---
title: "Ulta Beauty: the 360 agent-readiness check | Agent Ready Checkout"
description: "Ulta Beauty on Ora's agent-readiness scan, read 2026-11-14: 29 of 100, grade D. The pay layer did not apply. One company a day."
canonical: https://agentreadycheckout.com/blog/ulta-agent-readiness
site: "Agent Ready Checkout"
last_updated: 2026-11-14
date: 2026-11-11
section: "360 checks"
---

# Ulta Beauty: the 360 agent-readiness check | Agent Ready Checkout

> Ulta Beauty on Ora's agent-readiness scan, read 2026-11-14: 29 of 100, grade D. The pay layer did not apply. One company a day.

Source: https://agentreadycheckout.com/blog/ulta-agent-readiness
Site: Agent Ready Checkout
Last reviewed: 2026-11-14

360 check, 11 Nov 2026

# Ulta Beauty on the pay layer: the 360 agent-readiness check

In short

Ulta Beauty scores 29 of 100 on Ora's agent-readiness scan, a D, read 14 Nov 2026. The six payment checks did not apply to ulta.com on this read, which is how Ora treats a site it does not read as a shop. An open door, a locked GraphQL endpoint, and no MCP server for an agent's basket.

On 14 Nov 2026 the public site at ulta.com scored **29 of 100** on [Ora's](https://ora.ai/?utm_source=agentreadycheckout.com&utm_medium=referral&utm_campaign=check) agent-readiness scan, a D, in Ora's E-commerce category. Ulta Beauty is the largest beauty retailer in the United States, so this check reads the Payments layer first: the six checks that look for x402, MPP, UCP, ACP and AP2 on the domain, the same protocols this site's matrix tracks row by row. The other layers follow, with every check Ora ran and what it saw. Ora's one-line summary: Gives agents almost nothing to work with: no MCP server, no OpenAPI spec.

## The score

| Layer | Points | Share | What the layer asks |
| --- | --- | --- | --- |
| Discovery | 4 of 11 | 36% | Can agents find and recommend it |
| Access | 11.17 of 38 | 29% | Can agents read it |
| Usability | 13 of 52 | 25% | Can agents use it |
| Payments | 0 of 0 | none apply | Can agents pay |
|  |
| Total | 29 of 100 | 29% | Grade D |

## The pay layer

Ora did not run the six payment checks against ulta.com on this read: it marks them not applicable on a site it does not read as a shop, so the layer has no maximum and costs nothing. A retailer that sells online can still publish any of the five protocols; the matrix says which processors and platforms carry each one. Each protocol links to its matrix row, where the processors and platforms that carry it are dated and sourced.

| Payment check | Result | Points | Matrix row | What Ora saw |
| --- | --- | --- | --- | --- |
| x402 | Does not apply | 0 of 2 | x402 in the matrix | No x402 payment protocol support detected. No commerce signals detected - agent-payment protocols are optional for non-commerce sites |
| MPP | Does not apply | 0 of 2 | MPP in the matrix | No MPP (Machine Payments Protocol) support detected. No commerce signals detected - agent-payment protocols are optional for non-commerce sites |
| UCP | Does not apply | 0 of 3 | UCP in the matrix | no UCP (Universal Commerce Protocol) signals detected. No commerce signals detected - agent-payment protocols are optional for non-commerce sites |
| ACP | Does not apply | 0 of 3 | ACP in the matrix | no ACP (Agentic Commerce Protocol) signals detected. No commerce signals detected - agent-payment protocols are optional for non-commerce sites |

## The other layers, check by check

Every check Ora ran on ulta.com, grouped by layer, with the result, the points and what Ora recorded where its wording passes this site's gate.

### Discovery: 4 of 11

| Check | Result | Points | What Ora saw |
| --- | --- | --- | --- |
| ARD discovery | Fail | 0 of 1 | No /.well-known/ard.json, no same-site rel="ard" link, and no legacy /.well-known/ai-catalog.json |
| Developer resource discoverability | Fail | 0 of 4 | In a search for your API docs, none of the 10 results is your official docs |
| Brand name discoverability | Partial | 1 of 3 | ulta.com ranks #6 for "Ulta Beauty" (searched your brand name alone: no main product term from your homepage qualified) |
| robots.txt AI crawler policy | Pass | 1 of 1 | AI search crawlers: allowed in 3 of 3 checks (3 crawlers on 1 page). AI training crawlers: allowed in 2 of 2 checks (2 crawlers on 1 page), not scored. |
| NPM/PyPI SDK package | Pass | 1 of 1 | Pass, no detail recorded. |
| Agent platform configs | Fail | 0 of 1 | Could not locate a public repo containing agent configs or rules. If our probes missed it, AI coding agents likely will too - link the repo from your homepage or docs so it's discoverable. |
| Agent Plugins manifest | Fail | 0 of 1 | No Agent Plugins manifest (plugin.json) found in discovered repos |
| ChatGPT app listed | Fail | 0 of 2 | Not found in ChatGPT app directory |
| Homepage not hidden from search | Pass | 1 of 1 | No noindex on the homepage: no robots, googlebot or bingbot meta tag and no X-Robots-Tag header hides it from search. |

### Access: 11.17 of 38

| Check | Result | Points | What Ora saw |
| --- | --- | --- | --- |
| Sitemap exists | Pass | 1 of 1 | Valid sitemap found at https://www.ulta.com/sitemap/index.xml with multiple sitemaps entries |
| Content without JavaScript | Partial | 1.67 of 5 | Homepage: 4720 chars of readable text, but no H1 tag. No inner pages checked: the 5 sampled pages were skipped (forms, login pages, bot challenges, error pages, non-HTML pages and pages over 1 MB are skipped). |
| Not blocked by bot detection | Pass | 2 of 2 | Site accessible to 4 agent user-agents (ChatGPT-User, OAI-SearchBot, Claude-User, PerplexityBot). |
| Agent discovery file | Fail | 0 of 2 | No agent discovery file found |
| A2A / agent-card | Fail | 0 of 2 | No A2A agent card found at /.well-known/agent-card.json |
| Listed on skills.sh | Fail | 0 of 1 | No official skills self-published on skills.sh (4 community skills with potential relation to this domain found, but only self-published official skills count) |
| pricing.md exists | Fail | 0 of 2 | No pricing.md found - agents need machine-readable pricing to compare products and make purchase recommendations |
| NLWeb Schema Feeds | Fail | 0 of 1 | No schemamap: directive in robots.txt |
| MCP well-known discovery | Fail | 0 of 2 | No MCP server URL discovered |
| HTTP Link headers (RFC 8288) | Fail | 0 of 1 | Link header present but no agent-relevant rel values (sitemap, describedby, alternate, service-desc) |
| Markdown URL fallback | Fail | 0 of 2 | Homepage does not support the .md suffix. Probed https://ulta.com/index.md and it did not return markdown (expected text/markdown content-type or a heading-led non-HTML body). |
| Modular llms.txt per product area | Fail | 0 of 1 | No section-level llms.txt found. Tried /docs/llms.txt, /api/llms.txt, /developers/llms.txt, /guides/llms.txt, /reference/llms.txt, /stores/llms.txt. This is a bonus check: it can add a point and never costs one. |
| robots.txt agent-user policy | Pass | 1 of 1 | No applicable crawl or usage restriction found for 3 user-triggered agents (chatgpt-user, claude-user, perplexity-user) on 1 public page: https://ulta.com/. Declared policy only |
| llms.txt exists | Fail | 0 of 1 | No llms.txt found at https://ulta.com/llms.txt. Publish it at the site root, where agents that follow the llms.txt spec look for it. |
| llms.txt formatting | Fail | 0 of 2 | No llms.txt found to evaluate quality |
| JSON-LD structured data | Fail | 0 of 2 | No JSON-LD structured data found on homepage |
| Pricing info accessible | Fail | 0 of 3 | No pricing page or pricing data found |
| Public API/docs linked from homepage | Fail | 0 of 4 | No public API or documentation page linked from homepage |
| Agent instruction / when-to-use | Fail | 0 of 1 | No agent instruction file with when-to-use guidance found |
| Skills.sh skill quality | Fail | 0 of 2 | No official skills on skills.sh to evaluate |
| JSON-LD entity linking (sameAs) | Fail | 0 of 1 | No JSON-LD found - no entity linking possible |
| Metadata completeness | Partial | 0.5 of 1 | 2/4 metadata signals present - missing: og:image, og:type |
| Organization schema completeness | Fail | 0 of 1 | No JSON-LD found - Organization schema missing |
| Trust anchor pages | Pass | 1 of 1 | Pass, no detail recorded. |
| Markdown alternate link | Fail | 0 of 1 | No sampled page advertises a markdown alternate. Add <link rel="alternate" type="text/markdown" href="..."> (or the equivalent Link response header) pointing at a markdown twin of the page. |
| Redirect hygiene | Pass | 1 of 1 | Pass, no detail recorded. |
| Page token budget | Pass | 1 of 1 | All 6 measured pages fit an agent context budget (largest ~5K tokens) |
| Content behind auth | Pass | 1 of 1 | All 5 sampled pages are publicly readable (5 with substantive content) |
| OpenAPI spec published | Fail | 0 of 8 | No OpenAPI/Swagger specification found |
| API catalog (RFC 9727) | Fail | 0 of 2 | No /.well-known/api-catalog found (RFC 9727) |
| Markdown agent docs | Fail | 0 of 1 | Missing markdown content negotiation. Homepage returned text/html when probed with Accept: text/markdown (expected text/markdown), and none of the well-known root paths (/llms.md, /auth.md, /agents.md, /developers.md |
| Markdown content negotiation (acceptmarkdown.com) | Fail | 0 of 1 | Homepage https://ulta.com does not meet the Markdown negotiation requirements: Accept: text/markdown returned text/html; Vary header missing Accept (got "accept-encoding") |
| Bot-UA markdown serving | Fail | 0 of 1 | No probed bot User-Agent (ChatGPT-User, Claude-User, Perplexity-User) receives markdown when requesting HTML. Optional: detect AI-bot UAs server-side and serve them a markdown representation directly. |
| Agent crawler reachability | Pass | 1 of 1 | Reachable to every agent we tested - ChatGPT-User: reachable, OAI-SearchBot: reachable, Claude-User: reachable, PerplexityBot: reachable |

### Usability: 13 of 52

| Check | Result | Points | What Ora saw |
| --- | --- | --- | --- |
| Public API with reachable endpoints | Pass | 8 of 8 | GraphQL endpoint at https://api.ulta.com/graphql is reachable; introspection requires authentication (API key / OAuth), which is expected for agent access. Best-of-protocols score: 7/7. |
| OAuth 2.0 support | Pass | 5 of 5 | OAuth endpoint found at https://ulta.com/oauth/authorize |
| Scoped permissions | Fail | 0 of 5 | No declared OAuth scopes, security schemes, or scoped-permission documentation found |
| Agent onboarding friction | Fail | 0 of 2 | High onboarding friction - no free tier, self-serve keys, or sandbox detected |
| Web Bot Auth directory | Fail | 0 of 2 | No /.well-known/http-message-signatures-directory found |
| auth.md exists | Fail | 0 of 2 | No /auth.md found at site root |
| auth.md structure | Fail | 0 of 2 | No /auth.md found at site root |
| MCP server / manifest | Fail | 0 of 10 | No MCP server or manifest found |
| Rate limit response headers | Fail | 0 of 2 | GraphQL introspection auth-gated and no header convention documented on GraphQL-tagged pages |
| Idempotency-Key support | Fail | 0 of 3 | GraphQL introspection auth-gated and no idempotency documentation found on GraphQL-tagged pages |
| NLWeb /ask endpoint | Fail | 0 of 1 | No response from /ask endpoint |
| NLWeb streaming support | Fail | 0 of 1 | No response from /ask endpoint for streaming request |
| MCP server-card.json | Fail | 0 of 2 | No MCP server card found (checked /.well-known/mcp/server-card.json, the site's ai-catalog.json, servers[].card in mcp.json, and <server>/server-card) |
| Product + docs MCP coverage | Fail | 0 of 2 | This bonus needs two MCP servers: one for your product so agents can take actions, and a separate one for your documentation so agents can answer questions from your docs. |
| Sandbox / test environment | Fail | 0 of 2 | No sandbox or test environment found |
| GraphQL typed error model | Fail | 0 of 3 | GraphQL introspection auth-gated and no typed graphql error model documentation found on GraphQL-tagged pages |
| GraphQL versioning / deprecation policy | Fail | 0 of 2 | GraphQL introspection auth-gated and no graphql versioning / deprecation policy documentation found on GraphQL-tagged pages |
| GraphQL pagination pattern | Fail | 0 of 2 | GraphQL introspection auth-gated and no graphql pagination pattern documentation found on GraphQL-tagged pages |
| GraphQL async-job pattern | Fail | 0 of 2 | GraphQL introspection auth-gated and no graphql async-job pattern documentation found on GraphQL-tagged pages |
| Agent-friendly 404s | Not run | 0 of 2 | Not run, no detail recorded. |
| Native interactive controls | Pass | 3 of 3 | Pass, no detail recorded. |
| Accessible names on controls | Pass | 2 of 2 | Pass, no detail recorded. |
| Form control labeling | Pass | 2 of 2 | Pass, no detail recorded. |
| Accessibility-tree injection safety (bonus) | Pass | 2 of 2 | Pass, no detail recorded. |
| API schema complexity analysis | Fail | 0 of 2 | GraphQL: introspection auth-gated and no schema evidence in docs |
| Function calling compatibility | Fail | 0 of 2 | No API spec found - function calling requires discoverable endpoints |

## The fixes worth most points

Ora attaches an estimate to each failing or partial check: how many points the site would gain by passing it. These are the 5 with the largest estimates for Ulta Beauty.

MCP server / manifest

Fail, 0 of 10, about 8.5 points to gain. Ora saw: No MCP server or manifest found.

Developer resource discoverability

Fail, 0 of 4, about 8.1 points to gain. Ora saw: In a search for your API docs, none of the 10 results is your official docs.

OpenAPI spec published

Fail, 0 of 8, about 7 points to gain. Ora saw: No OpenAPI/Swagger specification found.

Scoped permissions

Fail, 0 of 5, about 4.3 points to gain. Ora saw: No declared OAuth scopes, security schemes, or scoped-permission documentation found.

Brand name discoverability

Partial, 1 of 3, about 4 points to gain. Ora saw: ulta.com ranks #6 for "Ulta Beauty" (searched your brand name alone: no main product term from your homepage qualified).

## Our read

Ulta Beauty sells online, but Ora did not read ulta.com as a shop: it found no commerce signals, so the payment checks did not apply on this read and the Payments layer reads 0 of 0. The rest of the read decides the D. The door is open, with all four test agents reaching the home page and robots.txt allowing the AI search crawlers in 3 of 3 checks. The reading layer is thin: 4,720 characters of text without an H1, no llms.txt, no JSON-LD on the home page and metadata at 2 of 4. The act layer has pieces without a map: a GraphQL endpoint at api.ulta.com whose introspection requires authentication and an OAuth endpoint, but neither an OpenAPI specification nor an MCP server, and no declared scopes. Usability reads 13 of 52. The fix worth most is an MCP server, about 8.5 points, with API docs a search can find close behind. A D at 29: the counter is open, and an agent has no basket to carry.

## Test your own checkout

The scan above is free and needs no account: enter a domain at [ora.ai](https://ora.ai/?utm_source=agentreadycheckout.com&utm_medium=referral&utm_campaign=check) and read the same layers for your own site, with the six payment checks mapped to this matrix on [the Ora Payments page](https://agentreadycheckout.com/method/ora-payments-layer). The command below runs the same audit from a terminal and exits with 1 under the score you set, so it can gate a deploy. [Why Ora, and its limits](https://agentreadycheckout.com/guides/best-ai-readiness-tools-2026).

```bash
npx ax@0.10 audit https://example.com --min-score 70
```

[All 360 checks](https://agentreadycheckout.com/blog), one company a day. Corrections to [the corrections page](https://agentreadycheckout.com/corrections).

## Sources

1.  [ora.ai/api/score/ulta.com, Ora's scan (vendor)](https://ora.ai/api/score/ulta.com?utm_source=agentreadycheckout.com&utm_medium=referral&utm_campaign=check), read 14 Nov 2026
2.  [Ora's scoring rules, version 3 (vendor)](https://ora.ai/api/ranker/releases/3/rules?utm_source=agentreadycheckout.com&utm_medium=referral&utm_campaign=check), read 14 Nov 2026
3.  [Ora check catalog (GET /api/checks)](https://ora.ai/api/checks?utm_source=agentreadycheckout.com&utm_medium=referral&utm_campaign=check), read 14 Nov 2026
4.  [ulta.com, the company's site](https://www.ulta.com/), read 14 Nov 2026

Last reviewed 14 Nov 2026

## Edition

Matrix edition of 4 Nov 2026.

Reviewed 14 Nov 2026, [4 sources](#sources-h).

## Method

Every number on this page is read from Ora's score file for the domain on the date shown. The verdict is ours.

[Methodology](https://agentreadycheckout.com/method)