{"target":"https://vercel.com","display_target":"vercel.com","report_url":"https://is-agentic.com/scan/vercel.com","score":96,"score_label":"Strong technical baseline","scanned_at":"2026-11-10T05:00:25.420Z","eligible_checks":33,"score_breakdown":{"essential":{"earned":72.5,"available":80,"passing":8,"total":10},"recommended":{"earned":18.6,"available":20,"passing":20,"total":23},"bonus":{"points":5,"positive_signals":40}},"issues":[{"details":"Homepage: 1009 chars with H1, but 1.0% content ratio is below the 5% target. 4 of 4 sampled inner pages have text without JavaScript (1 skipped).","id":"content-no-js","name":"Content without JavaScript","recommendation":"Serve at least 500 characters of meaningful homepage content in raw HTML. Add a clear H1, keep deeper heading levels sequential, and remove excessive non-content markup. Inner pages need their main text in the raw HTML too, not only after JavaScript runs.","result":"partial","tier":"essential"},{"details":"OpenAPI declares security schemes but no named OAuth scopes - agents get all-or-nothing access. Declare per-scope grants (e.g. read:*, write:*) in the spec.","id":"scoped-permissions","name":"Scoped permissions","recommendation":"Declare scoped API permissions where machines can read them: named OAuth scopes in your OpenAPI security schemes, or scopes_supported in RFC 9728 protected-resource metadata. Prose descriptions of roles help humans, but agents need the machine-readable declaration to request least-privilege access.","result":"partial","tier":"essential"},{"details":"No REST rate-limit headers found on probed endpoints","id":"rate-limit-headers","name":"Rate limit response headers","recommendation":"Return standard rate-limit headers on your API responses (the RFC RateLimit headers, plus Retry-After on a 429) so agents can self-throttle in real time, and document the conventions alongside your API.","result":"failed","tier":"recommended"},{"details":"Verified live: GET https://api.vercel.com/v1/registrar/tlds/supported answered 200 without credentials (zero-auth access). Described but not verified live: free tier available, self-serve key generation, sandbox/test environment","id":"onboarding-friction","name":"Agent onboarding friction","recommendation":"Offer a free tier or trial, self-serve API key generation, and a sandbox environment. Agents can't fill out 'contact sales' forms.","result":"partial","tier":"recommended"},{"details":"MCP server detected at https://mcp.vercel.com; it requires authentication. Presence is verified (5/6), but Ora could not inspect its tools or verify access scopes without credentials.","id":"mcp-server","name":"MCP server / manifest","recommendation":"Keep authentication enabled. Verify tool listing with an authorized MCP client. This unauthenticated scan cannot establish whether protected tools are missing or unusable.","result":"partial","tier":"recommended"}]}