bombas.com
Verdict
Not yet tested by agents
- Blocked
- at
/by Unknown for our scanner - Verified
- 3 Oct 2026
No agent runs on record yet. Agent runs are scheduled for stores and booking sites; the static checks below are already in.
Agent runs
The last few runs, newest first. Agents stop at the payment step and buy nothing. Tiers: T1 real agent, T2 self-hosted, T3 emulated, T4 protocol. What the tiers mean
No agent runs on record.
Static checks
What an agent can read and reach before it starts shopping, from our scan on 3 Oct 2026. Our scanner was blocked on the home page by Unknown, so some checks could not run.
Access
- Not met
Home page reachable
Home page: HTTP 429
How to fix: Serve the home page with a 2xx response to automated HTTPS clients.
- Not met
Agents not blocked
Blocked by unknown: HTTP 429
How to fix: Allow signed AI agents past the challenge, or publish a Storefront API/MCP path agents can use instead.
- Not met
robots.txt present
robots.txt: HTTP 429
How to fix: Publish a plain-text /robots.txt that states which crawlers and agents may access the site.
- Met
AI agents allowed in robots.txt
No robots.txt rules apply
- Partly met
Content signals declared
No Content-Signal line in robots.txt
How to fix: Add a Content-Signal line to robots.txt stating whether content may be used for search, AI input and AI training.
Discovery
- Not met
Sitemap present
/sitemap.xml: HTTP 429; none listed in robots.txt
How to fix: Publish an XML sitemap at /sitemap.xml and reference it from robots.txt.
- Not met
llms.txt present
/llms.txt: HTTP 429
How to fix: Publish /llms.txt as markdown starting with "# <site name>" and linking your key pages.
- Not met
Link headers for agents
No Link header on the home page
How to fix: Add a Link header on the home page with rel="api-catalog" pointing to /.well-known/api-catalog.
- Not met
API catalog
/.well-known/api-catalog: HTTP 429
How to fix: Publish an RFC 9727 linkset at /.well-known/api-catalog listing your public APIs.
- Not met
MCP server card
/.well-known/mcp/server-card.json: HTTP 429
How to fix: Publish an MCP server card at /.well-known/mcp/server-card.json describing your MCP endpoint.
- Not met
A2A agent card
/.well-known/agent-card.json: HTTP 429
How to fix: Publish an A2A agent card at /.well-known/agent-card.json if you run an agent other agents can call.
- Not met
Agent skills index
/.well-known/agent-skills/index.json: HTTP 429
How to fix: Publish an agent skills index at /.well-known/agent-skills/index.json listing tasks agents can perform.
- Not met
OAuth server metadata
/.well-known/oauth-authorization-server: HTTP 429
How to fix: Publish RFC 8414 metadata at /.well-known/oauth-authorization-server so agents can obtain delegated access.
- Not met
OAuth protected resource metadata
/.well-known/oauth-protected-resource: HTTP 429
How to fix: Publish RFC 9728 metadata at /.well-known/oauth-protected-resource naming the authorization server for your APIs.
- Not met
auth.md
/auth.md: HTTP 429
How to fix: Publish /auth.md explaining in plain text how agents authenticate to your site or API.
Content
- Not applicable
Markdown on request
Home page not retrieved
- Not applicable
Content in server HTML
Home page not retrieved
Commerce data
- Not applicable
Product structured data
Not a commerce site
- Not applicable
Offer details complete
Not a commerce site
- Not applicable
UCP manifest
Not a commerce site
- Not applicable
Shopify Storefront MCP
Not a commerce site
- Not applicable
Shipping and returns policies linked
Not a commerce site
Next steps
Something changed?
Ask for a fresh scan. One re-test per site every 24 hours.
Get the full audit
Every agent tier including real consumer agents, a per-agent map of where they stop, and a fix plan.
Get the full auditIs this your site? Claim it
Use an email at bombas.com. Claimed owners can request re-tests, opt out of testing or stop our emails.