gomry.com
Finalizing the report
Preparing the stored Is Agentic score
Essential—
Recommended—
Bonus signals—
gomry.com
Preparing the stored Is Agentic score
gomry.com
These checks describe whether an ordinary agent can enter, read, and operate the public site.
Agents can reach the site
Crawler access and bot defenses.
Core content is available
Useful content remains accessible without a fragile browser-only path.
Navigation fails safely
Redirects and missing pages give agents a recoverable path.
Controls are understandable
Forms and interactive controls expose usable names and structure.
The public website is always evaluated. Optional surfaces appear when the scan finds positive evidence that they apply.
Strong
Weighted across 16 applicable checks
Strong
Weighted across 12 applicable checks
Strong
Weighted across 3 applicable checks
Ready with gaps
Weighted across 1 applicable check
Strong
Weighted across 1 applicable check
Critical access gaps come first, followed by other applicable readiness gaps.
Verify that major agent User-Agents can reach the homepage. If your WAF or bot rules block them, remove or narrow the blocking rule. Add an allow rule only when your security setup denies them by default.
Serve at least 500 characters of meaningful homepage content in raw HTML. Add a clear H1, keep deeper heading levels sequential, and remove excessive non-content markup.
Document your error responses in your OpenAPI spec: give 4xx and 5xx responses a typed error schema (or use RFC 9457 application/problem+json). A consistent error object with a machine-readable code and a human-readable message lets agents handle failures without guessing.
Return standard rate-limit headers on your API responses (the RFC RateLimit headers, plus Retry-After on a 429) so agents can self-throttle in real time, and document the conventions alongside your API.
Declare a versioning policy agents can rely on: version your API (in the URL path or a version header) and publish how you signal deprecation (a Sunset/Deprecation header or a documented timeline). Agents avoid integrating against a surface that can change without warning.
Checks are grouped by relevance for App sites.
3918 chars with H1, but 1.5% content ratio is below the 5% target
How to pass
Serve at least 500 characters of meaningful homepage content in raw HTML. Add a clear H1, keep deeper heading levels sequential, and remove excessive non-content markup.
Some AI crawlers are blocked - ChatGPT-User: unknown, ClaudeBot: reachable, Google-Extended: reachable, ora-agent: reachable, DeepSeekBot: reachable
How to pass
Verify that major agent User-Agents can reach the homepage. If your WAF or bot rules block them, remove or narrow the blocking rule. Add an allow rule only when your security setup denies them by default.
No meta-refresh stubs, JavaScript-redirect stubs, or cross-domain hops across 6 checked pages
All 5 sampled pages are publicly readable (3 with substantive content)
OpenAPI spec found at https://gomry.com/openapi.json (version: 3.1.0)
Canonical URL serves text/markdown and text/html via Accept negotiation with Vary: Accept
OAuth authorization server metadata at https://www.gomry.com
scopes_supported declares 3 scope(s) in RFC 9728 metadata (e.g. mcp, openid, email)
API returns JSON error responses (404 at https://api.gomry.com/v1/orank-probe-test)
Nonexistent paths return HTTP 404 with markdown guidance for agents - the strongest 404 contract
Valid sitemap found at https://www.gomry.com/sitemap.xml with multiple sitemaps entries
Rich JSON-LD identity: Organization with name, description, url, and sameAs/logo/address (1 block)
Pricing page found at /pricing
Documentation site found at https://docs.gomry.com
All metadata signals present: canonical URL, lang="en", og:image, og:type
Organization schema complete with contactPoint and address
All trust anchor pages verified: About, Contact, Privacy
All 7 measured pages fit an agent context budget (largest ~4K tokens)
Documented REST API detected; endpoints require authentication (API key / OAuth), which is expected for agent access. Best-of-protocols score: 7/7.
Low friction onboarding verified live: free tier available, self-serve key generation, sandbox/test environment, zero-auth access, zero-friction self-serve registration at /signup
MCP server detected at https://www.gomry.com/api/mcp/token; it requires authentication. Presence is verified (5/6), but Ora could not inspect its tools or verify access scopes without credentials.
How to pass
Keep authentication enabled. Verify tool listing with an authorized MCP client. This unauthenticated scan cannot establish whether protected tools are missing or unusable.
REST rate-limit headers documented in OpenAPI spec, but not observed on a live response (API requires authentication).
How to pass
Return standard rate-limit headers on your API responses (the RFC RateLimit headers, plus Retry-After on a 429) so agents can self-throttle in real time, and document the conventions alongside your API.
Partial typed error model: error schema defined but not consistently referenced (or vice versa)
How to pass
Document your error responses in your OpenAPI spec: give 4xx and 5xx responses a typed error schema (or use RFC 9457 application/problem+json). A consistent error object with a machine-readable code and a human-readable message lets agents handle failures without guessing.
API versioning found (URL versioning (servers or paths)) but no deprecation or sunset policy detected - add Sunset/Deprecation headers or a deprecation policy page
How to pass
Declare a versioning policy agents can rely on: version your API (in the URL path or a version header) and publish how you signal deprecation (a Sunset/Deprecation header or a documented timeline). Agents avoid integrating against a surface that can change without warning.
CLI tool mentioned in llms.txt
How to pass
Publish an official CLI tool on npm, PyPI, or Homebrew. A CLI lets agents and developers script interactions with your product without building API integrations from scratch.
100% of operations define typed response schemas, 100% use application/json
REST: agent-friendly schema (57 operations, 100% with operationIds, 100% documented by description or summary)
Compatible: 57/57 ops with IDs, 56/57 with typed schemas
ARD catalog valid at /.well-known/ard.json (spec 1.0) - 3/3 entries, trustManifest present
All 3 entries valid with domain-anchored urn:air identifiers (catalog at /.well-known/ard.json)
trustManifest present on catalog entries (3/3 entries valid, catalog at /.well-known/ard.json)
Name search surfaced no pages on gomry.com, although developer resources exist on the site (API docs, OpenAPI spec, developer portal, auth docs, MCP server) - weak search indexing or transient search noise
How to pass
Check whether your developer resources (API docs, OpenAPI spec, auth docs, developer portal, MCP server, SDK documentation) surface in name-based searches. If they do not, use predictable URLs, link them in llms.txt, and include your product name in page titles and headings. This result reflects one search sample.
gomry.com appears at position #3 in a clean brand-name search for "Gomry" (4 total matches)
NPM package found: @gomry/analytics - "Gomry Analytics SDK for conversion tracking in sponsored cashback campaigns"
MCP manifest has full branding (name, icon, description) at /.well-known/mcp.json
Agent discovery file found at /.well-known/agent-skills
A2A Agent Card found: "Gomry"
pricing.md found at /pricing.md but thin (84 lines) - add plan tiers, prices, and feature breakdowns
How to pass
Create a /pricing.md file with your pricing tiers, features, and limits in plain markdown. This lets AI agents compare costs and recommend plans without scraping HTML pricing pages.
Valid Schema Map XML found at https://www.gomry.com/schemamap.xml
MCP server referenced in llms.txt
Agent mode view found at ?mode=agent (7 signals: llms.txt, openapi, mcp, api, endpoint, agent, integration)
How to pass
Add a ?mode=agent query parameter to your homepage that returns a structured, machine-readable view with API endpoints, authentication info, and key capabilities instead of marketing HTML.
RFC 8288 Link header advertises: sitemap, describedby, alternate(markdown)
Homepage markdown fallback works (https://gomry.com/index.md). No additional same-host content pages were discovered to sample.
100% of 5 sampled sitemap entries carry lastmod; newest is 0 day(s) old
Found the llms.txt at https://docs.gomry.com/llms.txt.
The llms.txt is well-formatted: 84 lines with markdown links, 10,831 characters in total.
Agent instruction with when-to-use guidance at /.well-known/agent-skills/
Entity linking to github.com - add more authority profiles (Wikipedia, Wikidata, LinkedIn, GitHub)
How to pass
Add sameAs links in your JSON-LD structured data pointing to your Wikipedia page, Wikidata entry, GitHub org, and social profiles. This helps AI disambiguate your brand from similarly named entities.
Rich schema vocabulary: FAQPage, Service, BreadcrumbList
All 5 probed llms.txt links resolve to real content
Markdown alternate advertised and verified: https://www.gomry.com/home.md serves markdown
Frontmatter with title + description and canonical on /index.md
Code fences balanced across 2 markdown documents
Developer portal found at /dashboard
RFC 9727 api-catalog with 4 API link(s) and rfc9727 profile
Path-suffix markdown docs served with text/markdown content-type: /agents.md, /auth.md, /index.md
product MCP requires authentication with OAuth metadata discovery
RFC 8414 OAuth metadata for product MCP: issuer=https://www.gomry.com, auth and token endpoints present; client registration: DCR endpoint only (RFC 7591, deprecated in favor of CIMD)
OAuth metadata for product MCP supports PKCE S256 code challenge
Web Bot Auth directory has no 'keys' array
How to pass
Publish a Web Bot Auth directory at /.well-known/http-message-signatures-directory. Serve a JSON document with a 'keys' array of Ed25519 JWKs (kty=OKP, crv=Ed25519, kid, nbf, exp). This lets agents sign their requests per RFC 9421 so you can distinguish legitimate bots from spoofers.
RFC 9728 metadata: resource=https://www.gomry.com, authorization_servers (1), scopes_supported (3), bearer_methods_supported
auth.md at https://gomry.com/auth.md served as text/markdown; charset=utf-8 (5000 chars)
WorkOS auth.md structure at https://gomry.com/auth.md - 4/8 walkthrough sections (found Discover, Pick a method, Register, and Use credential); anchors: oauth-protected-resource, oauth-authorization-server, and agent_auth
Static fallback: PRM + AS metadata reachable with agent_auth block, but identity_endpoint missing
How to pass
Make your published auth-discovery chain traversable end to end: an agent starting at /auth.md (or your protected-resource metadata) should be able to follow the links to your authorization-server metadata and registration endpoint without hitting a dead link. Test the whole path, not just each file in isolation.
PRM + AS metadata both present (AS metadata fetched from advertised origin https://www.gomry.com) but AS metadata agent_auth block missing identity_endpoint
How to pass
Publish RFC 9728 protected-resource metadata at /.well-known/oauth-protected-resource on your resource server (the host that actually serves the API, e.g. api.<apex>) with resource and authorization_servers. Publish RFC 8414 authorization-server metadata at /.well-known/oauth-authorization-server on the AS origin, and include the WorkOS auth.md agent_auth block with identity_endpoint, identity_types_supported drawn from the spec enum (anonymous, identity_assertion, service_auth - the assertion variant, the ID-JAG URN urn:ietf:params:oauth:token-type:id-jag, belongs inside identity_assertion.assertion_types_supported, not at the top level), and the identity_assertion.assertion_types_supported block when you advertise that type, so agents can check their assertion shape is accepted before minting. Cross-link by listing the AS origin in PRM authorization_servers, and point agent_auth.skill back at your published /auth.md. Spec: https://github.com/workos/auth.md.
Imperative WebMCP API detected (document.modelContext.registerTool in inline script).
REST Idempotency-Key header found on POST /events in OpenAPI spec
Offset/page-based pagination found in OpenAPI spec - consider migrating to cursor-based pagination for agent friendliness
How to pass
Use a consistent, documented pagination shape on your list endpoints (cursor-based preferred) and define the pagination fields in your OpenAPI response schemas, so agents can page through results without guessing the shape.
SDK package found only in npm
How to pass
Publish official SDK packages across multiple language ecosystems (npm, PyPI, Go modules, RubyGems). Auto-generate them from your OpenAPI spec using tools like openapi-generator. For each package set the project URL or homepage to your product domain (package.json repository/homepage, PyPI Home-Page or project_urls, RubyGems homepage_uri) - this is how agents verify the package is your official SDK.
NLWeb /ask endpoint returns JSON with _meta (partial conformance, via POST)
Server HTML is a well-structured document (main=true, landmarks=4/4, h1=1, maxHeadingSkip=1).
128 native controls, 0 non-native div-soup affordances (100% native).
128/128 interactive elements have a computable accessible name (100%).
2/2 form controls have an associated label (100%).
No hidden instruction text detected in accessibility-tree attributes or off-screen content.
UCP discovery profile at https://gomry.com/.well-known/ucp; version 2026-04-08; capabilities: dev.ucp.shopping.checkout
What does gomry.com do and who is it for? Explain it back to me.
Sign me up for Vercel product updates and marketing emails.
Unsubscribe anytime. Privacy Notice
Source: Ora API
What does gomry.com do and who is it for? Explain it back to me.
10 steps2 reasoning steps1 search
The agent successfully assembled a comprehensive explanation of Gomry's business model, target users, pricing, and differentiation by fetching the homepage and business pricing page, then supplementing with web search for founder background. The site was moderately navigable but required the agent to discover that /pricing redirects to a separate business subdomain; pricing for organizers was directly accessible, but attendee monetization and detailed competitor comparisons were not explicitly published.