# Scalekit - Agent Payment Report

- Domain: scalekit.com
- Category: Auth & Identity
- Company type: machine api
- Payment systems found: None detected
- Agent interfaces found: None detected
- Payer platforms or methods: None detected
- Vendor roles: None cataloged
- Strongest evidence: **Not evaluated**
- Score version: `agent-payments-v4`
- Last scanned: 2026-08-20T19:00:24.390206+00:00

## Payment documentation

- No payment protocols documented.

## Scores

| Dimension | Score |
|-----------|-------|
| Payment readiness | 0 |
| Agent access | 21 |
| Overall readiness | 6 |

An em dash means there is not enough evidence to calculate that dimension. A public support claim is not treated as a completed payment.

## Payment Checks

Each section shows what was found, what still needs work, and the strongest available evidence. Not-applicable systems do not reduce the score.

### x402 payments

- Company signal: Not detected

#### Is at least one accepted payment option complete enough for a payer to execute?

- Status: Needs fix
- Result: The x402 challenge is missing a complete accepted payment option or paid-resource binding.
- Why it matters: Agents may not be able to discover, understand, or safely attempt this payment path from static public evidence.
- How to fix: Include scheme, network, asset, positive amount, recipient/payTo, and resource binding for at least one accepted option.

#### Is the payment challenge protected from stale public caching?

- Status: Needs fix
- Importance: Recommended
- Result: No x402 challenge was detected.
- Why it matters: Agents may not be able to discover, understand, or safely attempt this payment path from static public evidence.
- How to fix: Return Cache-Control: no-store on unpaid x402 challenge responses.

#### Is there a concrete paid endpoint or tool the agent can discover?

- Status: Needs fix
- Result: A URL, OpenAPI operation, or protocol mention is not enough to prove a concrete payable x402 resource.
- Why it matters: Agents may not be able to discover, understand, or safely attempt this payment path from static public evidence.
- How to fix: Publish a concrete paid endpoint with method, price behavior, scheme, network, asset, and expected result.

#### Are HTTP, MCP, and A2A x402 claims evaluated separately?

- Status: Not applicable
- Result: Transport separation is not scored because no x402 challenge or explicit x402 claim was detected.

#### Does an unpaid request return an x402 challenge?

- Status: Needs fix
- Result: The unpaid response did not include a decodable x402 V2 payment challenge.
- Why it matters: Agents may not be able to discover, understand, or safely attempt this payment path from static public evidence.
- How to fix: Return HTTP 402 with a decodable x402 V2 PAYMENT-REQUIRED challenge.

### UCP checkout

- Company signal: Not detected

#### Are declared external UCP service endpoints reachable?

- Status: Not applicable
- Result: No external UCP service endpoint is declared; the registries may be empty or embedded-only.

#### Is the UCP business profile publicly discoverable?

- Status: Needs fix
- Result: No usable resource was found at /.well-known/ucp (HTTP 404).
- Why it matters: Agents may not be able to discover, understand, or safely attempt this payment path from static public evidence.
- How to fix: Serve a schema-valid public UCP business profile at /.well-known/ucp without authentication.

#### Is checkout capability claimed with enough structure to test later?

- Status: Needs fix
- Result: No structurally valid dev.ucp.shopping.checkout capability was declared.
- Why it matters: Agents may not be able to discover, understand, or safely attempt this payment path from static public evidence.
- How to fix: Declare dev.ucp.shopping.checkout with version and schema when UCP checkout is supported.

#### Does the profile declare payment handlers?

- Status: Needs fix
- Result: The UCP profile does not contain a valid payment-handler registry.
- Why it matters: Agents may not be able to discover, understand, or safely attempt this payment path from static public evidence.
- How to fix: Include the payment_handlers registry. Each declared handler entry requires version and id; config is optional.

#### Are signing keys published for message verification?

- Status: Not applicable
- Result: No signed-message or webhook capability is claimed, so signing keys are not required.

#### Does the profile follow the UCP business-profile registries?

- Status: Needs fix
- Result: The UCP profile exists, but its services, capabilities, or payment handlers use the wrong structure.
- Why it matters: Agents may not be able to discover, understand, or safely attempt this payment path from static public evidence.
- How to fix: Declare a YYYY-MM-DD ucp.version plus services and payment_handlers registries. Capabilities are optional; declared services, capabilities, and handlers must follow their transport/entity schemas.

### Not applicable

MPP, ACP, AP2, Visa TAP, Mastercard Agent Pay

### Agent access

#### AI content-use preferences

- Status: Needs fix
- Result: No Content Signals found in robots.txt
- Why it matters: Agents may fail to discover, read or authenticate against the public website.
- How to fix: Add standards-based content-use signals to robots.txt when the company has an AI content policy.

#### AI crawler access

- Status: Passed
- Result: No AI-specific bot rules; wildcard rules apply to all crawlers including AI bots

#### Authenticated bot identity

- Status: Not applicable
- Result: Web Bot Auth directory not found (informational only)

#### Markdown availability

- Status: Needs fix
- Result: Site does not support Markdown for Agents
- Why it matters: Agents may fail to discover, read or authenticate against the public website.
- How to fix: Support Accept: text/markdown for important public pages or provide an equivalent stable Markdown representation.

#### Agent discovery DNS

- Status: Needs fix
- Result: DNS for AI Discovery (DNS-AID) well-known entrypoint records not found
- Why it matters: Agents may fail to discover, read or authenticate against the public website.
- How to fix: Publish the applicable DNS-AID records under the company domain and protect the discovery zone with DNSSEC.

#### Agent discovery links

- Status: Needs fix
- Result: Link headers present but no agent-useful relation types found
- Why it matters: Agents may fail to discover, read or authenticate against the public website.
- How to fix: Add Link response headers from the homepage to API documentation, API catalogs, MCP metadata and payment documentation.

#### robots.txt

- Status: Passed
- Result: robots.txt exists with valid format

#### Sitemap

- Status: Passed
- Result: sitemap.xml exists with valid structure

#### A2A agent card

- Status: Not applicable
- Result: This check was excluded from scoring for this scan.

#### Agent Skills index

- Status: Needs fix
- Result: Agent Skills index not found
- Why it matters: Agents may not find the correct machine interface or operation.
- How to fix: Expose an Agent Skills index with focused instructions for discovery, authentication and paid operations.

#### API catalog

- Status: Needs fix
- Result: API Catalog not found
- Why it matters: Agents may not find the correct machine interface or operation.
- How to fix: Publish a machine-readable API catalog that links to current OpenAPI documents and authentication guidance.

#### Agent authentication guidance

- Status: Needs fix
- Result: auth.md not found
- Why it matters: Agents may fail to discover, read or authenticate against the public website.
- How to fix: Publish stable agent-readable authentication instructions, including registration, scopes, test credentials and failure behavior.

#### MCP server discovery

- Status: Needs fix
- Result: MCP Server Card not found
- Why it matters: Agents may not find the correct machine interface or operation.
- How to fix: Publish current MCP connection metadata, transport, authentication requirements, tool schemas and example calls.

#### OAuth sign-in discovery

- Status: Needs fix
- Result: No OAuth/OIDC discovery metadata found
- Why it matters: Agents may fail to discover, read or authenticate against the public website.
- How to fix: Publish the appropriate OAuth authorization-server or OpenID provider metadata and keep every referenced endpoint reachable.

#### Protected API metadata

- Status: Needs fix
- Result: No OAuth Protected Resource Metadata found
- Why it matters: Agents may fail to discover, read or authenticate against the public website.
- How to fix: Publish OAuth protected-resource metadata that identifies the resource, authorization servers and supported scopes.

#### Browser tools (WebMCP)

- Status: Needs verification
- Result: Browser session timed out
- Why it matters: Agents may not find the correct machine interface or operation.
- How to fix: Publish a WebMCP surface with stable tool schemas and document any authentication or payment requirements.

## Executed Agent Tests

| Agent | Status | Score |
|-------|--------|-------|
| Claude Code | Not run | — |
| Codex | Not run | — |

## Services and Endpoints

- No endpoint inventory attached.

## External Website Benchmarks

- No external website benchmark attached.

External scores provide website context and do not contribute to Lightsage's payment-readiness score.

## Evidence

- [Sapient backend static agent-payment scan](https://lightsage.com/agent-experience-arena/payments/methodology)
- [Lightsage backend static agent-payment scan](https://lightsage.com/agent-experience-arena/payments/methodology)

Canonical URL: https://lightsage.com/agent-experience-arena/payments/scalekit-com