not run | 0 of 1 | Could not fetch homepage |
| Organization schema completeness | Not run | 0 of 1 | Not run, no detail recorded. |
| Trust anchor pages | Fail | 0 of 1 | No trust anchor pages found with sufficient content (About, Contact, Privacy) |
| Redirect hygiene | Pass | 1 of 1 | Pass, no detail recorded. |
| OpenAPI spec published | Fail | 0 of 8 | No OpenAPI/Swagger specification found |
| Developer portal | Fail | 0 of 5 | No developer portal found |
| API catalog (RFC 9727) | Fail | 0 of 2 | No /.well-known/api-catalog found (RFC 9727) |
| Markdown agent docs | Fail | 0 of 1 | Missing markdown content negotiation. Homepage returned text/html when probed with Accept: text/markdown (expected text/markdown), and none of the well-known root paths (/llms.md, /auth.md, /agents.md, /developers.md |
| Markdown content negotiation (acceptmarkdown.com) | Fail | 0 of 1 | Homepage https://trip.com does not meet the Markdown negotiation requirements: Accept: text/markdown returned text/html; Vary header missing Accept (got "none") |
| Bot-UA markdown serving | Fail | 0 of 1 | No probed bot User-Agent (ChatGPT-User, Claude-User, Perplexity-User) receives markdown when requesting HTML. Optional: detect AI-bot UAs server-side and serve them a markdown representation directly. |
Usability: 4 of 50
| Check | Result | Points | What Ora saw |
|---|---|---|---|
| Public API with reachable endpoints | Fail | 0 of 8 | No publicly reachable API surface detected (REST and GraphQL both absent or auth-gated) |
| OAuth 2.0 support | Fail | 0 of 5 | No OAuth 2.0 or OpenID Connect support detected |
| Scoped permissions | Fail | 0 of 5 | No declared OAuth scopes, security schemes, or scoped-permission documentation found |
| Agent onboarding friction | Fail | 0 of 2 | High onboarding friction - no free tier, self-serve keys, or sandbox detected |
| Web Bot Auth directory | Fail | 0 of 2 | No /.well-known/http-message-signatures-directory found |
| auth.md exists | Fail | 0 of 2 | No /auth.md found at site root |
| auth.md structure | Fail | 0 of 2 | No /auth.md found at site root |
| Agent auth discovery metadata | Fail | 0 of 3 | Neither /.well-known/oauth-protected-resource nor /.well-known/oauth-authorization-server found. Probed: trip.com, api.trip.com. |
| Agent auth WWW-Authenticate hint | Fail | 0 of 1 | No 401 with WWW-Authenticate: Bearer resource_metadata=... found. Probed [https://trip.com/api, https://trip.com/api/v1, https://trip.com/v1, https://trip.com/v2, https://trip.com/agent/identity, https://trip.com/agent/auth |
| agent_auth endpoints reachable | Fail | 0 of 2 | No agent_auth endpoint URIs found in AS metadata or /auth.md prose; nothing to probe |
| MCP server / manifest | Fail | 0 of 10 | No MCP server or manifest found |
| WebMCP support | Fail | 0 of 8 | No WebMCP support detected - no document.modelContext / navigator.modelContext usage found |
| JSON error responses | Fail | 0 of 3 | API does not return JSON error responses (or no API detected) |
| CLI tool available | Pass | 3 of 3 | CLI package found on npm: trip |
| NLWeb /ask endpoint | Fail | 0 of 1 | No NLWeb-conformant /ask endpoint found via GET or POST |
| NLWeb streaming support | Fail | 0 of 1 | NLWeb /ask does not support SSE streaming via GET or POST |
| MCP server-card.json | Fail | 0 of 2 | No MCP server card found (checked /.well-known/mcp/server-card.json, the site's ai-catalog.json, servers[].card in mcp.json, and <server>/server-card) |
| Product + docs MCP coverage | Fail | 0 of 2 | This bonus needs two MCP servers: one for your product so agents can take actions, and a separate one for your documentation so agents can answer questions from your docs. |
| Agent-friendly 404s | Partial | 1 of 2 | Nonexistent paths return HTTP 418 instead of 404/410 - agents get a non-200 signal but not the standard not-found semantics |
| API schema complexity analysis | Fail | 0 of 2 | No API schema detected |
| Function calling compatibility | Fail | 0 of 2 | No API spec found - function calling requires discoverable endpoints |
The fixes worth most points
Ora attaches an estimate to each failing or partial check: how many points the site would gain by passing it. These are the 5 with the largest estimates for Trip.com.
- MCP server / manifest
- Fail, 0 of 10, about 8.9 points to gain. Ora saw:
No MCP server or manifest found
. - OpenAPI spec published
- Fail, 0 of 8, about 7.8 points to gain. Ora saw:
No OpenAPI/Swagger specification found
. - Public API with reachable endpoints
- Fail, 0 of 8, about 7.1 points to gain. Ora saw:
No publicly reachable API surface detected (REST and GraphQL both absent or auth-gated)
. - WebMCP support
- Fail, 0 of 8, about 7.1 points to gain. Ora saw:
No WebMCP support detected - no document.modelContext / navigator.modelContext usage found
. - Developer portal
- Fail, 0 of 5, about 4.9 points to gain. Ora saw:
No developer portal found
.
Our read
Trip.com answered the robots.txt request with HTTP 418, the status code that means I'm a teapot, a joke in the specification and a refusal in practice; the agent user agents could not be tested and the home page returned no page, so the door, content, policy and structured-data rows are unverified and the Access layer reads 1 of 46. Ora found no commerce signals, so the six payment checks did not apply on this read, on the largest online travel agency in Asia. What could be probed came back empty: no publicly reachable API, neither a developer portal nor an OpenAPI specification, and neither an MCP server nor OAuth discovery, so the Usability layer reads 5 of 46. The Discovery layer is nearly perfect at 13 of 14, with trip.com fourth for a common word and a confirmed knowledge graph match. The knowledge graph knows the company; the server tells the agent it is a teapot, and a robots.txt an agent can fetch is the first fix.
Test your own checkout
The scan above is free and needs no account: enter a domain at ora.ai and read the same layers for your own site, with the six payment checks mapped to this matrix on the Ora Payments page. The command below runs the same audit from a terminal and exits with 1 under the score you set, so it can gate a deploy. Why Ora, and its limits.
npx ax@0.10 audit https://example.com --min-score 70All 360 checks, one company a day. Corrections to the corrections page.
Sources
- ora.ai/api/score/trip.com, Ora's scan (vendor), read 14 Nov 2026
- Ora's scoring rules, version 3 (vendor), read 14 Nov 2026
- Ora check catalog (GET /api/checks), read 14 Nov 2026
- trip.com, the company's site, read 14 Nov 2026
Last reviewed