kapiva.in
Audited 6 days ago· bigcommerce
Agent-readiness across all five AI commerce surfaces.
Surfaces — click to filter
9 failing · 10 not checked · 19 shown
10 checks couldn't run on this store — each is listed below with the reason. Your score reflects only what we could verify.
Enforce HTTPS sitewide and ship a Strict-Transport-Security header with max-age ≥ 6 months
Why this matters: AI agents and payment flows refuse plain HTTP; weak HSTS is treated as effectively no HSTS by trust-and-safety scanners.
Findings (1)
Confirmed the homepage is HTTPS (status 200), probed http://kapiva.in/ for redirect behaviour, and parsed the Strict-Transport-Security header (absent).
How: URL scheme + homepage status check, an http://host/ redirect probe through politeFetch, and a Strict-Transport-Security max-age parse (RFC 6797; ≥ 180-day threshold).
- No Strict-Transport-Security header on the homepage responseCRITICAL
Add
Strict-Transport-Security: max-age=31536000; includeSubDomainsto every HTTPS response.
Add every required top-level key to the UCP profile
Why this matters: A profile missing one of the four required keys is treated as non-conformant — agent runtimes fall back to default behaviour and may skip the merchant.
Findings (1)
Profile is missing required key(s): signing_keys.
How: Read the profile root (or top-level ucp wrapper) and verify the presence of version, services, capabilities, and signing_keys keys.
- Required top-level key
signing_keysis missingHIGHWhat we expected
Add a top-level "signing_keys" field to the JSON document (empty array/object is fine).Set
signing_keysat the root of the JSON document.
Populate the conditional fields required by each service's transport
Why this matters: A service declared with the right transport but missing endpoint/schema is unreachable — agents can't negotiate or connect.
Findings (1)
Validated 1 services with recognised transports (0 satisfy their transport's required fields).
How: For each services[] entry with a recognised transport, require the transport-conditional fields: rest/mcp → endpoint+schema; a2a → endpoint; embedded → schema.
Coverage
0/1 · 0%
- Service is missing transport-conditional field(s)HIGH
/.well-known/ucpnamespace=dev.ucp.shopping; transport=rest
What we found
missing: schemaWhat we expected
`endpoint` + `schema`Add schema to this services[] entry.
Skipped — Profile declares no signing_keys; JWK validation has no entries to evaluate.
Context: Malformed JWK entries are rejected silently by agents — signed payloads cannot be verified and the merchant loses trust signal.
Why this was skipped
Profile declares no signing_keys; JWK validation has no entries to evaluate.
How: Walk signing_keys[] and validate each entry per RFC 7517 §4.1 (kty required) + RFC 7518 §6 (kty-specific required parameters). kid is OPTIONAL per RFC 7517 §4.5 and not enforced here.
Add an Organization (or OnlineStore) JSON-LD block to your homepage with a contactPoint
Why this matters: Organization markup with a contactPoint tells AI agents who you are and how a shopper can reach you for support.
Findings (1)
Parsed the homepage JSON-LD looking for an Organization/OnlineStore node with a contactPoint, but no Organization-class node is present.
How: Parse homepage <script type="application/ld+json"> blocks, flatten @graph, and look for an Organization/OnlineStore/Store node with a contactPoint carrying email or telephone.
- No Organization/OnlineStore JSON-LD on homepageMEDIUM
What we expected
<script type="application/ld+json">{"@context":"https://schema.org","@type":"OnlineStore","name":"Example Store","url":"https://example.com","contactPoint":[{"@type":"ContactPoint","contactType":"customer service","email":"support@example.com"}]}</script>Add an Organization (or OnlineStore) JSON-LD block in the homepage
<head>with a contactPoint.
Install a third-party review platform so agents see syndicated reviews on your storefront
Why this matters: Third-party review widgets feed the ratings AI agents trust when ranking merchants.
Findings (1)
Scanned the homepage and 20 sampled PDPs for 8 review-platform asset fingerprints; none matched.
How: Substring scan of homepage and sampled PDP HTML for known review-platform asset fingerprints (judge.me, yotpo, stamped.io, reviews.io, okendo, loox, trustpilot, bazaarvoice).
- No third-party review-platform integration detectedMEDIUM
none of 8 fingerprints matched across 21 sources
Install a Judge.me / Yotpo / Loox / Okendo / Stamped / Reviews.io / Trustpilot / Bazaarvoice widget on your storefront.
Skipped — HSTS itself is not enabled
Context: Without includeSubDomains, an HTTP subdomain (staging, mail, …) can be used to attack the apex's cookies.
Why this was skipped
Looked for includeSubDomains in the Strict-Transport-Security header, but HSTS itself is not enabled.
How: Parse the homepage Strict-Transport-Security header for the includeSubDomains directive (RFC 6797 §6.1.2).
- HSTS not enabled; check
https-and-hsts-enforcedfirst.MEDIUMFix
https-and-hsts-enforcedfirst — once HSTS ships, re-run this check.
Skipped — No MerchantReturnPolicy node carried a `merchantReturnLink` URL, so reachability has nothing to evaluate.
Context: A broken return-link makes Option B policies invisible — agents can't render or follow the link.
Why this was skipped
No MerchantReturnPolicy node carried a merchantReturnLink URL, so reachability has nothing to evaluate.
How: Collect every unique merchantReturnLink URL across all MerchantReturnPolicy nodes; probe each once via politeFetch (failSoft). 2xx counts as reachable.
Skipped — No OfferShippingDetails node carried `shippingRate`, so the MonetaryAmount check has nothing to evaluate.
Context: An invalid rate object is silently dropped; agents can't quote your shipping cost in shopping cards.
Why this was skipped
No OfferShippingDetails node carried shippingRate, so the MonetaryAmount check has nothing to evaluate.
How: On each OfferShippingDetails node where shippingRate is set, require an object with numeric value/maxValue (typed or numeric string) and a 3-letter ISO 4217 currency.
Skipped — Profile declares no capabilities; required-field checks have nothing to evaluate.
Context: Capabilities missing version/spec/schema can't be matched against agent support tables — agents skip them silently.
Why this was skipped
Profile declares no capabilities; required-field checks have nothing to evaluate.
How: For each capabilities[] entry, require non-empty string values for version, spec, and schema.
Skipped — No services declared a `spec` URL; origin matching has nothing to evaluate.
Context: A spec URL on an unrelated authority signals the service was copy-pasted from stale documentation — agents can't trust the conformance claim.
Why this was skipped
No services declared a spec URL; origin matching has nothing to evaluate.
How: For each service with a spec URL, require the URL origin to be a canonical UCP authority OR the host/path to include the namespace token.
Add descriptive alt text to product images (WCAG 2.x SC 1.1.1)
Why this matters: Alt text is the only text description AI agents and screen readers have for your product imagery.
Findings (11)
Parsed <img> alt attributes across 20 sampled product pages (0 have alt text on at least 80% of images).
How: Per PDP, count <img> tags via regex; a tag 'has alt text' when its alt attribute is present AND non-empty after trim. A PDP passes when it carries no <img> at all OR ≥80% of its <img> tags have non-empty alt.
Coverage
0/20 · 0%
- Most images on this product page lack alt textLOW× 10
What we expected
<img src="/img/sneaker.webp" alt="Red leather running shoe, side view" />Populate the alt attribute on each <img> with a description of what the image shows; use alt="" only for decorative images.
Affected (10)
- /detox/kapiva-noni-juice-1l17/42 <img> tags have non-empty alt (40%)
- /detox/kapiva-wheat-grass-juice-1-l37/68 <img> tags have non-empty alt (54%)
- /daily-diet/kapiva-vegan-protein-chocolate-1-kg28/57 <img> tags have non-empty alt (49%)
- /weight-loss/kapiva-get-slim-juice-1-l67/117 <img> tags have non-empty alt (57%)
- /weight-loss/kapiva-slimfit-combo-1-049/83 <img> tags have non-empty alt (59%)
- /diabetes-care/kapiva-neem-juice-1-l19/44 <img> tags have non-empty alt (43%)
- /diabetes-care/kapiva-karela-jamun-juice-1-l40/71 <img> tags have non-empty alt (56%)
- /skin-hair/kapiva-aloe-vera-juice-1-l41/72 <img> tags have non-empty alt (57%)
- /kapiva-dia-free-juice-1-l34/66 <img> tags have non-empty alt (52%)
- /skin-hair/kapiva-aloe-vera-skin-gel-500gms37/68 <img> tags have non-empty alt (54%)
…and 1 more
Add a BreadcrumbList JSON-LD block to every PDP
Why this matters: Breadcrumbs help agents understand where a product sits in your catalog.
Findings (11)
Searched JSON-LD on 20 sampled product pages for a BreadcrumbList (0 found, 0%).
How: Search every JSON-LD block on each PDP for @type: BreadcrumbList with a non-empty itemListElement.
Coverage
0/20 · 0%
- No BreadcrumbList JSON-LD with a populated itemListElementLOW× 10
Add a BreadcrumbList JSON-LD block walking Home → Category → Product.
Affected (10)
- /detox/kapiva-noni-juice-1l
- /detox/kapiva-wheat-grass-juice-1-l
- /daily-diet/kapiva-vegan-protein-chocolate-1-kg
- /weight-loss/kapiva-get-slim-juice-1-l
- /weight-loss/kapiva-slimfit-combo-1-0
- /diabetes-care/kapiva-neem-juice-1-l
- /diabetes-care/kapiva-karela-jamun-juice-1-l
- /skin-hair/kapiva-aloe-vera-juice-1-l
- /kapiva-dia-free-juice-1-l
- /skin-hair/kapiva-aloe-vera-skin-gel-500gms
…and 1 more
Skipped — HSTS itself is not enabled
Context: HSTS preload-list inclusion is the strongest downgrade protection available — first-time visits are protected too.
Why this was skipped
Looked for the preload directive in the Strict-Transport-Security header, but HSTS itself is not enabled.
How: Parse the homepage Strict-Transport-Security header for the preload directive (hstspreload.org vendor extension to RFC 6797).
- HSTS not enabled; check
https-and-hsts-enforcedfirst.LOWFix
https-and-hsts-enforcedfirst — once HSTS ships, re-run this check.
Skipped — No OfferShippingDetails node carried `deliveryTime`, so the ShippingDeliveryTime check has nothing to evaluate.
Context: Without populated handling/transit times, agents can't quote a delivery window in shopping cards.
Why this was skipped
No OfferShippingDetails node carried deliveryTime, so the ShippingDeliveryTime check has nothing to evaluate.
How: On each OfferShippingDetails node where deliveryTime is set, require an object with at least one of handlingTime / transitTime populated as a QuantitativeValue.
Skipped — Walked services[] for `transport: "mcp"` entries; none advertised.
Context: If you advertise MCP transport, agents will try to connect — broken or non-HTTPS endpoints fail silently and lose the integration.
Why this was skipped
Walked services[] for transport: "mcp" entries; none advertised.
How: Filter services[] to entries where transport=mcp and validate that endpoint is an absolute https:// URL.
Enable Apple Pay through your payment processor (informational only)
Why this matters: Apple Pay is a checkout-quality signal for human shoppers — informational only, does not affect the agent-readiness score.
Findings (1)
Scanned the homepage and 20 sampled PDPs for Apple Pay markers; none matched.
How: Substring match on known Apple Pay SDK/markup signatures (ApplePaySession, apple-pay-button, /apple-developer-merchantid-domain-association) across the homepage and every sampled PDP HTML.
- No Apple Pay markers detected on the homepage or PDPsINFO
Enable Apple Pay in your payment processor's dashboard (Stripe / Adyen / Braintree). Informational only — does not affect the score.
Enable Google Pay through your payment processor (informational only)
Why this matters: Google Pay is a checkout-quality signal for human shoppers — informational only, does not affect the agent-readiness score.
Findings (1)
Scanned the homepage and 20 sampled PDPs for Google Pay markers; none matched.
How: Substring match on known Google Pay SDK/markup signatures (pay.google.com/gp/p/js/pay.js, google.payments.api, <google-pay-button) across the homepage and every sampled PDP HTML.
- No Google Pay markers detected on the homepage or PDPsINFO
Enable Google Pay in your payment processor's dashboard (Stripe / Adyen / Braintree). Informational only — does not affect the score.
Skipped — Looked for /llms.txt at the site root; the fetcher returned no file.
Context: An /llms.txt manifest points agents at your feed and key pages without them having to guess.
Why this was skipped
Looked for /llms.txt at the site root; the fetcher returned no file.
How: Check whether the fetcher reached an /llms.txt at the site root. Informational only — no failure path per llmstxt.org being a voluntary community convention.