# Usenaive - Agent Payment Report - Domain: usenaive.ai - Category: Other - Company type: other - Payment systems found: None detected - Agent interfaces found: None detected - Payer platforms or methods: None detected - Vendor roles: None cataloged - Strongest evidence: **Not evaluated** - Score version: `agent-payments-v6` - Last scanned: 2026-08-24T21:06:28.638+00:00 ## Payment documentation - No payment protocols documented. ## Scores | Dimension | Score | |-----------|-------| | Payment readiness | 0 | | Agent access | 21 | | Overall readiness | 6 | An em dash means there is not enough evidence to calculate that dimension. A public support claim is not treated as a completed payment. ## Payment Checks Each section shows what was found, what still needs work, and the strongest available evidence. Not-applicable systems do not reduce the score. ### x402 payments - Company signal: Not detected #### Is at least one accepted payment option complete enough for a payer to execute? - Status: Needs fix - Result: No payment-required object could be inspected. - Why it matters: Agents may not be able to discover, understand, or safely attempt this payment path from static public evidence. - How to fix: Return a complete x402 V2 challenge with at least one accepted option. #### Is the payment challenge protected from stale public caching? - Status: Needs fix - Importance: Recommended - Result: No x402 challenge response was available to inspect cache behavior. - Why it matters: Agents may not be able to discover, understand, or safely attempt this payment path from static public evidence. - How to fix: Return x402 payment challenges with Cache-Control: no-store. #### Is there a concrete paid endpoint or tool the agent can discover? - Status: Needs fix - Result: No x402-specific public discovery source identified a payable endpoint. Generic paid API pages and failed common-path probes are not counted as x402 support. - Why it matters: Agents may not be able to discover, understand, or safely attempt this payment path from static public evidence. - How to fix: Publish a concrete x402 paid endpoint in public docs/OpenAPI or the official x402 Bazaar discovery index, and make the endpoint return a complete unpaid HTTP 402 x402 challenge. #### Are HTTP, MCP, and A2A x402 claims evaluated separately? - Status: Not detected - Result: Transport separation is not scored because no x402 protocol artifact was available. #### Does an unpaid request return an x402 challenge? - Status: Needs fix - Result: No x402 endpoint was available for an unpaid HTTP 402 preflight request. - Why it matters: Agents may not be able to discover, understand, or safely attempt this payment path from static public evidence. - How to fix: Expose a safe unpaid GET/HEAD endpoint that returns an x402 V2 PAYMENT-REQUIRED challenge. ### MPP payments - Company signal: Not detected #### Can the agent understand the shared and method-specific payment terms before payment? - Status: Needs fix - Result: Observed amount=None, currency=None, recipient=None, resource=None. - Why it matters: Agents may not be able to discover, understand, or safely attempt this payment path from static public evidence. - How to fix: Include the shared amount and currency or asset fields, plus any fields required by the selected MPP method and intent. Recipient and description are method-specific and are not universally required. #### Are MPP challenges cache-safe? - Status: Needs fix - Importance: Recommended - Result: Cache headers were not scored because no MPP Payment challenge was detected. - Why it matters: Agents may not be able to discover, understand, or safely attempt this payment path from static public evidence. - How to fix: Return Cache-Control: no-store on MPP challenge responses. #### Is the MPP challenge identifiable and bound to a payment intent? - Status: Needs fix - Result: The challenge must include id, realm, a lowercase method, and a registered intent. - Why it matters: Agents may not be able to discover, understand, or safely attempt this payment path from static public evidence. - How to fix: Include id, realm, a lowercase method, a registered intent, and a decodable request parameter in the MPP challenge. #### Does an unpaid request return an MPP Payment challenge? - Status: Needs fix - Result: The endpoint did not return an MPP Payment challenge. - Why it matters: Agents may not be able to discover, understand, or safely attempt this payment path from static public evidence. - How to fix: Return HTTP 402 with WWW-Authenticate: Payment. #### Is the MPP service discoverable from the expected OpenAPI route? - Status: Needs fix - Result: Agents need a public OpenAPI 3.1 /openapi.json document with x-payment-info.offers to discover MPP paid operations. - Why it matters: Agents may not be able to discover, understand, or safely attempt this payment path from static public evidence. - How to fix: Serve GET /openapi.json with OpenAPI 3.1 and x-payment-info.offers for each MPP paid operation; validate it with mppx discover validate. #### Is the MPP service publicly listed? - Status: Needs verification - Importance: Optional - Result: Public listing is curated and not automatic after protocol validation. - Why it matters: Agents may not be able to discover, understand, or safely attempt this payment path from static public evidence. - How to fix: Register the deployed API in MPPScan and, if it accepts live MPP payments, submit a service-directory pull request to tempoxyz/mpp. #### Is there a concrete payable resource or tool? - Status: Needs fix - Result: A URL, OpenAPI operation, or protocol mention is not enough to prove a concrete payable MPP resource. - Why it matters: Agents may not be able to discover, understand, or safely attempt this payment path from static public evidence. - How to fix: Publish a concrete MPP-protected endpoint or OpenAPI operation with payment information. #### Is the challenge bounded to the current request and validity window? - Status: Needs fix - Result: The challenge does not include enough request-bound payment terms to verify it safely. - Why it matters: Agents may not be able to discover, understand, or safely attempt this payment path from static public evidence. - How to fix: Include decodable request terms and a short expiry in the unpaid Payment challenge. ### UCP checkout - Company signal: Not detected #### Are declared external UCP service endpoints reachable? - Status: Needs fix - Result: No public UCP profile was found, so no declared service endpoint could be checked. - Why it matters: Agents may not be able to discover, understand, or safely attempt this payment path from static public evidence. - How to fix: Publish the transport-specific endpoint required by each external UCP service binding and keep it reachable. Authentication metadata is not required in the business profile. #### Is the UCP business profile publicly discoverable? - Status: Needs fix - Result: No usable resource was found at /.well-known/ucp (HTTP 404). - Why it matters: Agents may not be able to discover, understand, or safely attempt this payment path from static public evidence. - How to fix: Serve a schema-valid public UCP business profile at /.well-known/ucp without authentication. #### Does the profile declare payment handlers? - Status: Needs fix - Result: The UCP profile does not contain a valid payment-handler registry. - Why it matters: Agents may not be able to discover, understand, or safely attempt this payment path from static public evidence. - How to fix: Include the payment_handlers registry. Each declared handler entry requires version and id; config is optional. #### Are signing keys published for message verification? - Status: Not detected - Result: No signed-message or webhook capability is claimed, so signing keys are not required. #### Does the profile follow the UCP business-profile registries? - Status: Needs fix - Result: The UCP profile exists, but its services, capabilities, or payment handlers use the wrong structure. - Why it matters: Agents may not be able to discover, understand, or safely attempt this payment path from static public evidence. - How to fix: Declare a YYYY-MM-DD ucp.version plus services and payment_handlers registries. Capabilities are optional; declared services, capabilities, and handlers must follow their transport/entity schemas. ### ACP checkout - Company signal: Not detected #### Are required checkout operations documented? - Status: Needs fix - Result: Documented checkout operations: create; missing: cancel, complete, get, update. - Why it matters: Agents may not be able to discover, understand, or safely attempt this payment path from static public evidence. - How to fix: Document create, update, complete, cancel, and get checkout session operations with schemas and error models. #### Is ACP publicly discoverable through official discovery or a concrete conventional endpoint? - Status: Needs fix - Result: No schema-valid ACP discovery document was found at /.well-known/acp.json. - Why it matters: Agents may not be able to discover, understand, or safely attempt this payment path from static public evidence. - How to fix: Publish a schema-valid, unauthenticated /.well-known/acp.json discovery document at the seller origin, or expose a conventional ACP endpoint that responds with ACP-shaped errors for malformed unauthenticated requests. #### Is payment handling described without implying settlement? - Status: Needs fix - Result: No complete payment-handler contract was found; a provider/handler claim and executable method or credential detail are both required. - Why it matters: Agents may not be able to discover, understand, or safely attempt this payment path from static public evidence. - How to fix: Document payment_provider, supported payment methods, PSP token handling, and delegated-payment support if applicable. #### Are open ACP support and platform-specific ChatGPT support separated? - Status: Needs fix - Result: Platform-claim separation was not scored because no valid ACP discovery document was found. - Why it matters: Agents may not be able to discover, understand, or safely attempt this payment path from static public evidence. - How to fix: Separate open ACP implementation claims from approved ChatGPT/Instant Checkout participation claims. #### Can agents understand products before checkout? - Status: Not detected - Result: No ACP product-feed or product-catalog service is advertised; checkout-only ACP does not require a feed. #### Does the contract require authenticated, signed, idempotent requests? - Status: Needs fix - Result: Missing required ACP request controls: Authorization, API-Version, Request-Id, Idempotency-Key. - Why it matters: Agents may not be able to discover, understand, or safely attempt this payment path from static public evidence. - How to fix: Require Authorization, Signature, Timestamp, API-Version, Request-Id, and Idempotency-Key where applicable. ### AP2 authorization - Company signal: Not detected #### Is the audit trail model documented? - Status: Needs fix - Result: AP2 audit/dispute evidence is incomplete; missing: mandate retention, customer-support outcome, correlated evidence. - Why it matters: Agents may not be able to discover, understand, or safely attempt this payment path from static public evidence. - How to fix: Document how signed mandates, payment references, receipts, refunds, and dispute evidence are retained. #### Are autonomous-payment limits represented in the contract? - Status: Needs fix - Result: AP2 authorization bounds are incomplete; missing: amount and currency, merchant or item scope, expiry. - Why it matters: Agents may not be able to discover, understand, or safely attempt this payment path from static public evidence. - How to fix: Represent merchant, item, amount, currency, payment method, and expiry bounds in the mandate contract. #### Is AP2 support discoverable through a real commerce or agent transport binding? - Status: Needs fix - Result: AP2 binding evidence is incomplete; missing: official A2A Agent Card or UCP AP2 capability. - Why it matters: Agents may not be able to discover, understand, or safely attempt this payment path from static public evidence. - How to fix: Advertise AP2 with the exact A2A extension URI https://github.com/google-agentic-commerce/ap2/v1 in the agent's /.well-known/agent-card.json, or publish the exact UCP capability dev.ucp.shopping.ap2_mandate in /.well-known/ucp. #### Are mandate types and schemas documented? - Status: Needs fix - Result: AP2 mandate schema evidence is incomplete; missing: Checkout Mandate vct, Payment Mandate vct. - Why it matters: Agents may not be able to discover, understand, or safely attempt this payment path from static public evidence. - How to fix: Document the v0.2 Checkout Mandate and Payment Mandate schemas using their registered closed/open vct values. #### Does AP2 evidence link to an underlying payment rail without claiming that rail passed? - Status: Needs fix - Result: AP2 payment linkage is incomplete; missing: underlying payment rail, payment/order correlation. - Why it matters: Agents may not be able to discover, understand, or safely attempt this payment path from static public evidence. - How to fix: Name the underlying rail and fields that link the mandate chain to the payment or order reference. #### Can the agent identify who signs and verifies each mandate? - Status: Needs fix - Result: AP2 signature/credential evidence is incomplete; missing: signed mandate, signer identity, verification key or credential. - Why it matters: Agents may not be able to discover, understand, or safely attempt this payment path from static public evidence. - How to fix: Document signing algorithms, key discovery, verifiable credential issuers, and trust anchors. ### Agent access #### AI content-use preferences - Status: Needs fix - Result: No Content Signals found in robots.txt - Why it matters: Agents may fail to discover, read or authenticate against the public website. - How to fix: Add standards-based content-use signals to robots.txt when the company has an AI content policy. #### AI crawler access - Status: Passed - Result: The crawler policy includes major AI agents. #### Authenticated bot identity - Status: Not detected - Result: Web Bot Auth directory not found (informational only) #### Markdown availability - Status: Needs fix - Result: Site does not support Markdown for Agents - Why it matters: Agents may fail to discover, read or authenticate against the public website. - How to fix: Support Accept: text/markdown for important public pages or provide an equivalent stable Markdown representation. #### Agent discovery DNS - Status: Needs fix - Result: DNS for AI Discovery (DNS-AID) well-known entrypoint records not found - Why it matters: Agents may fail to discover, read or authenticate against the public website. - How to fix: Publish the applicable DNS-AID records under the company domain and protect the discovery zone with DNSSEC. #### Agent discovery links - Status: Needs fix - Result: No Link headers found on target page - Why it matters: Agents may fail to discover, read or authenticate against the public website. - How to fix: Add Link response headers from the homepage to API documentation, API catalogs, MCP metadata and payment documentation. #### robots.txt - Status: Passed - Result: robots.txt exists with valid format #### Sitemap - Status: Passed - Result: sitemap.xml exists with valid structure #### A2A agent card - Status: Not detected - Result: This check was excluded from scoring for this scan. #### Agent Skills index - Status: Needs fix - Result: Agent Skills index not found - Why it matters: Agents may not find the correct machine interface or operation. - How to fix: Expose an Agent Skills index with focused instructions for discovery, authentication and paid operations. #### API catalog - Status: Needs fix - Result: API Catalog not found - Why it matters: Agents may not find the correct machine interface or operation. - How to fix: Publish a machine-readable API catalog that links to current OpenAPI documents and authentication guidance. #### Ard - Status: Not detected - Result: This check was excluded from scoring for this scan. #### Agent authentication guidance - Status: Needs fix - Result: auth.md not found - Why it matters: Agents may fail to discover, read or authenticate against the public website. - How to fix: Publish stable agent-readable authentication instructions, including registration, scopes, test credentials and failure behavior. #### MCP server discovery - Status: Needs fix - Result: MCP Server Card not found - Why it matters: Agents may not find the correct machine interface or operation. - How to fix: Publish current MCP connection metadata, transport, authentication requirements, tool schemas and example calls. #### OAuth sign-in discovery - Status: Needs fix - Result: No OAuth/OIDC discovery metadata found - Why it matters: Agents may fail to discover, read or authenticate against the public website. - How to fix: Publish the appropriate OAuth authorization-server or OpenID provider metadata and keep every referenced endpoint reachable. #### Protected API metadata - Status: Needs fix - Result: No OAuth Protected Resource Metadata found - Why it matters: Agents may fail to discover, read or authenticate against the public website. - How to fix: Publish OAuth protected-resource metadata that identifies the resource, authorization servers and supported scopes. #### Browser tools (WebMCP) - Status: Needs fix - Result: No WebMCP tools detected on page load - Why it matters: Agents may not find the correct machine interface or operation. - How to fix: Publish a WebMCP surface with stable tool schemas and document any authentication or payment requirements. ## Executed Agent Tests | Agent | Status | Score | |-------|--------|-------| | Claude Code | Not run | — | | Codex | Not run | — | ## Services and Endpoints - No endpoint inventory attached. ## External Website Benchmarks - No external website benchmark attached. External scores provide website context and do not contribute to Lightsage's payment-readiness score. ## Evidence - No public evidence attached. Page URL: https://lightsage.com/agent-experience-arena/payments/usenaive-ai