Johnson & Johnson: 16 of 100 on Ora's agent-readiness scan
In short
Johnson & Johnson scores 16 of 100 on Ora's agent-readiness scan, grade F, read on 9 November 2026. 2 percent of the 132,085 domains Ora ranks score under 10, and the average score is 44. A challenge at the door and a three-letter domain the knowledge graph cannot place.
The score
Johnson & Johnson is a pharmaceutical and medical device company based in New Brunswick, New Jersey.
- 16of 100, grade FOra's agent-readiness scan of jnj.com, read 9 November 2026.
- 0Discovery, of 7Whether assistants find the company: search presence, Wikipedia and Wikidata, catalogues.
- 0Access, of 41Whether they can read it: the door, text without JavaScript, llms.txt, structured data.
- 12Usability, of 33Whether they can act through it: an MCP server, an API with a specification, sign-in for agents.
- 0Payments, of 0No check in this layer applied to the site.
2 percent of the 132,085 domains Ora ranks score under 10, and the average score is 44.
Ora's one-line summary: jnj.com offers OAuth 2.0 support, but lacks an OpenAPI specification.
What an assistant meets at the door
Before an assistant can read, compare or buy, it has to get in. These rows are the door: whether the bot shield lets the main agents through, what robots.txt tells the search, training and user-triggered agents, and whether the home page has text without running JavaScript.
| Check | Result | What Ora saw |
|---|---|---|
| Not blocked by bot detection | Partial, 0 of 2 | Bot management challenged GPTBot, ClaudeBot, ChatGPT-User, PerplexityBot, Applebot-Extended. A challenge is an identity check that verified crawlers pass. |
| Agent crawler reachability | Partial, 0 of 2 | Bot management challenged ChatGPT-User, ClaudeBot - a challenge is an identity check verified crawlers pass, so reachability is undetermined rather than blocked (ChatGPT-User: challenged, ClaudeBot: challenged). |
| robots.txt AI crawler policy | Did not apply, 0 of 2 | Cannot verify robots.txt permission for training and search crawlers: WAF/bot challenge (HTTP 403) |
| robots.txt agent-user policy | Did not apply, 0 of 2 | Cannot verify robots.txt permission for user-triggered agents: WAF/bot challenge (HTTP 403) |
| Content without JavaScript | Partial, 0 of 3 | Homepage blocked by WAF/security challenge - content not accessible to agents |
What it can read, and what it can do
The reading layer is what an assistant takes away from the pages: a text file written for it, markdown on request, structured data about the company, a sitemap. The act layer is whether it can do anything through a published interface rather than by clicking through the site.
| Check | Result | What Ora saw |
|---|---|---|
| llms.txt exists | Fail, 0 of 1 | No llms.txt found at /llms.txt or /.well-known/llms.txt. |
| llms.txt formatting | Fail, 0 of 2 | No llms.txt found to evaluate quality |
| Markdown agent docs | Fail, 0 of 1 | Missing markdown content negotiation. Homepage returned text/html when probed with Accept: text/markdown (expected text/markdown), and none of the well-known root paths (/llms.md, /auth.md, /agents.md, /developers.md). |
| Bot-UA markdown serving | Did not apply, 0 of 1 | Site is behind a WAF/bot wall - cannot probe bot-UA serving |
| JSON-LD structured data | Partial, 0 of 4 | Homepage blocked by WAF - cannot check structured data |
| Organization schema completeness | Partial, 0 of 2 | Homepage blocked by WAF - cannot check Organization schema |
| Sitemap exists | Fail, 0 of 2 | No sitemap found |
| Metadata completeness | Partial, 0 of 2 | Homepage blocked by WAF - cannot check metadata |
| Page token budget | Did not apply, 0 of 1 | Nothing sampled to measure |
| Check | Result | What Ora saw |
|---|---|---|
| MCP server / manifest | Fail, 0 of 6 | No MCP server or manifest found |
| MCP well-known discovery | Fail, 0 of 2 | No MCP server URL discovered |
| Public API with reachable endpoints | Pass, 7 of 7 | GraphQL endpoint at https://jnj.com/graphql is reachable; introspection requires authentication (API key / OAuth), which is expected for agent access. Best-of-protocols score: 7/7. |
| Public API/docs linked from homepage | Partial, 0 of 3 | Homepage blocked by WAF - cannot check for docs links |
| OpenAPI spec published | Fail, 0 of 7 | No OpenAPI/Swagger specification found |
| Developer portal | Did not apply, 0 of 6 | No developer portal found |
| OAuth 2.0 support | Pass, 5 of 5 | OpenID Connect discovery endpoint found at https://login.jnj.com |
| Scoped permissions | Did not apply, 0 of 5 | No declared OAuth scopes, security schemes, or scoped-permission documentation found |
| Multi-language SDK packages | Did not apply, 0 of 3 | No SDK packages found across language ecosystems |
| CLI tool available | Did not apply, 0 of 3 | No CLI tool found |
| WebMCP support | Fail, 0 of 5 | No WebMCP support detected - no tool-attribute forms and no document.modelContext / navigator.modelContext usage found |
| Check | Result | What Ora saw |
|---|---|---|
| Wikipedia / Wikidata entity presence | Fail, 0 of 4 | No Wikipedia article or Wikidata entity found for "jnj" - creating a Wikipedia page and a Wikidata item with P856 = jnj.com is the highest-impact step for AI search citation coverage |
| Brand name discoverability | Fail, 0 of 3 | "jnj" search returned 10 results but domain did not appear - brand may be too generic or not indexed |
| Category share of voice | Did not apply, 0 of 6 | Category share of voice is in beta. It measures whether agents surface you for capability and use-case searches (not just your name). |
| Developer resource discoverability | Fail, 0 of 3 | Agent searched for "jnj" developer resources but found nothing relevant |
The six payment checks did not apply on this read: Ora did not read the site as a shop.
Three fixes to hand to the web team
Ora estimates how many points each open check would return. These are the largest on this read, in Ora's words where it gave them, so a leader can hand the list over without translating it.
- Developer resource discoverability, worth about 9.5 points by Ora's estimate: Agent searched for "jnj" developer resources but found nothing relevant.
- Brand name discoverability, worth about 9.5 points by Ora's estimate: "jnj" search returned 10 results but domain did not appear - brand may be too generic or not indexed.
- MCP server / manifest, worth about 8.1 points by Ora's estimate: No MCP server or manifest found.
Our read
Johnson & Johnson's 16 is two problems stacked. The first is the door: bot management challenged GPTBot, ClaudeBot, ChatGPT-User, PerplexityBot and Applebot-Extended, robots.txt answered with a 403 challenge and the home page came back as a security page, so the door, content, policy, structured-data and metadata rows are unverified rather than failed, and the Access layer reads 0 of 41; there is no sitemap and no llms.txt. The second is the name: the domain is jnj.com, so the probe searched for jnj, found ten results without the domain and no Wikipedia article or Wikidata item for that string, and the Discovery layer reads 0 of 7, which describes the domain more than the company. The act layer has one real surface, OpenID Connect discovery at login.jnj.com, beside a GraphQL endpoint with introspection gated, and no developer portal, OpenAPI specification or MCP server, so the Usability layer reads 12 of 33. A sameAs link from an Organization block would fix the second problem; only the shield can fix the first.
Test your own site
Run the same scan on your own domain at ora.ai. The score, the layers and the fixes on this page come from its public result for jnj.com; a scan of a public site takes a few minutes and needs no account.
- Scan your domain on OraThe same checks, the same scoring, on your own site.
- The self-check, 18 questionsWhat to ask for, in business terms, before the scan.
- All the 360 checksThe other companies in this series, newest first.
Sources
- Ora report for jnj.com (ora.ai/score/jnj.com), read 9 Nov 2026. Vendor claim.
Last reviewed