The Home Depot: 24 of 100 on Ora's agent-readiness scan

The score

The Home Depot is a home improvement retailer based in Atlanta.

• 24of 100, grade F
  Ora's agent-readiness scan of homedepot.com, read 9 November 2026, listed under E-commerce.
• 5Discovery, of 8
  Whether assistants find the company: search presence, Wikipedia and Wikidata, catalogues.
• 0Access, of 50
  Whether they can read it: the door, text without JavaScript, llms.txt, structured data.
• 13Usability, of 58
  Whether they can act through it: an MCP server, an API with a specification, sign-in for agents.
• 0Payments, of 0
  No check in this layer applied to the site.

9 percent of the 132,085 domains Ora ranks score under 20, and the average score is 44.

Ora's one-line summary: Home Depot offers OAuth 2.0 support, but lacks an OpenAPI specification.

What an assistant meets at the door

Before an assistant can read, compare or buy, it has to get in. These rows are the door: whether the bot shield lets the main agents through, what robots.txt tells the search, training and user-triggered agents, and whether the home page has text without running JavaScript.

What it can read, and what it can do

The reading layer is what an assistant takes away from the pages: a text file written for it, markdown on request, structured data about the company, a sitemap. The act layer is whether it can do anything through a published interface rather than by clicking through the site.

The six payment checks did not apply on this read: Ora did not read the site as a shop.

Three fixes to hand to the web team

Ora estimates how many points each open check would return. These are the largest on this read, in Ora's words where it gave them, so a leader can hand the list over without translating it.

1. Developer resource discoverability, worth about 5.6 points by Ora's estimate: Agent found 2 pages by name but no recognizable developer-resource type. Not found in this search sample: API docs, OpenAPI spec, developer portal, auth docs, MCP server, SDK documentation.
2. OpenAPI spec published, worth about 4.7 points by Ora's estimate: No OpenAPI/Swagger specification found.
3. MCP server / manifest, worth about 4.6 points by Ora's estimate: No MCP server or manifest found.

Our read

The Home Depot challenges six agents and leaves sign-in and an endpoint standing behind them. Bot management challenged GPTBot, ClaudeBot, ChatGPT-User, PerplexityBot, Google-Extended and Applebot-Extended, robots.txt answered with a 403 challenge and the home page came back as a security page, so the door, content, policy, structured-data and metadata rows are unverified rather than failed, and the Access layer reads 0 of 50; there is no sitemap and no llms.txt. The act layer has two real surfaces: a GraphQL endpoint at api.homedepot.com with introspection gated, and OpenID Connect discovery at identity.homedepot.com, with an SDK on npm beside them; there is no developer portal, no OpenAPI specification and no MCP server, so the Usability layer reads 13 of 58. The Discovery layer is 5 of 8: homedepot.com ranks first for homedepot, a search run on the bare name, and no Wikipedia article or Wikidata item points at the domain. A retailer whose customers ask assistants which drill to buy has a store they cannot open; the challenge decides the grade.

Test your own site

Run the same scan on your own domain at ora.ai. The score, the layers and the fixes on this page come from its public result for homedepot.com; a scan of a public site takes a few minutes and needs no account.

• Scan your domain on OraThe same checks, the same scoring, on your own site.
• The self-check, 18 questionsWhat to ask for, in business terms, before the scan.
• All the 360 checksThe other companies in this series, newest first.