Bank of America: 48 of 100 on Ora's agent-readiness scan

The score

Bank of America is a bank based in Charlotte, North Carolina.

• 48of 100, grade C
  Ora's agent-readiness scan of bankofamerica.com, read 9 November 2026.
• 11Discovery, of 15
  Whether assistants find the company: search presence, Wikipedia and Wikidata, catalogues.
• 28Access, of 54
  Whether they can read it: the door, text without JavaScript, llms.txt, structured data.
• 20Usability, of 62
  Whether they can act through it: an MCP server, an API with a specification, sign-in for agents.
• 0Payments, of 0
  No check in this layer applied to the site.

43 percent of the 132,085 domains Ora ranks score under 40, and the average score is 44.

Ora's one-line summary: Bank of America offers strong developer resource discoverability, but lacks an OpenAPI specification for standardized agent integration.

What an assistant meets at the door

Before an assistant can read, compare or buy, it has to get in. These rows are the door: whether the bot shield lets the main agents through, what robots.txt tells the search, training and user-triggered agents, and whether the home page has text without running JavaScript.

What it can read, and what it can do

The reading layer is what an assistant takes away from the pages: a text file written for it, markdown on request, structured data about the company, a sitemap. The act layer is whether it can do anything through a published interface rather than by clicking through the site.

The six payment checks did not apply on this read: Ora did not read the site as a shop.

Three fixes to hand to the web team

Ora estimates how many points each open check would return. These are the largest on this read, in Ora's words where it gave them, so a leader can hand the list over without translating it.

1. OpenAPI spec published, worth about 4.3 points by Ora's estimate: No OpenAPI/Swagger specification found.
2. Scoped permissions, worth about 3.6 points by Ora's estimate: No declared OAuth scopes, security schemes, or scoped-permission documentation found.
3. Developer resource discoverability, worth about 3 points by Ora's estimate: Name search surfaced no pages on bankofamerica.com, although developer resources exist on the site (developer portal) - weak search indexing or transient search noise.

Our read

Bank of America lets the agents in and reads well. All four agent user agents reach the home page, robots.txt allows the search and training crawlers, the sitemap lists 27 entries, the Organization block lacks only its description, and the home page gives 3,768 characters with an H1, though its first content heading is an H4 and the text ratio is 1.4 percent against the 5 percent target. There is no llms.txt on the main domain; the one at developer.bankofamerica.com returns an HTML page. The act layer is a portal with a shield in front of it: developer.bankofamerica.com is real, but the API has no machine-verifiable surface, OAuth is mentioned without standard endpoints, and Ora's requests for an MCP manifest were answered with a 403 by the bot shield, so that row is unverified. The domain ranks first for its investment banking term. An OpenAPI specification is the fix with the most points, about 4.3: the portal is built and not yet described to a machine.

Test your own site

Run the same scan on your own domain at ora.ai. The score, the layers and the fixes on this page come from its public result for bankofamerica.com; a scan of a public site takes a few minutes and needs no account.

• Scan your domain on OraThe same checks, the same scoring, on your own site.
• The self-check, 18 questionsWhat to ask for, in business terms, before the scan.
• All the 360 checksThe other companies in this series, newest first.