A drive, not a checklist.

1. 1Find: Can agents find you?What an agent finds on your domain: llms.txt, OpenAPI, an MCP server, a CLI or SDK (Agent-ready setup). Every product we drive is listed where agents look up software.
   What we check

   What an agent finds on your domain before it signs up: a docs page it can read, an OpenAPI description, llms.txt, an MCP server, a CLI or SDK. The product page lists what it found, as Agent-ready setup.

   llms.txtOpenAPIMCP serverCLISDKDocs an agent can read

   We don't measure whether an AI assistant recommends your product, or where it ranks you.

2. 2Learn: Can it learn it from your docs?The docs, read the way an agent reads them. In an Audit, every documented call checked against what the product does (Docs match).
   What we check

   Every drive of a product is measured against the same list: what its own docs say it does, the core features first.

   Checkpoint Docs: can an agent learn the product from what it publishes, without a person's help.

   The docs, read. Before the agent starts, we read the product's public docs, up to 600 pages, and judge them: a getting-started page, sign-in, errors, examples, how recent they are, and a page for each core feature. Then every documented way to do the core work is tried once. What the docs promise and doesn't work, and what works without docs, are counted.

   Surface audit. An Audit runs every documented API route, MCP tool and CLI command that is safe on its own test account, and checks each against the docs: does it work as documented, do the docs cover what an agent needs, and what exists but isn't documented. That gives the Docs match score. The product page shows the totals; the details stay private to the owner.

3. 3Sign up: Can it sign up on its own?The sign-up form or API, the bot check in front of it, and the email code.
   What we check

   Checkpoints Sign up and Verify. The agent tries every way in the product offers, the ones made for agents first: a sign-up call, an email code or form, Continue with GitHub or Google with its own accounts. It confirms with the code or link sent to its own address. The product page lists each way in and what happened.

   A bot check that stops our agent is a wall, and the result names the kind of check. The agent never solves a CAPTCHA; a step a person from our team clears counts as needing a human.

4. 4Get a key: Can it get a key without a person?A scoped API key made, used and revoked, and the first API, CLI or MCP call.
   What we check

   Checkpoints Key and First call. The agent makes an API key without a browser, uses it for a first call over the API, CLI or MCP, and revokes it at the end.

   An agent that signs up on its own and works the product in its browser gets in, even when only the API key needs a paid plan. The paid key then shows as where the API path stops.

5. 5Do the work: How much can it really do?Every core feature: create, read back, update, delete. A task counts only when the agent reads the result back. In a Drive, the crash test.
   What we check

   Core features first, the best headless way: MCP, then the official API, CLI or SDK. A task counts only when the agent reads the result back. Only documented routes count toward the level. Checkpoint First action is the first real thing it creates; Work done is the share of the core it did and read back.

   # create, then prove it exists
   POST /v1/contacts { "name": "Test Contact" }   → 201 id=ct_81
   GET  /v1/contacts/ct_81                    → 200 ✓ verified

   Crash test. Once in, the agent sends a few malformed requests, uses a wrong key of its own, retries a create as it would after a timeout, reads one endpoint until it meets the rate limit, and repeats each core feature to see that it holds. Each answer is graded: does the error say what to fix, is a retry safe, is the rate limit honest. Both go into the Holds up score.

6. 6Pay: Can it pay you on its own?x402, MPP, Stripe Projects, a billing API, the checkout. Paying counts only when our side proved a payment.
   What we check

   Checkpoint Pay. Agent-native payment (x402, the Machine Payments Protocol, Stripe Projects) first, then a billing API against a card on file, then a card checkout, which the agent walks up to the button that pays and stops. “Pays on its own” means an agent-native payment really happened: at most one dollar on the product's own endpoint, and we checked the transaction. A card checkout shows as a fact, never as paying on its own. Where the agent got to the last step before paying, it reads “Reaches the checkout”; a step we didn't try reads “Not tried yet”, with the reason. Only proven paying counts for L5.

   1. Not on its ownNo self-serve purchase
   2. Not on its ownPays only through a card checkout a person does
   3. Not on its ownOnly a card checkout, which an agent can finish once a person gives it a card
   4. Not on its ownA billing API that takes payment against a card on file, or an agent payment found but not made
   5. Pays on its own, once paidAgent-native payment, but only for part of the product, on a test network or with one human step
   6. Pays on its own, once paidPays through an agent-native rail (x402, MPP, Stripe Projects) on the vendor's own endpoint, no human
7. 7Cancel: Can it cancel without a person?Any plan or trial it started, cancelled the product's own way, with no charge after. Most drives start no plan.
   What we check

   Checkpoint Cancel. Any plan or trial the agent started, it cancels the product's own way, and a charge after the cancel counts against it. When it started nothing, because it used the free plan or paid per call, the product page says “Nothing to cancel”.

8. 8Leave: Can it delete its account?The account deleted, then checked that it is gone.
   What we check

   Checkpoint Delete. Last, on every drive, the agent deletes its account and its data. A delete passes only when access is refused afterwards. A delete behind a CAPTCHA, or one only support can do, is a wall.

Holds up

Reliability and the crash test: the core work done on every try, clear errors, safe retries, honest rate limits.

Docs match

The docs checked against live behaviour: documented operations that behave as the docs say, and how fully the docs describe them. Measured in an Audit. Whether the product speaks the current version of each standard (MCP, OpenAPI, A2A) shows next to it as a fact, never as points.

Agent-ready setup

What an agent finds to start with: llms.txt, OpenAPI, an MCP server, a CLI. Shown as found or not, never as a score.

Security is reported privately to the owner, with no score. A part we didn't measure says so, never 0. Rules of 15 Oct 2026.