We ran our scanner on ourselves and scored 69

The reading, 20 October 2026

$ npx tsx scripts/smoke.ts https://storedeploy.com

storedeploy.com  ->  69/100 (C)  status=partial
                     platform=Next.js (headless)  1012ms

   Agent discovery (UCP):            45
   AI crawler access:               100
   Product data agents can read:  -- unverified
   Catalogue reachability:           89

   findings:
     [critical] No UCP profile at /.well-known/ucp
     [medium]   No Organization markup on the homepage
     [medium]   No machine-readable product endpoint
     [low]      No product page could be inspected
     [low]      No llms.txt

That is the same code path a visitor gets, run from the command line against the live site. Two of those findings were simply ours to wear: we audit structured data and had none, and we tell merchants about llms.txt without having one. Both are fixed. The critical one is a decision, not an oversight.

Finding by finding

Why the score barely moves, and why that matters

Here is the part that would be easy to leave out. Fixing the Organization finding earns us nothing: the product-data category is excluded from the total, because we have no product pages for the scanner to read, so its findings are listed but unscored. Publishing llms.txt moves catalogue reachability from 89 to 91, worth about a third of a point overall.

weighted = (45 x 0.40  +  100 x 0.25  +  89 x 0.10) / 0.75
         = (18     +  25       +  8.9      ) / 0.75
         = 69.2
         -> 69

0.40  agent discovery (UCP)
0.25  AI crawler access
0.25  product data        <- excluded: we have no product pages to read
0.10  catalogue reachability

A critical finding also caps any score at 74, so 69 is the
score with or without the cap.

So after this round of work, our score is still 69. The only lever that moves it is a UCP profile, which carries 40% of the weight. That fact is what makes the next section a decision worth explaining rather than a corner we cut.

The decision: we are not publishing a UCP profile

We sell UCP conformance. Our own domain has no UCP profile. That looks indefensible until you read what a profile is, so here is the specification on exactly that point.

Three things follow, and together they settle it.

1. There is no such thing as an organization-only profile

We looked for one, because it would have been the convenient answer. A UCP profile carries protocol metadata and nothing else: there is no name, no description, no contact and no organization member anywhere in the profile structure. A profile has nowhere to say who you are. It is a seller's declaration of what an agent can do with it, which means the only document we could legally publish is this one:

{
  "ucp": {
    "version": "2026-08-25",
    "services": {},
    "payment_handlers": {}
  }
}

2. Our own scanner would flag that document three times

Point the scanner at that file and it reports no services declared, no capabilities declared and no payment handlers declared. We would be publishing a document that the product we sell describes as three open problems, on the domain that sells it. Our managed profile page has said from the start that a profile is a promise and that declaring a service you have not built is worse than declaring nothing. That has to apply to us first.

3. The motive would be visibly cosmetic

Publishing the empty profile would take us from 69 to roughly 72, because the empty-registry penalties replace most of the missing-profile penalty. Still grade C. Three points. Nobody fixes a real problem for three points, so the only thing it would buy is the absence of a red line on our own report — which is precisely the behaviour we built the scanner to detect in other people.

What this means when you scan your own store

Two things, both useful.

First, a score is only meaningful for a site that sells. Our 69 is the scanner correctly measuring a site it was not built to grade: 40% of the weight asks whether agents can buy from us, and the answer is no by design. If you point it at a blog or a brochure site, read the findings and ignore the number.

Second, if you are on Shopify you may well have nothing to buy from us. We checked a live Shopify store and found a conformant profile at version 2026-08-25, served by the platform. Run the scan anyway, because crawler access and product markup are yours rather than Shopify's, and a blocked AI crawler undoes the rest. But we would rather tell you that than sell you something.