---
title: "GSK: the 360 check | Agent Ready Checklist"
description: "GSK on Ora's agent-readiness scan, read 2026-11-09: 59 of 100, grade C. 5 of 22 checklist rows met, 9 not met. One company a day."
canonical: https://agentreadychecklist.com/blog/gsk-agent-readiness
site: "Agent Ready Checklist"
last_updated: 2026-11-09
date: 2026-11-09
section: "360 checks"
---

# GSK: the 360 check | Agent Ready Checklist

> GSK on Ora's agent-readiness scan, read 2026-11-09: 59 of 100, grade C. 5 of 22 checklist rows met, 9 not met. One company a day.

Source: https://agentreadychecklist.com/blog/gsk-agent-readiness
Site: Agent Ready Checklist
Last reviewed: 2026-11-09
Agent endpoints: https://agentreadychecklist.com/llms.txt (index), https://agentreadychecklist.com/openapi.json (API), https://agentreadychecklist.com/mcp (MCP server), https://agentreadychecklist.com/ask (search)
Access: https://agentreadychecklist.com/auth.md (no key). Pricing: https://agentreadychecklist.com/pricing.md (free).

# GSK against the checklist: the 360 agent-readiness check

360 check, 9 November 2026. GSK is the British pharmaceuticals and vaccines group.

GSK scores 59 of 100 on Ora's agent-readiness scan, a C, read 9 November 2026. At the door, site accessible to 6 AI agent user-agents. 5 of the 22 checklist rows with an Ora check are met. The best home page in the batch, with two agent files that do not parse.

On 9 November 2026 the public site at gsk.com scored **59 of 100** on [Ora's](https://ora.ai/?utm_source=agentreadychecklist.com&utm_medium=referral&utm_campaign=check) agent-readiness scan, a C. Ora probes a site the way an agent would: it requests pages with the agents' own user agents, reads robots.txt, looks for the files agents read, and tries the API, MCP and payment surfaces. Below, each of the 31 checklist rows is read against the Ora checks the [crosswalk](https://agentreadychecklist.com/checklist/ora-checks/) names for it, so the result says which requirements this company meets, not only how many points it scored. Ora's one-line summary: GSK has a sitemap, but lacks an OpenAPI specification.

## The score

| Layer | Points | Share | What the layer asks |
| --- | --- | --- | --- |
| Discovery | 9 of 13 | 69% | Can agents find and recommend it |
| Access | 30 of 54 | 56% | Can agents read it |
| Usability | 27 of 48 | 56% | Can agents use it |
| Payments | 0 of 0 | none apply | Can agents pay |
| Total | 59 of 100 | 59% | Grade C |

## Row by row

A row is met when every Ora check the crosswalk names for it passes, not met when every one fails, and partly when the checks disagree or one is partial. A row with no Ora check in the catalogue, or whose checks did not apply to this site, is marked as such; the [Verify Kit](https://agentreadychecklist.com/kit/) tests those by hand.

| Row | Level | Result | Ora checks, and what Ora saw |
| --- | --- | --- | --- |
| AR-FIND-01; Do not block agents | MUST | Partly | robots.txt AI crawler policy (partial), robots.txt agent-user policy (pass), Agent crawler reachability (pass), Not blocked by bot detection (pass).; robots.txt allows all crawlers (e.g. `User-agent: *` + `Allow: /`) - open by default but declares no AI-crawler tier differentiation |
| AR-FIND-02; Answers on one first-party page | SHOULD | No Ora check | No check in Ora's catalogue names this row. |
| AR-FIND-03; Sitemap listed in robots.txt | SHOULD | Met | Sitemap exists (pass).; Valid sitemap found at https://www.gsk.com/sitemap.xml with 2040 entries |
| AR-FIND-04; AI Catalog at .well-known | MAY | Partly | AI Catalog discovery (partial), ARD discovery (partial).; /.well-known/ai-catalog.json exists but is not valid JSON |
| AR-READ-01; Answer in the initial HTML | MUST | Met | Content without JavaScript (pass).; 2476 chars, semantic headings (1 H1 + 3 H2s + 11 H3s), 8.5% content ratio |
| AR-READ-02; Real HTTP status codes | MUST | Met | Redirect hygiene (pass).; Redirect hygiene: pass, 1 of 1. |
| AR-READ-03; Home page with real links | SHOULD | Not met | Public API/docs linked from homepage (fail).; No public API or documentation page linked from homepage |
| AR-READ-04; Docs that answer agent tasks | SHOULD | No Ora check | No check in Ora's catalogue names this row. |
| AR-READ-05; Fenced, language-tagged code | SHOULD | No Ora check | Code fence validity (not applicable). |
| AR-READ-06; Link the discovery files | SHOULD | No Ora check | No check in Ora's catalogue names this row. |
| AR-READ-07; Ship llms.txt | SHOULD | Partly | llms.txt exists (partial), llms.txt formatting (fail), llms.txt links resolve (not applicable).; A file is present at https://gsk.com/.well-known/llms.txt, but it returns an HTML page rather than a plain-text llms.txt. |
| AR-READ-08; JSON-LD on key pages | SHOULD | Partly | JSON-LD structured data (partial).; JSON-LD found (1 block(s)) but no identity type - use SoftwareApplication, Product, Organization, Person, or Article so agents can tell what this site is |
| AR-READ-09; Advertise a markdown mirror | MAY | Not met | Markdown alternate link (fail).; No sampled page advertises a markdown alternate. Add <link rel="alternate" type="text/markdown" href="..."> (or the equivalent Link response header) pointing at a markdown twin of the page. |
| AR-READ-11; Pricing as first-party HTML | SHOULD | Met | Pricing info accessible (pass).; Pricing info accessible: pass, 3 of 3. |
| AR-ACT-01; Auth an agent can finish | SHOULD | Met | OAuth 2.0 support (pass), Scoped permissions (not applicable).; OpenID Connect discovery endpoint found at https://gsk.com |
| AR-ACT-02; OpenAPI contract | SHOULD | Not met | OpenAPI spec published (fail).; No OpenAPI/Swagger specification found |
| AR-ACT-03; MCP over Streamable HTTP | SHOULD | Partly | MCP server / manifest (partial), Listed in MCP registries (not applicable), MCP PKCE S256 support (not applicable), MCP OAuth metadata (not applicable).; MCP endpoint found at /.well-known/mcp/manifest.json but response is not valid JSON |
| AR-ACT-04; MCP server card | MAY | Partly | MCP server-card.json (partial).; https://gsk.com/.well-known/mcp/server-card.json exists but body is not valid JSON |
| AR-ACT-05; MCP Apps view | MAY | No Ora check | MCP Apps support (not applicable). |
| AR-ACT-06; SDKs and a CLI | SHOULD | No Ora check | CLI tool available (not applicable), Multi-language SDK packages (not applicable), NPM/PyPI SDK package (not applicable). |
| AR-ACT-07; WebMCP tools | SHOULD | Not met | WebMCP support (fail).; No WebMCP support detected - no tool-attribute forms and no document.modelContext / navigator.modelContext usage found (scanned 1 of 1 same-origin script bundle(s) for modelContext registrations) |
| AR-ACT-08; Agent payments | MAY | No Ora check | x402 payment protocol (not applicable), MPP payment protocol (not applicable), UCP - Universal Commerce Protocol (not applicable), ACP - Agentic Commerce Protocol (not applicable), ACP delegate payment (not applicable). |
| AR-ACT-09; NLWeb /ask endpoint | MAY | Not met | NLWeb /ask endpoint (fail).; No NLWeb-conformant /ask endpoint found via GET or POST |
| AR-ACT-10; An MCP server or a CLI | MUST | Partly | MCP server / manifest (partial), CLI tool available (not applicable).; MCP endpoint found at /.well-known/mcp/manifest.json but response is not valid JSON |
| CF-CONTENT-SIGNALS; Content-Signal line | cloudflare | No Ora check | No check in Ora's catalogue names this row. |
| CF-MARKDOWN-NEGOTIATION; Markdown by Accept | cloudflare | Not met | Markdown content negotiation (acceptmarkdown.com) (fail), Markdown agent docs (fail).; Not acceptmarkdown.com compliant: Accept: text/markdown returned text/html; Vary header missing Accept (got "accept-encoding") |
| CF-PAY-PER-CRAWL; Pay per crawl, HTTP 402 | cloudflare | No Ora check | No check in Ora's catalogue names this row. |
| CF-OAUTH-DISCOVERY; OAuth discovery files | cloudflare | Not met | OAuth Protected Resource metadata (RFC 9728) (fail).; No /.well-known/oauth-protected-resource found (RFC 9728) |
| CF-AGENT-SKILLS; Agent Skills index | cloudflare | Not met | Agent Skills index conformance (v0.2.0) (fail).; /.well-known/agent-skills/index.json is not valid JSON |
| VERCEL-NEGOTIATION-HEADERS; Markdown headers | vercel | Not met | Markdown content negotiation (acceptmarkdown.com) (fail).; Not acceptmarkdown.com compliant: Accept: text/markdown returned text/html; Vary header missing Accept (got "accept-encoding") |
| VERCEL-ROBOTS-EXCLUSIONS; Robots exclusions | vercel | Partly | robots.txt AI crawler policy (partial), robots.txt agent-user policy (pass).; robots.txt allows all crawlers (e.g. `User-agent: *` + `Allow: /`) - open by default but declares no AI-crawler tier differentiation |

## The fixes worth most points

Ora attaches an estimate to each failing or partial check: how many points the site would gain by passing it. These are the 5 with the largest estimates for GSK, each tied to the checklist row whose recipes cover it.

Public API with reachable endpoints

Fail, 0 of 7, about 6.5 points to gain. Ora saw: No publicly reachable API surface detected (REST and GraphQL both absent or auth-gated). No checklist row names this check.

WebMCP support

Fail, 0 of 5, about 4.6 points to gain. Ora saw: No WebMCP support detected - no tool-attribute forms and no document.modelContext / navigator.modelContext usage found (scanned 1 of 1 same-origin script bundle(s) for modelContext registrations). Row [AR-ACT-07](https://agentreadychecklist.com/checklist/ar-act-07/), WebMCP tools.

OpenAPI spec published

Fail, 0 of 7, about 4.3 points to gain. Ora saw: No OpenAPI/Swagger specification found. Row [AR-ACT-02](https://agentreadychecklist.com/checklist/ar-act-02/), OpenAPI contract.

MCP server / manifest

Partial, 2 of 6, about 3.7 points to gain. Ora saw: MCP endpoint found at /.well-known/mcp/manifest.json but response is not valid JSON. Row [AR-ACT-03](https://agentreadychecklist.com/checklist/ar-act-03/), MCP over Streamable HTTP.

Developer resource discoverability

Partial, 1 of 3, about 3.4 points to gain. Ora saw: Name search surfaced no pages on gsk.com, although developer resources exist on the site (MCP server) - weak search indexing or transient search noise. No checklist row names this check.

## Our read

GSK has the best home page in this batch and a half-built agent layer behind it. The page gives 2,476 characters at an 8.5 percent content ratio with a clean heading tree, one H1, three H2s and eleven H3s, which is the content row met as the checklist means it. Every AI crawler Ora tested reached the site, robots.txt allows all crawlers with a plain wildcard, five of five sampled pages read without a login, and the sitemap lists 2,040 pages. The agent files are where it gets odd: an llms.txt at /.well-known/llms.txt returns an HTML page, and an MCP manifest sits at /.well-known/mcp/manifest.json but does not parse as JSON, so Ora scores it partial. An OpenID Connect discovery endpoint is published. Someone at GSK has read the specifications; the two files only need to be served as what they claim to be.

## Verify your own site

The scan above is free and needs no account: enter a domain at [ora.ai](https://ora.ai/?utm_source=agentreadychecklist.com&utm_medium=referral&utm_campaign=check) and read the same four layers for your own site, then take each failing row to its recipe on this site. The command below runs the same audit from a terminal and exits with 1 under the score you set, so it can gate a deploy. Payments did not apply to this company; a site that sells is read on that layer too. [Why Ora, and its limits](https://agentreadychecklist.com/verify-with-ora/).

```bash
npx ax@0.10 audit https://example.com --min-score 70
```

[All 360 checks](https://agentreadychecklist.com/blog/), one company a day. Corrections to [the corrections page](https://agentreadychecklist.com/corrections/).

## Sources

-   [ora.ai/api/score/gsk.com, Ora's scan (vendor)](https://ora.ai/api/score/gsk.com?utm_source=agentreadychecklist.com&utm_medium=referral&utm_campaign=check)read 2026-11-09
-   [ora.ai/api/checks, contract 1.38.0 (vendor)](https://ora.ai/api/checks?utm_source=agentreadychecklist.com&utm_medium=referral&utm_campaign=check)read 2026-11-05
-   [gsk.com, the company's site](https://www.gsk.com/en-gb/)read 2026-11-09

Edition

Data

2026-11-04

Reviewed

2026-11-05

Spec

AgentReady v2.0, 273d2d7

Crawl

13,071 rows, 2026-11-04

Ora

132 checks, contract 1.38.0, 2026-11-05

Verify with Ora

The scanner this site recommends for the whole checklist. 132 checks, a score out of 100, no account.

`npx ax@0.10 audit <url> --min-score <n>`

[Why Ora, and its limits](https://agentreadychecklist.com/verify-with-ora/)

Method

-   [How rows, commands and rates are made](https://agentreadychecklist.com/method/)
-   [How an Ora check is matched to a row](https://agentreadychecklist.com/checklist/ora-checks/)
-   [Pass rates by rank band](https://agentreadychecklist.com/data/by-rank/)

Sources and read dates sit at the foot of the page.

Last reviewed 2026-11-09. AgentReady v2.0, read 2026-11-04.