laso.finance
Finalizing the report
Preparing the stored Is Agentic score
Essential—
Recommended—
Bonus signals—
laso.finance
Preparing the stored Is Agentic score
laso.finance
These checks describe whether an ordinary agent can enter, read, and operate the public site.
Agents can reach the site
Crawler access and bot defenses.
Core content is available
Useful content remains accessible without a fragile browser-only path.
Navigation fails safely
Redirects and missing pages give agents a recoverable path.
Controls are understandable
Forms and interactive controls expose usable names and structure.
The public website is always evaluated. Optional surfaces appear when the scan finds positive evidence that they apply.
Strong
Weighted across 17 applicable checks
Strong
Weighted across 12 applicable checks
Ready with gaps
Weighted across 3 applicable checks
Strong
Weighted across 3 applicable checks
Strong
Weighted across 1 applicable check
Critical access gaps come first, followed by other applicable readiness gaps.
Declare scoped API permissions where machines can read them: named OAuth scopes in your OpenAPI security schemes, or scopes_supported in RFC 9728 protected-resource metadata. Prose descriptions of roles help humans, but agents need the machine-readable declaration to request least-privilege access.
Publish an official CLI tool on npm, PyPI, or Homebrew. A CLI lets agents and developers script interactions with your product without building API integrations from scratch.
Declare a versioning policy agents can rely on: version your API (in the URL path or a version header) and publish how you signal deprecation (a Sunset/Deprecation header or a documented timeline). Agents avoid integrating against a surface that can change without warning.
Keep authentication enabled. Verify tool listing with an authorized MCP client. This unauthenticated scan cannot establish whether protected tools are missing or unusable.
Checks are grouped by relevance for App sites.
Homepage: 3627 chars, semantic headings (1 H1 + 1 H2s + 3 H3s), 15.7% content ratio. 5 of 5 sampled inner pages have text without JavaScript.
Site accessible to 3 agent user-agents (ChatGPT-User, OAI-SearchBot, Claude-User). Can't verify PerplexityBot. A bot shield, rate limit, or timeout stopped our test request. Real crawlers come from their own networks and may get through.
No meta-refresh or JavaScript-redirect stubs across 21 checked pages
All 5 sampled pages are publicly readable (4 with substantive content)
OpenAPI spec found at https://laso.finance/openapi.json (version: 3.1.0)
Canonical URL serves text/markdown and text/html via Accept negotiation with Vary: Accept
OAuth authorization server metadata at https://laso.finance
OpenAPI declares security schemes but no named OAuth scopes - agents get all-or-nothing access. Declare per-scope grants (e.g. read:*, write:*) in the spec.
How to pass
Declare scoped API permissions where machines can read them: named OAuth scopes in your OpenAPI security schemes, or scopes_supported in RFC 9728 protected-resource metadata. Prose descriptions of roles help humans, but agents need the machine-readable declaration to request least-privilege access.
API returns JSON error responses (402 at GET https://laso.finance/get-card, an operation in the OpenAPI spec)
MCP server exposes 1 resource(s) via resources/list
Nonexistent paths return HTTP 404 with markdown guidance for agents - the strongest 404 contract
No noindex on the homepage: no robots, googlebot or bingbot meta tag and no X-Robots-Tag header hides it from search.
Valid sitemap found at https://laso.finance/sitemap.xml with 5249 entries
Rich JSON-LD identity: Organization with name, description, url, and sameAs/logo/address (5 blocks)
Pricing page found at /pricing
Documentation site found at https://docs.laso.finance
All metadata signals present: canonical URL, lang="en", og:image, og:type
Organization schema complete with contactPoint and address
All trust anchor pages verified: About, Contact, Privacy
All 9 measured pages fit an agent context budget (largest ~4K tokens)
REST API documentation found at /docs/api. Best-of-protocols score: 7/7.
Low friction onboarding verified live: self-serve key generation, sandbox/test environment, zero-auth access, zero-friction self-serve registration at /signup
MCP server detected at https://laso.finance/mcp; it requires authentication. Presence is verified (5/6), but Ora could not inspect its tools or verify access scopes without credentials.
How to pass
Keep authentication enabled. Verify tool listing with an authorized MCP client. This unauthenticated scan cannot establish whether protected tools are missing or unusable.
The live API operation https://laso.finance/version returns IETF RateLimit headers: ratelimit-limit, ratelimit-policy, ratelimit-remaining.
OpenAPI defines a typed error schema in components.schemas and 4xx/5xx responses reference it
Sunset or Deprecation headers found in OpenAPI spec but no URL or header versioning strategy detected
How to pass
Declare a versioning policy agents can rely on: version your API (in the URL path or a version header) and publish how you signal deprecation (a Sunset/Deprecation header or a documented timeline). Agents avoid integrating against a surface that can change without warning.
No CLI tool found
How to pass
Publish an official CLI tool on npm, PyPI, or Homebrew. A CLI lets agents and developers script interactions with your product without building API integrations from scratch.
99% of operations define typed response schemas, 99% use application/json
REST: agent-friendly schema (82 operations, 100% with operationIds, 100% documented by description or summary)
Compatible: 82/82 ops with IDs, 68/82 with typed schemas
1/1 resources read with valid mimeType and non-empty content
ARD catalog valid at /.well-known/ard.json (spec 1.0) - 6/6 entries, trustManifest present
Valid AI Catalog at /.well-known/ai-catalog.json (spec 1.0) - 6/6 entries
All 6 entries valid with domain-anchored urn:air identifiers (catalog at /.well-known/ard.json)
trustManifest present on catalog entries (6/6 entries valid, catalog at /.well-known/ard.json)
In a search for your API docs, your docs came up at #2 (https://docs.laso.finance/api-reference/introduction). In a search for your MCP server, SDK or CLI, we found your MCP server at #2 (https://docs.laso.finance/frameworks/claude-code)
laso.finance ranks #2 for "Laso Finance" (searched your brand name alone: no main product term from your homepage qualified)
Verified in the official MCP Registry as finance.laso/laso-finance via domain-namespace
Agent config found: github.com/lasofinance/docs/blob/main/AGENTS.md
MCP manifest has full branding (name, icon, description) at /.well-known/mcp/server-card.json
ChatGPT plugin manifest found: "Laso Finance"
Agent Skills index (agentskills.io) found at /.well-known/agent-skills/index.json with 1 skill(s)
Index v0.2.0 conformant; verified SHA-256 of "laso-finance" (skill-md)
1 official skill published on skills.sh - 1 total installs (skills.sh/lasofinance)
Structured pricing.md found at /pricing.md (22 lines)
MCP server discoverable via server-card.json at /.well-known/mcp/
Rich agent mode view at ?mode=agent with 8 agent signals and navigation links
RFC 8288 Link header advertises: describedby, service-desc, service-doc, api-catalog
Full markdown fallback support. Homepage (https://laso.finance/index.md) and all 3 sampled content pages return markdown: https://laso.finance/about.md, https://laso.finance/gift-cards/adidas-my.md, https://laso.finance/gift-cards/albrekts-guld-se.md
Modular llms.txt files found for sections: developers, guides
100% of 500 sampled sitemap entries carry lastmod; newest is 0 day(s) old
Found the llms.txt at https://laso.finance/llms.txt.
The llms.txt is well-formatted: 86 lines with markdown links, 15,762 characters in total.
When-to-use guidance found in llms.txt
Strong entity linking via sameAs: github.com, linkedin.com
Some extended schema types found: FAQPage, Service - add 1 more type that matches what the homepage shows, for full coverage
How to pass
Add 1 more JSON-LD type that matches what your homepage shows. Only add a type where the page shows that content.
All 5 probed llms.txt links resolve to real content
Markdown alternate advertised and verified: https://laso.finance/SKILL.md serves markdown
Frontmatter with title + description and canonical on /developers.md
Code fences balanced across 2 markdown documents
Developer portal found at https://docs.laso.finance
application/linkset+json api-catalog with 3 API link(s)
Path-suffix markdown docs served with text/markdown content-type: /developers.md, /auth.md, /index.md
All 3 tools on docs MCP have detailed descriptions (>= 30 chars)
3/3 tools on docs MCP have parameter schemas
docs MCP identifies as "Laso Finance API" v1.0.0 with instructions
docs MCP exposes 3 tool(s) - focused docs surface
All 3 tool names follow consistent convention, descriptive, and non-generic
product MCP requires authentication with OAuth metadata discovery
RFC 8414 OAuth metadata for product MCP: issuer=https://laso.finance, auth and token endpoints present; client registration: CIMD (client_id_metadata_document_supported)
OAuth metadata for product MCP supports PKCE S256 code challenge
RFC 9728 metadata: resource=https://laso.finance/, authorization_servers (1), bearer_methods_supported
auth.md at https://laso.finance/auth.md served as text/markdown; charset=utf-8 (5000 chars)
WorkOS auth.md structure at https://laso.finance/auth.md - 5/8 walkthrough sections (found Discover, Pick a method, Register, Claim, and Use credential); anchors: oauth-protected-resource, oauth-authorization-server, and agent_auth
Static fallback (deep check disabled): PRM + AS metadata both reachable with agent_auth.identity_endpoint (https://laso.finance/auth) (advertised under the pre-v0.2 register_uri key); walkthrough discoverable end-to-end
PRM + AS metadata cross-linked; agent_auth has identity_endpoint (https://laso.finance/auth) (advertised under the pre-v0.2 register_uri key), identity_types_supported [anonymous, service_auth] with the required per-type blocks, and skill -> https://laso.finance/auth.md (also advertised: claim_endpoint; events_endpoint, events_supported absent)
agent_auth endpoints reachable (source: AS metadata agent_auth block) - identity_endpoint: HTTP 204, claim_endpoint: HTTP 204, events_endpoint: not advertised
docs MCP returns structured JSON-RPC errors with code and message
docs MCP uses modern Streamable HTTP transport
Imperative WebMCP API detected (document.modelContext.registerTool in script bundle /assets/index-Cz-VEiMg.js).
REST Idempotency-Key header referenced on POST /start-card-issuer-link via #/components/parameters/IdempotencyKey
Offset/page-based pagination found in OpenAPI spec - consider migrating to cursor-based pagination for agent friendliness
How to pass
Use a consistent, documented pagination shape on your list endpoints (cursor-based preferred) and define the pagination fields in your OpenAPI response schemas, so agents can page through results without guessing the shape.
Async job pattern detected: 202 Accepted with a Location header or job-tracking fields on the 202 body
docs MCP: 3/3 tools have behavioral annotations
MCP server card found at https://laso.finance/.well-known/mcp/server-card.json (80 tools advertised)
You run both: a product MCP server (https://laso.finance/mcp) for actions and a docs MCP server (https://docs.laso.finance/mcp) for documentation.
Sandbox environment found at https://laso.finance/docs/sandbox
27 native controls, 0 non-native div-soup affordances (100% native).
27/27 interactive elements have a computable accessible name (100%).
No hidden instruction text detected in accessibility-tree attributes or off-screen content.
MPP 402 challenge found at GET https://laso.finance/auth with 5/5 required params
x402 payment challenge at GET https://laso.finance/auth (v2)
What does laso.finance do and who is it for? Explain it back to me.
Sign me up for Vercel product updates and marketing emails.
Unsubscribe anytime. Privacy Notice
Source: Ora API
What does laso.finance do and who is it for? Explain it back to me.
6 steps2 reasoning steps
The agent successfully understood and explained Laso Finance by fetching machine-readable documentation that the site explicitly surfaced in its HTML comments. Steps [2], [3], and [4] (llms.txt, llms-full.txt, and openapi.json) provided comprehensive, well-structured answers to what Laso does, who it's for, how it's priced, and how it differs from alternatives. The site was highly navigable for AI agents—it published answers in agent-native formats rather than requiring the agent to scrape or infer from a traditional UI.