---
title: "Walgreens: the 360 agent-readiness check | Agent Ready Checkout"
description: "Walgreens on Ora's agent-readiness scan, read 2026-11-14: 28 of 100, grade D. The pay layer did not apply. One company a day."
canonical: https://agentreadycheckout.com/blog/walgreens-agent-readiness
site: "Agent Ready Checkout"
last_updated: 2026-11-14
date: 2026-11-09
section: "360 checks"
---

# Walgreens: the 360 agent-readiness check | Agent Ready Checkout

> Walgreens on Ora's agent-readiness scan, read 2026-11-14: 28 of 100, grade D. The pay layer did not apply. One company a day.

Source: https://agentreadycheckout.com/blog/walgreens-agent-readiness
Site: Agent Ready Checkout
Last reviewed: 2026-11-14

360 check, 9 Nov 2026

# Walgreens on the pay layer: the 360 agent-readiness check

In short

Walgreens scores 28 of 100 on Ora's agent-readiness scan, a D, read 14 Nov 2026. The six payment checks did not apply to walgreens.com on this read, which is how Ora treats a site it does not read as a shop. A challenge page for every agent, in front of one GraphQL endpoint.

On 14 Nov 2026 the public site at walgreens.com scored **28 of 100** on [Ora's](https://ora.ai/?utm_source=agentreadycheckout.com&utm_medium=referral&utm_campaign=check) agent-readiness scan, a D. Walgreens is the US pharmacy chain, selling health and household goods online, so this check reads the Payments layer first: the six checks that look for x402, MPP, UCP, ACP and AP2 on the domain, the same protocols this site's matrix tracks row by row. The other layers follow, with every check Ora ran and what it saw. Ora's one-line summary: Walgreens offers discoverable public APIs and endpoints, but lacks published OpenAPI specifications for agent integration.

## The score

| Layer | Points | Share | What the layer asks |
| --- | --- | --- | --- |
| Discovery | 10 of 11 | 91% | Can agents find and recommend it |
| Access | 0 of 41 | 0% | Can agents read it |
| Usability | 7 of 42 | 17% | Can agents use it |
| Payments | 0 of 0 | none apply | Can agents pay |
|  |
| Total | 28 of 100 | 28% | Grade D |

## The pay layer

Ora did not run the six payment checks against walgreens.com on this read: it marks them not applicable on a site it does not read as a shop, so the layer has no maximum and costs nothing. A retailer that sells online can still publish any of the five protocols; the matrix says which processors and platforms carry each one. Each protocol links to its matrix row, where the processors and platforms that carry it are dated and sourced.

| Payment check | Result | Points | Matrix row | What Ora saw |
| --- | --- | --- | --- | --- |
| x402 | Does not apply | 0 of 2 | x402 in the matrix | No commerce signals detected - agent-payment protocols are optional for non-commerce sites |
| MPP | Does not apply | 0 of 2 | MPP in the matrix | No commerce signals detected - agent-payment protocols are optional for non-commerce sites |
| UCP | Does not apply | 0 of 3 | UCP in the matrix | No commerce signals detected - agent-payment protocols are optional for non-commerce sites |
| ACP | Does not apply | 0 of 3 | ACP in the matrix | No commerce signals detected - agent-payment protocols are optional for non-commerce sites |
| ACP delegate payment | Does not apply | 0 of 3 | ACP in the matrix | No commerce signals detected - agent-payment protocols are optional for non-commerce sites |
| AP2 | Does not apply | 0 of 3 | AP2 in the matrix | No commerce signals detected - agent-payment protocols are optional for non-commerce sites |

## The other layers, check by check

Every check Ora ran on walgreens.com, grouped by layer, with the result, the points and what Ora recorded where its wording passes this site's gate.

### Discovery: 10 of 11

| Check | Result | Points | What Ora saw |
| --- | --- | --- | --- |
| ARD discovery | Fail | 0 of 1 | No /.well-known/ard.json, no same-site rel="ard" link, and no legacy /.well-known/ai-catalog.json |
| Developer resource discoverability | Pass | 3 of 3 | Pass, no detail recorded. |
| Brand name discoverability | Pass | 3 of 3 | walgreens.com ranks #1 for "walgreens" (searched your brand name alone: we could not read a product term from your site) |
| Wikipedia / Wikidata entity presence | Pass | 4 of 4 | Wikipedia "Walgreens" and Wikidata Q1591889 both verified - domain confirmed on both sources |
| Agent platform configs | Fail | 0 of 1 | Could not locate a public repo containing agent configs or rules. If our probes missed it, AI coding agents likely will too - link the repo from your homepage or docs so it's discoverable. |
| Agent Plugins manifest | Fail | 0 of 1 | No Agent Plugins manifest (plugin.json) found in discovered repos |
| ChatGPT app listed | Fail | 0 of 2 | Not found in ChatGPT app directory |

### Access: 0 of 41

| Check | Result | Points | What Ora saw |
| --- | --- | --- | --- |
| Sitemap exists | Fail | 0 of 2 | No sitemap found |
| Content without JavaScript | Partial | 0 of 3 | Homepage blocked by WAF/security challenge - content not accessible to agents |
| Not blocked by bot detection | Partial | 0 of 2 | Bot management challenged ChatGPT-User, OAI-SearchBot, Claude-User, PerplexityBot. A challenge is an identity check that verified crawlers pass |
| Agent discovery file | Fail | 0 of 2 | No agent discovery file found |
| A2A / agent-card | Fail | 0 of 2 | No A2A agent card found at /.well-known/agent-card.json |
| Listed on skills.sh | Fail | 0 of 1 | No official skills self-published on skills.sh (2 community skills with potential relation to this domain found, but only self-published official skills count) |
| NLWeb Schema Feeds | Partial | 0 of 1 | robots.txt blocked by WAF/bot protection - cannot check for Schema Feeds |
| MCP well-known discovery | Fail | 0 of 2 | No MCP server URL discovered |
| Agent mode view | Fail | 0 of 2 | No agent mode view detected at ?mode=agent (optional) |
| HTTP Link headers (RFC 8288) | Fail | 0 of 1 | No HTTP Link response headers (RFC 8288) found |
| Markdown URL fallback | Fail | 0 of 2 | Homepage does not support the .md suffix. Probed https://walgreens.com/index.md and it did not return markdown (expected text/markdown content-type or a heading-led non-HTML body). |
| Modular llms.txt per product area | Fail | 0 of 1 | No section-level llms.txt found. Tried /docs/llms.txt, /api/llms.txt, /developers/llms.txt, /guides/llms.txt, /reference/llms.txt. This is a bonus check: it can add a point and never costs one. |
| llms.txt exists | Fail | 0 of 1 | No llms.txt found at /llms.txt or /.well-known/llms.txt. |
| llms.txt formatting | Fail | 0 of 2 | No llms.txt found to evaluate quality |
| JSON-LD structured data | Partial | 0 of 4 | Homepage blocked by WAF - cannot check structured data |
| Public API/docs linked from homepage | Partial | 0 of 3 | Homepage blocked by WAF - cannot check for docs links |
| Agent instruction / when-to-use | Fail | 0 of 3 | No agent instruction file with when-to-use guidance found |
| Skills.sh skill quality | Fail | 0 of 2 | No official skills on skills.sh to evaluate |
| JSON-LD entity linking (sameAs) | Partial | 0 of 2 | Homepage blocked by WAF - cannot check entity linking |
| Metadata completeness | Partial | 0 of 2 | Homepage blocked by WAF - cannot check metadata |
| Organization schema completeness | Partial | 0 of 2 | Homepage blocked by WAF - cannot check Organization schema |
| Schema type breadth | Partial | 0 of 2 | Homepage blocked by WAF - cannot check schema types |
| Trust anchor pages | Fail | 0 of 2 | No trust anchor pages found with sufficient content (About, Contact, Privacy) |
| OpenAPI spec published | Fail | 0 of 7 | No OpenAPI/Swagger specification found |
| API catalog (RFC 9727) | Fail | 0 of 2 | No /.well-known/api-catalog found (RFC 9727) |
| Markdown agent docs | Fail | 0 of 1 | Missing markdown content negotiation. Homepage returned text/html when probed with Accept: text/markdown (expected text/markdown), and none of the well-known root paths (/llms.md, /auth.md, /agents.md, /developers.md |
| Markdown content negotiation (acceptmarkdown.com) | Fail | 0 of 1 | Homepage https://walgreens.com does not meet the Markdown negotiation requirements: Accept: text/markdown returned text/html; Vary header missing Accept (got "none") |
| Agent crawler reachability | Partial | 0 of 2 | Bot management challenged ChatGPT-User, OAI-SearchBot, Claude-User, PerplexityBot - a challenge is an identity check verified crawlers pass, so reachability is undetermined rather than blocked (ChatGPT-User: challenged |

### Usability: 7 of 42

| Check | Result | Points | What Ora saw |
| --- | --- | --- | --- |
| Public API with reachable endpoints | Pass | 7 of 7 | GraphQL endpoint at https://walgreens.com/graphql is reachable; introspection requires authentication (API key / OAuth), which is expected for agent access. Best-of-protocols score: 7/7. |
| Agent onboarding friction | Fail | 0 of 2 | Insufficient content to evaluate onboarding friction |
| Web Bot Auth directory | Fail | 0 of 2 | No /.well-known/http-message-signatures-directory found |
| OAuth Protected Resource metadata (RFC 9728) | Fail | 0 of 2 | No /.well-known/oauth-protected-resource found (RFC 9728) |
| auth.md exists | Fail | 0 of 2 | No /auth.md found at site root |
| auth.md structure | Fail | 0 of 2 | No /auth.md found at site root |
| Agent auth discovery metadata | Fail | 0 of 3 | Neither /.well-known/oauth-protected-resource nor /.well-known/oauth-authorization-server found. Probed: walgreens.com, api.walgreens.com. |
| Agent auth WWW-Authenticate hint | Fail | 0 of 1 | No 401 with WWW-Authenticate: Bearer resource_metadata=... found. Probed [https://walgreens.com/api, https://walgreens.com/api/v1, https://walgreens.com/v1, https://walgreens.com/v2, https://walgreens.com/agent/identity |
| agent_auth endpoints reachable | Fail | 0 of 2 | No agent_auth endpoint URIs found in AS metadata or /auth.md prose; nothing to probe |
| MCP server / manifest | Fail | 0 of 6 | No MCP server or manifest found |
| WebMCP support | Fail | 0 of 5 | No WebMCP support detected - no document.modelContext / navigator.modelContext usage found |
| Rate limit response headers | Fail | 0 of 2 | GraphQL introspection auth-gated and no header convention documented on GraphQL-tagged pages |
| Idempotency-Key support | Fail | 0 of 3 | GraphQL introspection auth-gated and no idempotency documentation found on GraphQL-tagged pages |
| JSON error responses | Fail | 0 of 4 | API does not return JSON error responses (or no API detected) |
| NLWeb /ask endpoint | Pass | 1 of 1 | NLWeb /ask endpoint exists but requires authentication (HTTP 403, via GET) |
| NLWeb streaming support | Fail | 0 of 1 | NLWeb /ask requires authentication - cannot verify streaming |
| MCP server-card.json | Fail | 0 of 2 | No MCP server card found (checked /.well-known/mcp/server-card.json, the site's ai-catalog.json, servers[].card in mcp.json, and <server>/server-card) |
| Product + docs MCP coverage | Fail | 0 of 2 | This bonus needs two MCP servers: one for your product so agents can take actions, and a separate one for your documentation so agents can answer questions from your docs. |
| Sandbox / test environment | Fail | 0 of 2 | No sandbox or test environment found |
| GraphQL typed error model | Fail | 0 of 3 | GraphQL introspection auth-gated and no typed graphql error model documentation found on GraphQL-tagged pages |
| GraphQL versioning / deprecation policy | Fail | 0 of 2 | GraphQL introspection auth-gated and no graphql versioning / deprecation policy documentation found on GraphQL-tagged pages |
| GraphQL pagination pattern | Fail | 0 of 2 | GraphQL introspection auth-gated and no graphql pagination pattern documentation found on GraphQL-tagged pages |
| GraphQL async-job pattern | Fail | 0 of 2 | GraphQL introspection auth-gated and no graphql async-job pattern documentation found on GraphQL-tagged pages |
| API schema complexity analysis | Fail | 0 of 2 | GraphQL: introspection auth-gated and no schema evidence in docs |
| Function calling compatibility | Fail | 0 of 2 | No API spec found - function calling requires discoverable endpoints |

## The fixes worth most points

Ora attaches an estimate to each failing or partial check: how many points the site would gain by passing it. These are the 5 with the largest estimates for Walgreens.

MCP server / manifest

Fail, 0 of 6, about 6.3 points to gain. Ora saw: No MCP server or manifest found.

OpenAPI spec published

Fail, 0 of 7, about 5.7 points to gain. Ora saw: No OpenAPI/Swagger specification found.

WebMCP support

Fail, 0 of 5, about 5.3 points to gain. Ora saw: No WebMCP support detected - no document.modelContext / navigator.modelContext usage found.

JSON error responses

Fail, 0 of 4, about 4.2 points to gain. Ora saw: API does not return JSON error responses (or no API detected).

JSON-LD structured data

Partial, 0 of 4, about 3.3 points to gain. Ora saw: Homepage blocked by WAF - cannot check structured data.

## Our read

Walgreens challenged ChatGPT-User, OAI-SearchBot, Claude-User and PerplexityBot at the door, answered the robots.txt request with a 403 challenge and returned a security page in place of the home page, so the Access layer scores 0 of 41 and the content, policy and structured-data rows are unverified from outside. Ora found no commerce signals past the wall, so the six payment checks did not apply on this read, though the pharmacy sells health and household goods online every day. What it could reach is a GraphQL endpoint at walgreens.com/graphql with introspection gated, and nothing around it: neither a developer portal nor an OpenAPI specification, neither an MCP server nor OAuth discovery, and neither a sitemap nor an llms.txt. The brand search places the domain first for its own name, which is the Discovery layer's 10 of 11. A retailer with a pharmacy counter has every reason to manage bots; the checklist asks it to say so in a robots.txt an agent can fetch.

## Test your own checkout

The scan above is free and needs no account: enter a domain at [ora.ai](https://ora.ai/?utm_source=agentreadycheckout.com&utm_medium=referral&utm_campaign=check) and read the same layers for your own site, with the six payment checks mapped to this matrix on [the Ora Payments page](https://agentreadycheckout.com/method/ora-payments-layer). The command below runs the same audit from a terminal and exits with 1 under the score you set, so it can gate a deploy. [Why Ora, and its limits](https://agentreadycheckout.com/guides/best-ai-readiness-tools-2026).

```bash
npx ax@0.10 audit https://example.com --min-score 70
```

[All 360 checks](https://agentreadycheckout.com/blog), one company a day. Corrections to [the corrections page](https://agentreadycheckout.com/corrections).

## Sources

1.  [ora.ai/api/score/walgreens.com, Ora's scan (vendor)](https://ora.ai/api/score/walgreens.com?utm_source=agentreadycheckout.com&utm_medium=referral&utm_campaign=check), read 14 Nov 2026
2.  [Ora check catalog (GET /api/checks)](https://ora.ai/api/checks?utm_source=agentreadycheckout.com&utm_medium=referral&utm_campaign=check), read 14 Nov 2026
3.  [walgreens.com, the company's site](https://walgreens.com/), read 14 Nov 2026

Last reviewed 14 Nov 2026

## Edition

Matrix edition of 4 Nov 2026.

Reviewed 14 Nov 2026, [3 sources](#sources-h).

## Method

Every number on this page is read from Ora's score file for the domain on the date shown. The verdict is ours.

[Methodology](https://agentreadycheckout.com/method)