Costco: 39 of 100 on Ora's agent-readiness scan
In short
Costco scores 39 of 100 on Ora's agent-readiness scan, grade D, read on 9 November 2026. 25 percent of the 132,085 domains Ora ranks score under 30, and the average score is 44. A door opening onto 414 characters, on a shop the scan did not read as one.
The score
Costco is a membership warehouse retailer based in Washington state.
- 39of 100, grade DOra's agent-readiness scan of costco.com, read 9 November 2026, listed under E-commerce.
- 8Discovery, of 12Whether assistants find the company: search presence, Wikipedia and Wikidata, catalogues.
- 14Access, of 49Whether they can read it: the door, text without JavaScript, llms.txt, structured data.
- 23Usability, of 70Whether they can act through it: an MCP server, an API with a specification, sign-in for agents.
- 0Payments, of 0No check in this layer applied to the site.
25 percent of the 132,085 domains Ora ranks score under 30, and the average score is 44.
Ora's one-line summary: Costco.com has a sitemap, but lacks an OpenAPI specification.
What an assistant meets at the door
Before an assistant can read, compare or buy, it has to get in. These rows are the door: whether the bot shield lets the main agents through, what robots.txt tells the search, training and user-triggered agents, and whether the home page has text without running JavaScript.
| Check | Result | What Ora saw |
|---|---|---|
| Not blocked by bot detection | Pass, 2 of 2 | Site accessible to 4 agent user-agents (ChatGPT-User, OAI-SearchBot, Claude-User, PerplexityBot). |
| Agent crawler reachability | Pass, 2 of 2 | Reachable to every agent we tested - ChatGPT-User: reachable, OAI-SearchBot: reachable, Claude-User: reachable, PerplexityBot: reachable |
| robots.txt AI crawler policy | Pass, 2 of 2 | AI search crawlers: allowed in 3 of 3 checks (3 crawlers on 1 page). AI training crawlers: allowed in 2 of 2 checks (2 crawlers on 1 page), not scored. |
| robots.txt agent-user policy | Pass, 2 of 2 | No applicable crawl or usage restriction found for 3 user-triggered agents (chatgpt-user, claude-user, perplexity-user) on 1 public page: https://costco.com/. Declared policy only; |
| Content without JavaScript | Partial, 1 of 3 | Only 414 chars of text content - agents see limited content |
| Homepage not hidden from search | Pass, 1 of 1 | No noindex on the homepage: no robots, googlebot or bingbot meta tag and no X-Robots-Tag header hides it from search. |
What it can read, and what it can do
The reading layer is what an assistant takes away from the pages: a text file written for it, markdown on request, structured data about the company, a sitemap. The act layer is whether it can do anything through a published interface rather than by clicking through the site.
| Check | Result | What Ora saw |
|---|---|---|
| llms.txt exists | Fail, 0 of 1 | No llms.txt found at /llms.txt or /.well-known/llms.txt. |
| llms.txt formatting | Fail, 0 of 2 | No llms.txt found to evaluate quality |
| Markdown agent docs | Fail, 0 of 1 | Missing markdown content negotiation. Homepage returned text/html when probed with Accept: text/markdown (expected text/markdown), and none of the well-known root paths (/llms.md, /auth.md, /agents.md, /developers.md). |
| Bot-UA markdown serving | Fail, 0 of 1 | No probed bot User-Agent (GPTBot, ClaudeBot, ChatGPT-User, PerplexityBot, Google-Extended, Applebot-Extended, ora-agent, DeepSeekBot) receives markdown when requesting HTML. |
| JSON-LD structured data | Fail, 0 of 4 | No JSON-LD structured data found on homepage |
| Organization schema completeness | Fail, 0 of 2 | No JSON-LD found - Organization schema missing |
| Sitemap exists | Pass, 2 of 2 | Valid sitemap found at https://www.costco.com/sitemap_lw_index.xml with multiple sitemaps entries |
| Metadata completeness | Partial, 1 of 2 | 2/4 metadata signals present - missing: og:image, og:type |
| Page token budget | Pass, 1 of 1 | All 1 measured page fit an agent context budget (largest ~1K tokens) |
| Check | Result | What Ora saw |
|---|---|---|
| MCP server / manifest | Fail, 0 of 6 | No MCP server or manifest found |
| MCP well-known discovery | Fail, 0 of 2 | No MCP server URL discovered |
| Public API with reachable endpoints | Pass, 7 of 7 | GraphQL endpoint at https://ecom-api.costco.com/ebusiness/product/v1/products/graphql\ is reachable; introspection requires authentication (API key / OAuth), which is expected for agent access. |
| Public API/docs linked from homepage | Fail, 0 of 3 | No public API or documentation page linked from homepage |
| OpenAPI spec published | Fail, 0 of 7 | No OpenAPI/Swagger specification found |
| Developer portal | Did not apply, 0 of 6 | No developer portal found |
| OAuth 2.0 support | Partial, 2 of 5 | OAuth mentioned on homepage but no standard endpoints found |
| Scoped permissions | Fail, 0 of 5 | No declared OAuth scopes, security schemes, or scoped-permission documentation found |
| Multi-language SDK packages | Did not apply, 0 of 3 | No SDK packages found across language ecosystems |
| CLI tool available | Did not apply, 0 of 3 | No CLI tool found |
| WebMCP support | Fail, 0 of 5 | No WebMCP support detected - no tool-attribute forms and no document.modelContext / navigator.modelContext usage found (scanned 8 of 65 same-origin script bundle(s) for modelContext registrations) |
| Check | Result | What Ora saw |
|---|---|---|
| Wikipedia / Wikidata entity presence | Partial, 2 of 4 | Wikidata Q715583 (Costco) verified - draft a Wikipedia page with cited references to complete knowledge graph coverage |
| Brand name discoverability | Pass, 3 of 3 | costco.com ranks #1 for "costco" (searched your brand name alone: no main product term from your homepage qualified) |
| Category share of voice | Did not apply, 0 of 6 | Category share of voice is in beta. It measures whether agents surface you for capability and use-case searches (not just your name). |
| Developer resource discoverability | Fail, 0 of 3 | Agent searched for "costco" developer resources but found nothing relevant |
The six payment checks did not apply on this read: Ora did not read the site as a shop.
Three fixes to hand to the web team
Ora estimates how many points each open check would return. These are the largest on this read, in Ora's words where it gave them, so a leader can hand the list over without translating it.
- Developer resource discoverability, worth about 5.6 points by Ora's estimate: Agent searched for "costco" developer resources but found nothing relevant.
- OpenAPI spec published, worth about 4.8 points by Ora's estimate: No OpenAPI/Swagger specification found.
- MCP server / manifest, worth about 3.8 points by Ora's estimate: No MCP server or manifest found.
Our read
Costco opens the door and gives an agent 414 characters. All four agent user agents get in and robots.txt allows the search and training crawlers, but the home page renders 414 characters of text without JavaScript, there is no JSON-LD and no llms.txt, and the metadata carries two of four signals, so the Access layer reads 14 of 49; the sitemap index is the one reading row in order. The act layer is a GraphQL endpoint at ecom-api.costco.com that answers, with OAuth mentioned and no standard endpoints, and neither a developer portal nor an OpenAPI specification, and no MCP server, so the Usability layer reads 23 of 70. The six payment checks did not apply on this read: Ora did not read the warehouse club as a shop. The domain ranks first for costco, Wikidata confirms it, and a search for its developer resources found nothing. A membership retailer whose members increasingly send assistants to compare prices shows those assistants a near-empty page; the template is the fix.
Test your own site
Run the same scan on your own domain at ora.ai. The score, the layers and the fixes on this page come from its public result for costco.com; a scan of a public site takes a few minutes and needs no account.
- Scan your domain on OraThe same checks, the same scoring, on your own site.
- The self-check, 18 questionsWhat to ask for, in business terms, before the scan.
- All the 360 checksThe other companies in this series, newest first.
Sources
- Ora report for costco.com (ora.ai/score/costco.com), read 9 Nov 2026. Vendor claim.
Last reviewed