1password.com
Journey
60.6/ 100
C · Needs work
Waymark scored 1password.com 60.6/100 (C) on 26 Aug 2026.
1password.com is blockers remain. Access is the strongest layer, and Discovery is the open one. Next: openAPI document.
FindMixed
9.6/20
7 of 17 checks passed
DoorMixed
21.2/30
20 of 29 checks passed
ToolsMixed
23.8/40
8 of 14 checks passed
Pay
N/A
No cart or pay rail — out of the denominator.
Group by
1. Can an agent discover and trust you? 65/100
Whether an agent can find this origin from public files and treat it as the real one.
pass
HTTPS reachable
2/2
Evidence. Homepage responded 200 over HTTPS.
Probed homepage.
pass
robots.txt present
2/2
Evidence. Valid robots.txt with User-agent rules.
Probed robots.txt.
pass
XML sitemap
2/2
Evidence. Found sitemap.xml or sitemap index.
failed
Well-known AI catalog
0/1
Evidence. No ai-plugin.json or ai-catalog.json.
Recommended fix. Add /.well-known/ai-plugin.json or /.well-known/ai-catalog.json.
failed
AGENTS.md
0/1
Evidence. agents.md status 404.
Probed public URLs named in the evidence.
Recommended fix. Publish /agents.md with agent-oriented usage notes.
partial
robots.txt AI policy
Required
1/2
Evidence. robots.txt present but no named AI crawlers.
Probed robots.txt.
Recommended fix. Name GPTBot, ClaudeBot, Google-Extended, PerplexityBot and state allow or deny.
pass
Sitemap for agents
Recommended
2/2
Evidence. Sitemap document fetched.
Probed sitemap.
failed
HTTP Link header
bonus
0/1
Evidence. No rel=sitemap|describedby|api-catalog|alternate on homepage.
Probed homepage + sitemap.
Recommended fix. Send RFC 8288 Link headers for related machine resources.
failed
ai-plugin.json
bonus
0/1
Evidence. No /.well-known/ai-plugin.json.
Probed well-known paths.
Recommended fix. Optionally publish a plugin-style capability manifest.
n/a
API catalog linkset
bonus
0/2
Evidence. No public API catalog (N/A).
scanner error
Wikipedia sitelink
bonus
0/4
Evidence. Wikidata SPARQL The operation was aborted
Scanner error — not counted as a site fail and not in the score denominator.
scanner error
Wikidata official website
bonus
0/3
Evidence. Wikidata SPARQL The operation was aborted
Scanner error — not counted as a site fail and not in the score denominator.
scanner error
Brand official-website match
Recommended
0/3
Evidence. Wikidata SPARQL The operation was aborted
Scanner error — not counted as a site fail and not in the score denominator.
pass
Public MCP registry listing
bonus
1/1
Evidence. Registry hit at https://glama.ai/mcp/servers?query=1password.
Probed public URLs named in the evidence.
pass
Package homepage match
bonus
1/1
Evidence. npm package homepage matches 1password.com.
Probed homepage.
failed
Sitemap lastmod
bonus
0/1
Evidence. Sitemap without lastmod.
Recommended fix. Add lastmod dates to sitemap entries.
n/a
related-website-set
bonus
0/1
Evidence. No related-website-set (N/A unless multi-origin).
n/a
ads.txt
bonus
0/1
Evidence. No ads inventory (N/A).
2. Do you welcome agents? 92/100
Whether crawlers and signed bots are allowed through rather than blocked at the door.
pass
AI crawlers not blanket-blocked
2/2
Evidence. No blanket Disallow: / for common AI bots.
n/a
robots Crawl-delay
bonus
0/1
Evidence. No Crawl-delay (optional).
n/a
Web Bot Auth keys
Recommended
0/2
Evidence. No http-message-signatures-directory.
partial
CORS / API hint
0.5/1
Evidence. No CORS header or obvious API path.
Recommended fix. If you expose an API, send Access-Control-Allow-Origin for intended clients.
pass
CSP or X-Frame-Options
1/1
Evidence. CSP or X-Frame-Options present.
pass
robots.txt agent-user policy
Required
2/2
Evidence. No Disallow: / for ChatGPT-User, Claude-User, or Perplexity-User (silence passes).
3. Does an agent understand who you are and what you do? 43/100
Whether the site explains the product in language a model can ingest.
pass
Title and description
2/2
Evidence. Title and meta description present.
failed
JSON-LD structured data
0/4
Evidence. No JSON-LD on the homepage.
Probed homepage.
Recommended fix. Add JSON-LD (Organization, WebSite, or SoftwareApplication).
pass
html lang attribute
1/1
Evidence. html[lang] is set.
failed
JSON-LD entities
Recommended
0/4
Evidence. No JSON-LD.
Recommended fix. Embed Organization, Product, Offer, SoftwareApplication, or FAQPage.
n/a
JSON-LD sameAs
bonus
0/2
Evidence. No JSON-LD.
pass
Open Graph basics
bonus
2/2
Evidence. Open Graph plus canonical.
failed
llms.txt
0/2
Evidence. llms.txt status 404.
Probed public URLs named in the evidence.
Recommended fix. Add /llms.txt describing the site for language models. Verify: curl -sI https://1password.com/llms.txt
failed
llms.txt index
Recommended
0/2
Evidence. Missing /llms.txt.
Recommended fix. Add a markdown index at /llms.txt. Verify: curl -sI https://1password.com/llms.txt
failed
llms.txt size and links
Recommended
0/2
Evidence. No llms.txt to score.
Recommended fix. Keep /llms.txt over ~200 characters with absolute URLs to docs.
failed
llms-full.txt
bonus
0/1
Evidence. llms-full.txt status 404.
Probed public URLs named in the evidence.
Recommended fix. Optionally publish /llms-full.txt for one-shot ingest.
n/a
Section llms.txt
bonus
0/1
Evidence. No /docs/llms.txt.
n/a
NLWeb schemamap
bonus
0/1
Evidence. No schemamap (N/A unless you offer NL search).
pass
Trust pages
Recommended
2/2
Evidence. Trust links found.
n/a
Speakable markup
bonus
0/1
Evidence. No SpeakableSpecification (N/A unless voice content).
n/a
humans.txt
bonus
0/1
Evidence. No /humans.txt (optional).
pass
security.txt
Recommended
1/1
Evidence. RFC 9116 security.txt with Contact.
failed
RSS or Atom feed
0/1
Evidence. No RSS/Atom link.
Recommended fix. Expose an RSS or Atom feed for machine subscribers.
pass
RSS or Atom document
bonus
1/1
Evidence. Fetched a feed document.
Probed public URLs named in the evidence.
n/a
Agent instruction / when-to-use
Required
0/3
Evidence. No llms.txt or agent.txt to grade.
n/a
Organization schema completeness
Recommended
0/2
Evidence. No Organization JSON-LD to score completeness.
n/a
Schema type breadth
Recommended
0/2
Evidence. No JSON-LD to score type breadth.
pass
Content without JavaScript
Required
3/3
Evidence. Raw HTML has H1 and 319527 visible characters without JavaScript.
4. Can an agent integrate with you? 76/100
Whether there is a documented machine door into the product.
pass
OpenAPI / Swagger link
2/2
Evidence. Homepage links mention OpenAPI or Swagger.
Probed homepage + OpenAPI.
pass
Login or docs link
3/3
Evidence. Login or developer docs link found.
pass
MCP well-known card
2/2
Evidence. MCP server card found under .well-known.
Probed well-known paths.
pass
MCP SSE / HTTP hint
1/1
Evidence. Page mentions MCP or SSE transport.
n/a
openapi.json fetchable
0/0
Evidence. OpenAPI linked but not fetchable at common or discovered paths.
Probed OpenAPI.
pass
Webhook or API docs
2/2
Evidence. Webhook or API docs mention found.
n/a
Agent skills index
0/2
Evidence. No agent-skills index (N/A unless you publish skills).
partial
OpenAPI document
Required
1/7
Evidence. OpenAPI probe.
Probed OpenAPI.
Recommended fix. Publish an OpenAPI document at a stable URL. Verify: curl -sI https://1password.com/openapi.json
pass
Public API surface
Recommended
7/7
Evidence. Docs or API paths look callable.
pass
Developer portal
Recommended
6/6
Evidence. Developer hub found.
partial
MCP server
Recommended
2/6
Evidence. MCP mentioned without a documented initialize.
Recommended fix. Publish an MCP card or document the MCP URL in llms.txt, then answer initialize.
pass
MCP server card
Recommended
2/2
Evidence. MCP card JSON found.
n/a
Agent Skills files
bonus
0/2
Evidence. No SKILL.md surface (N/A).
pass
CLI tool
Recommended
3/3
Evidence. CLI mention found.
n/a
GraphQL GET hint
bonus
0/2
Evidence. No GraphQL surface (N/A).
n/a
OpenAPI UI page
bonus
0/1
Evidence. No swagger-ui/redoc page.
n/a
OpenAPI (legacy slot)
0/0
Evidence. Linked but not fetched.
Probed public URLs named in the evidence.
5. Is your integration well-built? 40/100
Whether the integration surface is complete enough to call with confidence.
failed
MCP initialize
Required
0/3
Evidence. No MCP card to initialize
Recommended fix. Expose Streamable HTTP MCP and answer initialize.
pass
MCP server card
Recommended
2/2
Evidence. MCP card JSON found.
n/a
REST typed error model
Recommended
0/1
Evidence. No OpenAPI document to analyze.
Probed OpenAPI.
n/a
REST versioning / deprecation policy
Recommended
0/1
Evidence. No OpenAPI document to analyze.
Probed OpenAPI.
n/a
REST pagination pattern
Recommended
0/1
Evidence. No OpenAPI document to analyze.
Probed OpenAPI.
n/a
REST async-job pattern
Recommended
0/1
Evidence. No OpenAPI document to analyze.
Probed OpenAPI.
n/a
REST response schema coverage
Recommended
0/1
Evidence. No OpenAPI document to analyze.
Probed OpenAPI.
n/a
Function calling compatibility
Recommended
0/1
Evidence. No OpenAPI document to analyze.
Probed OpenAPI.
n/a
REST batch / bulk endpoint
bonus
0/1
Evidence. No OpenAPI document to analyze.
Probed OpenAPI.
n/a
MCP tool listing
bonus
0/3
Evidence. No public tools/list.
n/a
MCP tool descriptions
bonus
0/3
Evidence. No public tools/list.
n/a
MCP parameter schemas
bonus
0/2
Evidence. No public tools/list.
n/a
MCP tool naming
bonus
0/2
Evidence. No public tools/list.
n/a
MCP tool annotations
bonus
0/2
Evidence. No public tools/list.
n/a
MCP resources exposed
Recommended
0/3
Evidence. No public MCP initialize.
6. Can an agent use you reliably in production? 62/100
Whether errors, idempotency, and limits are visible before a call fails.
pass
Rate limit signal
Recommended
2/2
Evidence. Rate-limit or retry signal found.
partial
Idempotency signal
Recommended
1/3
Evidence. API surface without idempotency notes.
Recommended fix. Document idempotency keys for mutating calls.
partial
Machine-readable errors
Recommended
1/4
Evidence. API surface without a JSON error shape.
Recommended fix. Return a JSON or problem+json error body.
pass
Honest 404
Recommended
2/2
Evidence. Unknown path returned HTTP 404.
pass
Sandbox / test environment
bonus
2/2
Evidence. Docs mention a sandbox or test key.
n/a
Agent onboarding friction
Recommended
0/2
Evidence. No OpenAPI spec; onboarding stays N/A (no live signup probe).
Probed OpenAPI.
n/a
MCP error handling
bonus
0/2
Evidence. No public tools/call surface.
7. Can an agent authenticate to you? 33/100
Whether an agent can obtain access without a human in the loop.
failed
OAuth / OIDC well-known
0/2
Evidence. No oauth-authorization-server or openid-configuration.
Recommended fix. Publish /.well-known/openid-configuration or oauth-authorization-server if you authenticate agents.
n/a
OAuth 2.0 surface
Required
0/5
Evidence. No delegated-access surface (N/A).
n/a
OAuth AS metadata
Required
0/3
Evidence. No AS metadata (N/A unless you run an AS).
n/a
PKCE S256
Required
0/2
Evidence. No OAuth metadata to evaluate PKCE.
n/a
OAuth protected resource
Recommended
0/2
Evidence. No OAuth resource metadata (N/A).
n/a
Scoped permissions
Recommended
0/5
Evidence. No named OAuth scopes.
n/a
Scoped permissions
Recommended
0/2
Evidence. No OpenAPI document to analyze.
Probed OpenAPI.
n/a
auth.md
bonus
0/2
Evidence. No /auth.md (optional).
n/a
auth.md structure
bonus
0/2
Evidence. No /auth.md to grade.
pass
change-password well-known
bonus
1/1
Evidence. change-password HTTP 200.
n/a
MCP auth mechanism
bonus
0/2
Evidence. No discovered MCP endpoint to grade auth.
n/a
Agent auth WWW-Authenticate hint
bonus
0/1
Evidence. No documented API path to probe for WWW-Authenticate.
8. Can an agent transact with you? 100/100
Whether an agent can price, pay, or check out on a documented rail.
n/a
x402 payment
bonus
0/0
Evidence. No cart/SKU/checkout and no live payment rail (Pay N/A).
n/a
Agentic checkout (ACP)
bonus
0/0
Evidence. No cart/SKU/checkout and no live payment rail (Pay N/A).
n/a
ACP delegated payment
bonus
0/0
Evidence. No cart/SKU/checkout and no live payment rail (Pay N/A).
n/a
Universal Commerce Protocol
bonus
0/0
Evidence. No cart/SKU/checkout and no live payment rail (Pay N/A).
n/a
Machine Payments Protocol
bonus
0/0
Evidence. No cart/SKU/checkout and no live payment rail (Pay N/A).
n/a
AP2 - Agent Payments Protocol
bonus
0/0
Evidence. No cart/SKU/checkout and no live payment rail (Pay N/A).
pass
Pricing page
Recommended
3/3
Evidence. Fetched /pricing.
Probed public URLs named in the evidence.
n/a
pricing.md
bonus
0/2
Evidence. No /pricing.md (optional).
9. Can a user act through an agent? 50/100
Whether a person can finish a job through an agent-facing UI.
n/a
MCP Apps UI hint
bonus
0/1
Evidence. No MCP Apps hint (N/A unless you return UI).
n/a
A2A agent card
Required
0/2
Evidence. No agent-card.json (N/A unless A2A).
partial
Web app manifest
bonus
0.5/1
Evidence. manifest link without a fetchable file.
Recommended fix. Host /manifest.webmanifest if the site is installable.
n/a
Listed on skills.sh
bonus
0/1
Evidence. No official skills.sh org for this brand; community listings are N/A.
10. Can an agent operate your website directly? 40/100
Whether an agent can read and operate the site itself when there is no API or MCP.
n/a
Markdown negotiation
bonus
0/1
Evidence. No markdown twin advertised (N/A).
n/a
/index.md fallback
bonus
0/1
Evidence. No /index.md twin (N/A).
n/a
WebMCP page tools
bonus
0/1
Evidence. No in-page WebMCP (N/A).
n/a
NLWeb /ask
bonus
0/1
Evidence. No NLWeb /ask (N/A).
pass
Agent mode view
bonus
1/1
Evidence. mode=agent responded.
Probed public URLs named in the evidence.
n/a
NodeInfo
bonus
0/1
Evidence. No nodeinfo (N/A).
n/a
oEmbed discovery
bonus
0/1
Evidence. No oEmbed (N/A unless embeddable).
n/a
Markdown alternate link
bonus
0/1
Evidence. No rel=alternate type=text/markdown.
n/a
Markdown frontmatter metadata
bonus
0/1
Evidence. No served markdown to check frontmatter.
n/a
Markdown content negotiation (acceptmarkdown.com)
bonus
0/1
Evidence. Homepage does not negotiate markdown.
Probed homepage.
failed
Agent-UA markdown docs
bonus
0/1
Evidence. Docs host did not serve markdown to GPTBot (HTTP 200, text/html; charset=utf-8).
Recommended fix. Serve text/markdown to GPTBot (and similar agent UAs) on your docs host.
partial
Accessible document structure
bonus
1/3
Evidence. Landmarks partial (main=true nav=true h1=true skip=true).
Recommended fix. Give the homepage a main region, nav, H1, and a heading order that does not skip levels.
n/a
Code fence validity
bonus
0/1
Evidence. No markdown body to check fences.
n/a
llms.txt links resolve
Recommended
0/2
Evidence. No llms.txt to sample.
About this snapshot & how to cite it
Public technical signals observed by Waymark. A score describes this snapshot; it does not guarantee that an agent will complete a task. Private and authenticated workflows are outside this scan.
Snapshot: . Cite the domain, score, scan time, and report URL. This URL serves the latest completed snapshot and can change after a rescan.
Share this snapshot
Also on the Board
- ora.ai90.9/100 · AScan them →
- superset.sh90.7/100 · AScan them →
- waymark.genedai.me87.2/100 · AScan them →
Email me if this score changes
Join the monitoring waitlist. Monitoring is not active yet. This saves your interest; it does not schedule scans or send change alerts.
Email this report
Send the current snapshot and a link. One email. Not a list.