Results for https://www.getbags.app/LEVEL5Scanned just now
100/100
Agent-Native
Discoverability
100
4 pass · 0 fail
Content Accessibility
100
1 pass · 0 fail
Bot Access Control
100
3 pass · 0 fail
Discovery
100
7 pass · 0 fail
Commerce
—
2 pass · 0 fail
04 / 04 pass
Discoverability
- Goal
- Publish a robots.txt so agents and crawlers can discover crawl policy for this origin.
- How to implement
- Create /robots.txt on this origin with at least one User-agent group and sensible Allow/Disallow rules. Serve it as text/plain.
- Resources
- fetchGET /robots.txt200
User-Agent: * Content-Signal: search=yes, ai-input=yes Allow: / Allow: /.well-known/ Disallow: /api/ Disallow: /dashboard/ Sitemap: https://www.getbags.app/sitemap.xml
- concluderobots.txt present with User-agent directive
{"contentType":"text/plain; charset=utf-8"}
- Goal
- Expose a valid XML sitemap so agents can enumerate important URLs.
- How to implement
- Add a valid XML sitemap and reference it with a Sitemap: line in robots.txt (or serve /sitemap.xml).
- Resources
- fetchGET /sitemap.xml200
<?xml version="1.0" encoding="UTF-8"?> <urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9"> <url> <loc>https://www.getbags.app</loc> <lastmod>2026-07-21T18:38:24.847Z</lastmod> <changefreq>weekly</changefreq> <priority>1</priority> </url> <url> <loc>https://www.getbags.app/get-started</loc> <lastmod>2026-07-21T18:38:24.847Z</lastmod> <changefreq>weekly</changefreq> <priority>0.8</priority> </url> <url> <loc>https://www.getbags.app/login</loc> <lastmod>2026-07-21T18:38:24.847Z</lastmod> <…
- parseValid XML sitemap structure detected
- concludeSitemap OK at https://www.getbags.app/sitemap.xml
{"url":"https://www.getbags.app/sitemap.xml"}
- Goal
- Advertise agent-useful Link relations on the homepage so discovery is machine-readable.
- How to implement
- Add RFC 8288 Link response headers on GET / for agent-useful relations such as api-catalog, describedby, service-desc, or service-doc.
- Resources
- fetchGET /200
- parseParsed 17 Link entries
- concludeFound agent-useful rels: api-catalog, describedby, describedby, describedby, describedby, describedby, describedby, describedby, describedby, describedby, describedby, service-desc, service-doc, describedby, describedby, status
{"links":[{"rel":"api-catalog","href":"/.well-known/api-catalog"},{"rel":"describedby","href":"/.well-known/agent-skills/index.json"},{"rel":"describedby","href":"/.well-known/mcp/server-card.json"},{"rel":"describedby","href":"/.well-known/agent-card.json"},{"rel":"describedby","href":"/.well-known/oauth-protected-resource"},{"rel":"describedby","href":"/.well-known/openid-configuration"},{"rel":"describedby","href":"/.well-known/oauth-authorization-server"},{"rel":"describedby","href":"/auth.md"},{"rel":"describedby","href":"/merchants.md"},{"rel":"describedby","href":"/.well-known/agents.md"},{"rel":"describedby","href":"/.well-known/http-message-signatures-directory"},{"rel":"service-desc","href":"https://www.getbags.app/api/openapi.json"},{"rel":"service-doc","href":"https://docs.getbags.app"},{"rel":"describedby","href":"https://www.getbags.app/llms.txt"},{"rel":"describedby","href":"https://www.getbags.app/llms-full.txt"},{"rel":"status","href":"https://www.getbags.app/api/health"}]}
- Goal
- Publish DNS-AID SVCB records under _agents so agents can find services via DNS.
- How to implement
- Publish DNSSEC-validated SVCB/HTTPS records for _index._agents, _mcp._agents, and/or _a2a._agents on the apex (and www if used).
- Resources
- dnsAD=true status=0 answers=2
- dnsAD=true status=0 answers=0
- dnsAD=true status=0 answers=0
- dnsAD=true status=0 answers=0
- dnsAD=true status=0 answers=0
- dnsAD=true status=0 answers=0
- dnsAD=true status=0 answers=2
- dnsAD=true status=0 answers=0
- dnsAD=true status=0 answers=0
- dnsAD=true status=0 answers=0
- dnsAD=true status=0 answers=0
- dnsAD=true status=0 answers=0
- dnsAD=true status=0 answers=0
- dnsAD=true status=0 answers=0
- dnsAD=true status=0 answers=0
- dnsAD=true status=0 answers=0
- dnsAD=true status=0 answers=0
- dnsAD=true status=0 answers=0
- concludeDNSSEC-validated ServiceMode record(s): _index._agents.getbags.app/SVCB, _mcp._agents.getbags.app/SVCB
{"hits":["_index._agents.getbags.app/SVCB","_mcp._agents.getbags.app/SVCB"]}
01 / 01 pass
Content Accessibility
- Goal
- Serve text/markdown when clients Accept: text/markdown so agents can read a clean page summary.
- How to implement
- When GET / is requested with Accept: text/markdown, respond with Content-Type including text/markdown (e.g. Cloudflare Markdown for Agents or an equivalent).
- Resources
- fetchGET /200
--- description: Sell API access to AI agents with x402 pay-per-call and USDC payment links — agents pay per request, no accounts or API keys. title: BAGS Agent | Agentic Commerce for AI Agents image: https://www.getbags.app/og.png --- # Agentic commerce for AI agents BAGS Agent lets API providers charge AI agents per request via x402: an agent calls your endpoint, pays automatically in USDC, and gets the response — no accounts, no API keys, no invoices. - [Get Started](https://www.getbags.ap…
- concludeContent-Type includes text/markdown
{"contentType":"text/markdown; charset=utf-8"}
03 / 03 pass
Bot Access Control
- Goal
- Declare AI crawler rules in robots.txt so bot access policy is explicit.
- How to implement
- Add explicit User-agent rules for known AI crawlers (GPTBot, ClaudeBot, PerplexityBot, etc.) or a clear User-agent: * policy in robots.txt.
- Resources
- parseParsed 1 user-agent group(s)
- concludeFound AI crawler rules or User-agent: * policy
- Goal
- Publish Content-Signal directives so AI training/search/input preferences are machine-readable.
- How to implement
- Add Content-Signal: lines in robots.txt with ai-train / search / ai-input directives stating your preferences for AI use of the site.
- Resources
- parseContent-Signal lines: 1
- concludeFound ai-train / search / ai-input directives
{"signals":["search=yes, ai-input=yes"]}
- Goal
- Publish an HTTP Message Signatures directory so bots can authenticate cryptographically.
- How to implement
- Serve a valid JWKS directory at /.well-known/http-message-signatures-directory for cryptographic bot authentication.
- Resources
- fetchGET /.well-known/http-message-signatures-directory200
{"keys":[{"kty":"OKP","crv":"Ed25519","x":"dhufEN25sKfi_aUdmOuyuj-g_AbtPnae7rwbmSD0DKU","kid":"bags-web-bot-auth-1","use":"sig","alg":"EdDSA"}]} - concludeValid JWKS / message-signatures directory
07 / 08 pass
Discovery
- Goal
- Publish an RFC 9727 API catalog so agents can discover your API surfaces.
- How to implement
- Serve /.well-known/api-catalog as application/linkset+json with a linkset array describing your API surfaces.
- Resources
- fetchGET /.well-known/api-catalog200
{"linkset":[{"anchor":"https://www.getbags.app/api/v1","service-desc":[{"href":"https://www.getbags.app/api/openapi.json","type":"application/json"}],"service-doc":[{"href":"https://docs.getbags.app","type":"text/html"}],"status":[{"href":"https://www.getbags.app/api/health"}],"x402":[{"href":"https://www.getbags.app/api/v1","type":"application/json"}],"x402-resource":[{"href":"https://www.getbags.app/api/agent/link/pl-{paymentLinkId}"}],"describedby":[{"href":"https://www.getbags.app/merchants.… - parselinkset length 1
- concludeValid linkset catalog
{"linksetCount":1}
- Goal
- Publish OAuth/OIDC discovery metadata so agents can authenticate with your APIs.
- How to implement
- Serve /.well-known/openid-configuration or /.well-known/oauth-authorization-server with issuer, authorization_endpoint, and token_endpoint.
- Resources
- fetchGET /.well-known/openid-configuration200
{"issuer":"https://www.getbags.app","authorization_endpoint":"https://dznfhyuvwrlpusdtotct.supabase.co/auth/v1/oauth/authorize","token_endpoint":"https://dznfhyuvwrlpusdtotct.supabase.co/auth/v1/oauth/token","userinfo_endpoint":"https://dznfhyuvwrlpusdtotct.supabase.co/auth/v1/oauth/userinfo","jwks_uri":"https://dznfhyuvwrlpusdtotct.supabase.co/auth/v1/.well-known/jwks.json","scopes_supported":["openid","profile","email","phone"],"response_types_supported":["code"],"response_modes_supported":["q… - parseissuer=https://www.getbags.app
- concludeValid discovery at /.well-known/openid-configuration
{"issuer":"https://www.getbags.app","authorization_endpoint":"https://dznfhyuvwrlpusdtotct.supabase.co/auth/v1/oauth/authorize","token_endpoint":"https://dznfhyuvwrlpusdtotct.supabase.co/auth/v1/oauth/token"}
- Goal
- Publish OAuth protected resource metadata so agents know which auth servers protect your API.
- How to implement
- Serve /.well-known/oauth-protected-resource with resource and authorization_servers, and advertise it via WWW-Authenticate where relevant.
- Resources
- fetchGET /.well-known/oauth-protected-resource200
{"resource":"https://www.getbags.app/api/v1","authorization_servers":["https://www.getbags.app","https://dznfhyuvwrlpusdtotct.supabase.co/auth/v1"],"scopes_supported":["bags:read","bags:write"],"bearer_methods_supported":["header"],"resource_documentation":"https://www.getbags.app/agent-markdown","resource_policy_uri":"https://www.getbags.app/merchant-agreement","resource_tos_uri":"https://www.getbags.app/merchant-agreement"} - parseresource=https://www.getbags.app/api/v1 servers=2
- concludeValid protected resource metadata
{"resource":"https://www.getbags.app/api/v1","authorization_servers":["https://www.getbags.app","https://dznfhyuvwrlpusdtotct.supabase.co/auth/v1"]}
- Goal
- Publish /auth.md so agents have human-readable registration and auth guidance.
- How to implement
- Serve /auth.md as text/markdown documenting how agents register/authenticate, discoverable via PRM and/or AS metadata agent_auth.
- Resources
- fetchGET /auth.md200
# BAGS auth.md > Agent registration and authentication guide for the BAGS Agent API > (https://www.getbags.app/api/v1). BAGS Agent lets merchants sell API calls to AI > agents via x402 payment links. ## Who this is for AI agents (and the developers operating them) that need authenticated access to the BAGS Agent API: payment links, products, and transactions. Anonymous, read-only surfaces do NOT require registration: - MCP server: `https://www.getbags.app/api/mcp/mcp` (streamable HTTP, no a…
- fetchGET /.well-known/oauth-protected-resource200
{"resource":"https://www.getbags.app/api/v1","authorization_servers":["https://www.getbags.app","https://dznfhyuvwrlpusdtotct.supabase.co/auth/v1"],"scopes_supported":["bags:read","bags:write"],"beare… - parseagent_auth block found in /.well-known/openid-configuration
- parseauthMd=true prm=true agent_auth=true registrationDocs=true
- concludeauth.md + discoverable PRM/agent_auth + registration guidance
{"prmOk":true,"agentAuth":true}
- Goal
- Publish an MCP server card and reachable Streamable HTTP endpoint so agents can list tools.
- How to implement
- Publish /.well-known/mcp/server-card.json (or mcp.json) with serverInfo.name, and expose a Streamable HTTP MCP endpoint that answers initialize + tools/list.
- Resources
- fetchGET /.well-known/mcp.json404
<!DOCTYPE html><html lang="en" class="__variable_246ccd __variable_35b0e9 __variable_afd4a3 __variable_6d24ac dark" style="color-scheme:dark"><head><meta charSet="utf-8"/><meta name="viewport" content="width=device-width, initial-scale=1"/><link rel="preload" href="/_next/static/media/22a5144ee8d83bca-s.p.woff2" as="font" crossorigin="" type="font/woff2"/><link rel="preload" href="/_next/static/media/45d0fdf0988e07ff-s.p.woff2" as="font" crossorigin="" type="font/woff2"/><link rel="preload" href…
- fetchGET /.well-known/mcp/server-cards.json404
<!DOCTYPE html><html lang="en" class="__variable_246ccd __variable_35b0e9 __variable_afd4a3 __variable_6d24ac dark" style="color-scheme:dark"><head><meta charSet="utf-8"/><meta name="viewport" content="width=device-width, initial-scale=1"/><link rel="preload" href="/_next/static/media/22a5144ee8d83bca-s.p.woff2" as="font" crossorigin="" type="font/woff2"/><link rel="preload" href="/_next/static/media/45d0fdf0988e07ff-s.p.woff2" as="font" crossorigin="" type="font/woff2"/><link rel="preload" href…
- fetchGET /.well-known/mcp/server-card.json200
{"name":"app.getbags.www","title":"BAGS","description":"BAGS is an Agentic Commerce platform: API providers charge AI agents per request, settlement handled. Tools here let agents preview payment links against the public BAGS API.","version":"0.1.0","websiteUrl":"https://www.getbags.app","repository":{"url":"https://github.com/getbagsapp/agentic-payments","source":"github"},"icons":[{"src":"https://www.getbags.app/baglogo.png","mimeType":"image/png"}],"supportedProtocolVersions":["2025-03-26"],"… - parseCard name=app.getbags.www
- fetchPOST /api/mcp/mcp200
event: message data: {"result":{"protocolVersion":"2025-11-25","capabilities":{"tools":{"listChanged":true}},"serverInfo":{"name":"bags-mcp","version":"0.1.0"}},"jsonrpc":"2.0","id":1} - fetchtools/list200
event: message data: {"result":{"tools":[{"name":"bags-preview-payment-link","title":"Preview BAGS payment link","description":"Fetch the public metadata for a BAGS payment link by id (uuid). Returns the display name, amount, currency, accepted networks, and merchant info. Use this to preview an agentic x402 endpoint before calling /api/agent/link/pl-{id}.","inputSchema":{"$schema":"http://json-schema.org/draft-07/schema#","type":"object","properties":{"id":{"type":"string","format":"uuid","patt… - concludeMCP card OK (name=app.getbags.www), deepProbe=true
{"name":"app.getbags.www","deepProbeOk":true,"endpoint":"https://www.getbags.app/api/mcp/mcp"}
- Goal
- Publish an A2A agent card so agents can discover your A2A interface.
- How to implement
- Serve /.well-known/agent-card.json with name, version, and supportedInterfaces per the A2A Agent Card spec.
- Resources
- concludeCheck disabled for this scan
- Goal
- Publish an agent-skills index so agents can find skill docs for this origin.
- How to implement
- Serve /.well-known/agent-skills/index.json (v0.2) listing skills agents can use against this origin.
- Resources
- fetchGET /.well-known/agent-skills/index.json200
{"$schema":"https://schemas.agentskills.io/discovery/0.2.0/schema.json","skills":[{"name":"bags-x402","type":"skill-md","description":"Charge AI agents for API calls with BAGS — create products and agentic x402 payment links, expose pay-per-call USDC endpoints, and read transactions.","url":"/.well-known/agent-skills/bags-x402/SKILL.md","digest":"sha256:3721116a7c836a5794aa4cf0b58478caaa2863bb8b560dcf17ea6bf9dcdc2d5d"}]} - parseskills array length 1
- concludeValid skills index at /.well-known/agent-skills/index.json
{"path":"/.well-known/agent-skills/index.json","count":1}
- Goal
- Register WebMCP tools on the homepage so headless scanners discover browser-side tools.
- How to implement
- On page load, register at least one WebMCP tool via navigator.modelContext (provideContext/registerTool) so headless scanners can discover it.
- Resources
- fetchLaunching Browser Rendering session for WebMCP inspection
- parseCaptured 1 WebMCP tool registration(s)
- concludePass: found 1 tool(s) on navigator.modelContext
{"tools":[{"source":"provideContext","name":"bags-preview-payment-link"}]}
02 / 05 pass
Commerce
- Goal
- Advertise x402 payment challenges on payable API routes so agents can pay per request.
- How to implement
- Return HTTP 402 with a valid x402 payment challenge (PAYMENT-REQUIRED / payment required body) on payable API routes such as /api/v1.
- Resources
- concludeCoinbase Bazaar discovery not queried (skipped in v1 scanner)
- fetchGET /200
<!DOCTYPE html><html lang="en" class="__variable_246ccd __variable_35b0e9 __variable_afd4a3 __variable_6d24ac dark" style="color-scheme:dark"><head><meta charSet="utf-8"/><meta name="viewport" content="width=device-width, initial-scale=1"/><link rel="preload" href="/_next/static/media/22a5144ee8d83bca-s.p.woff2" as="font" crossorigin="" type="font/woff2"/><link rel="preload" href="/_next/static/media/45d0fdf0988e07ff-s.p.woff2" as="font" crossorigin="" type="font/woff2"/><link rel="preload" href…
- fetchGET /api404
<!DOCTYPE html><html lang="en" class="__variable_246ccd __variable_35b0e9 __variable_afd4a3 __variable_6d24ac dark" style="color-scheme:dark"><head><meta charSet="utf-8"/><meta name="viewport" content="width=device-width, initial-scale=1"/><link rel="preload" href="/_next/static/media/22a5144ee8d83bca-s.p.woff2" as="font" crossorigin="" type="font/woff2"/><link rel="preload" href="/_next/static/media/45d0fdf0988e07ff-s.p.woff2" as="font" crossorigin="" type="font/woff2"/><link rel="preload" href…
- fetchGET /api/v1402
{"x402Version":1,"error":"X-PAYMENT header is required","discovery":true,"accepts":[{"scheme":"exact","network":"base","maxAmountRequired":"10000","resource":"https://www.getbags.app/api/v1","description":"BAGS Agent API index — machine-readable directory of the agentic payment API, MCP server, and x402 payment surface.","mimeType":"application/json","payTo":"0x374cFb844a5C702d637d72a5387fD9EF6B82108C","maxTimeoutSeconds":300,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","extra":{"name":"… - concludeValid x402 challenge at /api/v1
{"path":"/api/v1"}
- Goal
- Declare Machine Payments Protocol extensions in OpenAPI so payable ops are discoverable.
- How to implement
- Serve /openapi.json with x-payment-info extensions describing payable operations.
- Resources
- fetchGET /openapi.json200
{ "openapi": "3.1.0", "info": { "title": "BAGS Agent API", "version": "v1", "description": "BAGS Agent is an agentic-payments API for x402 payment links, products, and transaction reads.\n\n## Authentication\n\nPublic API endpoints accept either:\n\n- **API key** in the `Authorization: Bearer <key>` header. Keys are prefixed\n `bag_live_…` and generated from the dashboard. Never expose secret keys\n in client code.\n- **Key scope** — standalone agentic merchants use live keys f… - parsex-payment-info present=true
- concludeMPP extensions found
- Goal
- Publish Universal Commerce Protocol metadata for agent commerce discovery.
- How to implement
- Serve /.well-known/ucp with protocol_version and services.
- Resources
- fetchGET /.well-known/ucp404
<!DOCTYPE html><html lang="en" class="__variable_246ccd __variable_35b0e9 __variable_afd4a3 __variable_6d24ac dark" style="color-scheme:dark"><head><meta charSet="utf-8"/><meta name="viewport" content="width=device-width, initial-scale=1"/><link rel="preload" href="/_next/static/media/22a5144ee8d83bca-s.p.woff2" as="font" crossorigin="" type="font/woff2"/><link rel="preload" href="/_next/static/media/45d0fdf0988e07ff-s.p.woff2" as="font" crossorigin="" type="font/woff2"/><link rel="preload" href…
- concludeHTTP 404
- Goal
- Publish Agentic Commerce Protocol metadata for agent commerce discovery.
- How to implement
- Serve /.well-known/acp.json with protocol name/version, api_base_url, transports, and capabilities.
- Resources
- fetchGET /.well-known/acp.json404
<!DOCTYPE html><html lang="en" class="__variable_246ccd __variable_35b0e9 __variable_afd4a3 __variable_6d24ac dark" style="color-scheme:dark"><head><meta charSet="utf-8"/><meta name="viewport" content="width=device-width, initial-scale=1"/><link rel="preload" href="/_next/static/media/22a5144ee8d83bca-s.p.woff2" as="font" crossorigin="" type="font/woff2"/><link rel="preload" href="/_next/static/media/45d0fdf0988e07ff-s.p.woff2" as="font" crossorigin="" type="font/woff2"/><link rel="preload" href…
- concludeHTTP 404
- Goal
- Advertise AP2 extensions on the A2A agent card for agent payment flows.
- How to implement
- Extend /.well-known/agent-card.json with an AP2 extension that declares a role.
- Resources
- concludeCheck disabled for this scan
Max level
You’re at Level 5 — Agent-Native.