polymorfa.com
Finalizing the report
Preparing the stored Is Agentic score
Essential—
Recommended—
Bonus signals—
polymorfa.com
Preparing the stored Is Agentic score
polymorfa.com
These checks describe whether an ordinary agent can enter, read, and operate the public site.
Agents can reach the site
Crawler access and bot defenses.
Core content is available
Useful content remains accessible without a fragile browser-only path.
Navigation fails safely
Redirects and missing pages give agents a recoverable path.
Controls are understandable
Forms and interactive controls expose usable names and structure.
The public website is always evaluated. Optional surfaces appear when the scan finds positive evidence that they apply.
Strong
Weighted across 17 applicable checks
Strong
Weighted across 12 applicable checks
Strong
Weighted across 3 applicable checks
Critical access gaps come first, followed by other applicable readiness gaps.
Serve at least 500 characters of meaningful homepage content in raw HTML. Add a clear H1, keep deeper heading levels sequential, and remove excessive non-content markup. Inner pages need their main text in the raw HTML too, not only after JavaScript runs.
Implement OAuth 2.0 for API authentication. Publish your authorization server metadata at /.well-known/oauth-authorization-server.
Declare scoped API permissions where machines can read them: named OAuth scopes in your OpenAPI security schemes, or scopes_supported in RFC 9728 protected-resource metadata. Prose descriptions of roles help humans, but agents need the machine-readable declaration to request least-privilege access.
Declare a versioning policy agents can rely on: version your API (in the URL path or a version header) and publish how you signal deprecation (a Sunset/Deprecation header or a documented timeline). Agents avoid integrating against a surface that can change without warning.
Offer a free tier or trial, self-serve API key generation, and a sandbox environment. Agents can't fill out 'contact sales' forms.
Checks are grouped by relevance for App sites.
Homepage: 12892 chars with H1, but 3.9% content ratio is below the 5% target. 5 of 5 sampled inner pages have text without JavaScript.
How to pass
Serve at least 500 characters of meaningful homepage content in raw HTML. Add a clear H1, keep deeper heading levels sequential, and remove excessive non-content markup. Inner pages need their main text in the raw HTML too, not only after JavaScript runs.
Site accessible to 4 agent user-agents (ChatGPT-User, OAI-SearchBot, Claude-User, PerplexityBot).
No meta-refresh or JavaScript-redirect stubs across 24 checked pages
All 5 sampled pages are publicly readable (5 with substantive content)
OpenAPI spec found at https://www.polymorfa.com/openapi.json (version: 3.1.0)
Canonical URL serves text/markdown and text/html via Accept negotiation with Vary: Accept
No OAuth 2.0 or OpenID Connect support detected
How to pass
Implement OAuth 2.0 for API authentication. Publish your authorization server metadata at /.well-known/oauth-authorization-server.
OpenAPI declares security schemes but no named OAuth scopes - agents get all-or-nothing access. Declare per-scope grants (e.g. read:*, write:*) in the spec.
How to pass
Declare scoped API permissions where machines can read them: named OAuth scopes in your OpenAPI security schemes, or scopes_supported in RFC 9728 protected-resource metadata. Prose descriptions of roles help humans, but agents need the machine-readable declaration to request least-privilege access.
API returns JSON error responses (404 at https://www.polymorfa.com/api/v1/orank-probe-test)
MCP server exposes 1 resource(s) via resources/list
Nonexistent paths return HTTP 404 with markdown guidance for agents - the strongest 404 contract
No noindex on the homepage: no robots, googlebot or bingbot meta tag and no X-Robots-Tag header hides it from search.
Valid sitemap found at https://www.polymorfa.com/sitemap.xml with 124 entries
Rich JSON-LD identity: Organization with name, description, url, and sameAs/logo/address (1 block)
Pricing page found at /pricing
Documentation site found at https://docs.polymorfa.com
All metadata signals present: canonical URL, lang="en", og:image, og:type
Organization schema complete with contactPoint and address
All trust anchor pages verified: About, Contact, Privacy
All 7 measured pages fit an agent context budget (largest ~4K tokens)
REST API documentation found at https://docs.polymorfa.com. Best-of-protocols score: 7/7.
Onboarding signals described but not verified live: self-serve key generation, sandbox/test environment, zero-auth access
How to pass
Offer a free tier or trial, self-serve API key generation, and a sandbox environment. Agents can't fill out 'contact sales' forms.
MCP server connected via Streamable HTTP - Polymorfa v1.0.0 (protocol 2025-11-25)
REST rate-limit headers documented in OpenAPI spec, but not observed on a live response.
How to pass
Return standard rate-limit headers on your API responses (the RFC RateLimit headers, plus Retry-After on a 429) so agents can self-throttle in real time, and document the conventions alongside your API.
OpenAPI defines a typed error schema in components.schemas and 4xx/5xx responses reference it
No API versioning strategy found - add URL path versioning (/v1/, /v2/) or a versioned header parameter in your OpenAPI spec
How to pass
Declare a versioning policy agents can rely on: version your API (in the URL path or a version header) and publish how you signal deprecation (a Sunset/Deprecation header or a documented timeline). Agents avoid integrating against a surface that can change without warning.
CLI package found on npm: @polymorfa/cli
98% of operations define typed response schemas, 96% use application/json
REST: agent-friendly schema (503 operations, 100% with operationIds, 100% documented by description or summary)
Compatible: 503/503 ops with IDs, 474/503 with typed schemas
1/1 resources read with valid mimeType and non-empty content
In a search for your API docs, your docs came up at #2 (https://docs.polymorfa.com/api/overview). In a search for your MCP server, SDK or CLI, we found your CLI at #1 (https://www.polymorfa.com/cli), MCP server at #2 (https://www.polymorfa.com/mcp)
polymorfa.com ranks #1 for "Polymorfa WhatsApp API" but is not in the top 10 for "Polymorfa WhatsApp automation"
NPM package found: @polymorfa/sdk - "Handwritten Polymorfa server SDK for TypeScript and Node.js"
MCP server referenced in llms.txt
RFC 8288 Link header advertises: api-catalog, alternate(markdown)
Partial markdown fallback support. Homepage (https://polymorfa.com/index.md) returns markdown, but 3 of 3 sampled content pages do not: https://www.polymorfa.com/acceptable-use.md, https://www.polymorfa.com/compare/rasayel.md, https://www.polymorfa.com/privacy.md. To earn full credit, serve a .md twin for each content page (e.g. /docs/auth -> /docs/auth.md, or /docs/index.md for a section root like /docs) with text/markdown content-type or a heading-led non-HTML body.
How to pass
Let agents fetch markdown by appending .md to page URLs. Required for any credit: serve a markdown homepage at /index.md. For full credit (2/2): also serve a .md twin for each content page (e.g. /docs/auth -> /docs/auth.md). Content-Type should be text/markdown and the body should start with a top-level heading (not HTML).
100% of 124 sampled sitemap entries carry lastmod; newest is 1 day(s) old
Found the llms.txt at https://docs.polymorfa.com/llms.txt.
The llms.txt at https://polymorfa.com/llms.txt is well-formatted with markdown links, but at 51,747 characters it exceeds the 30,000-character recommendation for a navigation index.
How to pass
Format your llms.txt as a navigation index: start with a markdown heading, include markdown links to deeper resources, and keep it under 30,000 characters. Agents truncate an llms.txt past 100,000 characters, so nothing after that point is read. If you have more to say, move long-form content into /llms-full.txt or per-section files (e.g. /docs/llms.txt, /api/llms.txt) and link to them from the main index.
When-to-use guidance found in llms.txt
1 of 5 probed llms.txt links do not resolve: https://docs.polymorfa.com/get-started/quickstart
How to pass
Make every link your llms.txt declares resolve to real content. Verify each one with curl -L <url> - you should see the linked document, not your homepage. If your app returns the homepage shell for unknown paths (common with single-page apps), a 200 status is not proof: check the body. Fix or remove any dead link; agents that follow the index treat a broken link as a dead end.
Markdown alternate advertised and verified: https://www.polymorfa.com/index.md serves markdown
Code fences balanced across 1 markdown document
Developer portal found at /console
api-catalog linkset[0] has no 'item' entries
How to pass
Publish an API catalog at /.well-known/api-catalog per RFC 9727. Serve it with Content-Type: application/linkset+json;profile="https://www.rfc-editor.org/info/rfc9727" and include a 'linkset' array with item entries pointing to your OpenAPI specs and service descriptions.
Path-suffix markdown docs served with text/markdown content-type: /index.md
All 3 tools on docs MCP have detailed descriptions (>= 30 chars)
3/3 tools on docs MCP have parameter schemas
docs MCP identifies as "Polymorfa" v1.0.0 with instructions
docs MCP exposes 3 tool(s) - focused docs surface
All 3 tool names follow consistent convention, descriptive, and non-generic
docs MCP is public - correct posture for documentation surface
docs MCP returns structured JSON-RPC errors with code and message
docs MCP uses modern Streamable HTTP transport
REST Idempotency-Key header found on POST /messaging/{session}/messages/send in OpenAPI spec
Cursor-based pagination found in OpenAPI spec response schemas or query parameters
Async job pattern detected: 202 Accepted with a Location header or job-tracking fields on the 202 body
SDK package found only in npm
How to pass
Publish official SDK packages across multiple language ecosystems (npm, PyPI, Go modules, RubyGems). Auto-generate them from your OpenAPI spec using tools like openapi-generator. For each package set the project URL or homepage to your product domain (package.json repository/homepage, PyPI Home-Page or project_urls, RubyGems homepage_uri) - this is how agents verify the package is your official SDK.
docs MCP: 3/3 tools have behavioral annotations
MCP server card found at https://docs.polymorfa.com/.well-known/mcp/server-card.json (2 tools advertised) (note: card leaves out 1 live tool: submit_feedback)
Sandbox environment found at https://polymorfa.com/sandbox
Batch endpoint found in OpenAPI spec (/batch path)
Server HTML is a well-structured document (main=true, landmarks=4/4, h1=1, maxHeadingSkip=1).
130 native controls, 0 non-native div-soup affordances (100% native).
129/130 interactive elements have a computable accessible name (99%).
No hidden instruction text detected in accessibility-tree attributes or off-screen content.
What does polymorfa.com do and who is it for? Explain it back to me.
Sign me up for Vercel product updates and marketing emails.
Unsubscribe anytime. Privacy Notice
Source: Ora API
What does polymorfa.com do and who is it for? Explain it back to me.
6 steps2 reasoning steps
Agent successfully explored polymorfa.com and synthesized a comprehensive overview of what the company does, who it serves, how it's priced, and how it differs from competitors. The site was navigable—pricing and positioning were clearly stated on fetched pages—but some design details (credit units, bonus multiplier logic, and the Linked Devices vs. Meta Cloud API distinction) remained underexplained or required model reasoning to clarify for a lay audience.