--- title: "SAP: the 360 check | Agent Ready Checklist" description: "SAP on Ora's agent-readiness scan, read 2026-11-09: 52 of 100, grade C. 3 of 19 checklist rows met, 8 not met. One company a day." canonical: https://agentreadychecklist.com/blog/sap-agent-readiness site: "Agent Ready Checklist" last_updated: 2026-11-09 date: 2026-11-09 section: "360 checks" --- # SAP: the 360 check | Agent Ready Checklist > SAP on Ora's agent-readiness scan, read 2026-11-09: 52 of 100, grade C. 3 of 19 checklist rows met, 8 not met. One company a day. Source: https://agentreadychecklist.com/blog/sap-agent-readiness Site: Agent Ready Checklist Last reviewed: 2026-11-09 Agent endpoints: https://agentreadychecklist.com/llms.txt (index), https://agentreadychecklist.com/openapi.json (API), https://agentreadychecklist.com/mcp (MCP server), https://agentreadychecklist.com/ask (search) Access: https://agentreadychecklist.com/auth.md (no key). Pricing: https://agentreadychecklist.com/pricing.md (free). # SAP against the checklist: the 360 agent-readiness check 360 check, 9 November 2026. SAP is Europe's largest software company. SAP scores 52 of 100 on Ora's agent-readiness scan, a C, read 9 November 2026. At the door, bot management challenged GPTBot, ClaudeBot, ChatGPT-User, PerplexityBot, Applebot-Extended. 3 of the 19 checklist rows with an Ora check are met. The richest act layer in the set, behind a door that challenges the agents. On 9 November 2026 the public site at sap.com scored **52 of 100** on [Ora's](https://ora.ai/?utm_source=agentreadychecklist.com&utm_medium=referral&utm_campaign=check) agent-readiness scan, a C, in Ora's Infrastructure category. Ora probes a site the way an agent would: it requests pages with the agents' own user agents, reads robots.txt, looks for the files agents read, and tries the API, MCP and payment surfaces. Below, each of the 31 checklist rows is read against the Ora checks the [crosswalk](https://agentreadychecklist.com/checklist/ora-checks/) names for it, so the result says which requirements this company meets, not only how many points it scored. Ora's one-line summary: SAP provides developer resources, but lacks an OpenAPI specification. ## The score | Layer | Points | Share | What the layer asks | | --- | --- | --- | --- | | Discovery | 9 of 12 | 75% | Can agents find and recommend it | | Access | 22 of 50 | 44% | Can agents read it | | Usability | 27 of 58 | 47% | Can agents use it | | Payments | 0 of 0 | none apply | Can agents pay | | Total | 52 of 100 | 52% | Grade C | ## Row by row A row is met when every Ora check the crosswalk names for it passes, not met when every one fails, and partly when the checks disagree or one is partial. A row with no Ora check in the catalogue, or whose checks did not apply to this site, is marked as such; the [Verify Kit](https://agentreadychecklist.com/kit/) tests those by hand. | Row | Level | Result | Ora checks, and what Ora saw | | --- | --- | --- | --- | | AR-FIND-01; Do not block agents | MUST | Partly | robots.txt AI crawler policy (pass), robots.txt agent-user policy (pass), Agent crawler reachability (partial), Not blocked by bot detection (partial).; Training: 2/2. Search: 3/3 page/crawler pairs permitted. No applicable crawl or usage restriction found for 5 training and search crawlers (gptbot, claudebot, oai-searchbot, claude-searchbot, | | AR-FIND-02; Answers on one first-party page | SHOULD | No Ora check | No check in Ora's catalogue names this row. | | AR-FIND-03; Sitemap listed in robots.txt | SHOULD | Not met | Sitemap exists (fail).; No sitemap found | | AR-FIND-04; AI Catalog at .well-known | MAY | Not met | AI Catalog discovery (not applicable), ARD discovery (fail).; No /.well-known/ard.json (and no legacy /.well-known/ai-catalog.json) | | AR-READ-01; Answer in the initial HTML | MUST | Partly | Content without JavaScript (partial).; Homepage blocked by WAF/security challenge - content not accessible to agents | | AR-READ-02; Real HTTP status codes | MUST | No Ora check | Redirect hygiene (not applicable). | | AR-READ-03; Home page with real links | SHOULD | Met | Public API/docs linked from homepage (pass).; Documentation site found at https://developers.sap.com | | AR-READ-04; Docs that answer agent tasks | SHOULD | No Ora check | No check in Ora's catalogue names this row. | | AR-READ-05; Fenced, language-tagged code | SHOULD | No Ora check | Code fence validity (not applicable). | | AR-READ-06; Link the discovery files | SHOULD | No Ora check | No check in Ora's catalogue names this row. | | AR-READ-07; Ship llms.txt | SHOULD | Partly | llms.txt exists (pass), llms.txt formatting (partial), llms.txt links resolve (not applicable).; Found the llms.txt at https://developers.sap.com/llms.txt. | | AR-READ-08; JSON-LD on key pages | SHOULD | Partly | JSON-LD structured data (partial).; JSON-LD Organization found - missing description on this entity | | AR-READ-09; Advertise a markdown mirror | MAY | No Ora check | Markdown alternate link (not applicable). | | AR-READ-11; Pricing as first-party HTML | SHOULD | No Ora check | Pricing info accessible (not applicable). | | AR-ACT-01; Auth an agent can finish | SHOULD | Partly | OAuth 2.0 support (pass), Scoped permissions (partial).; OpenID Connect discovery endpoint found at https://accounts.sap.com | | AR-ACT-02; OpenAPI contract | SHOULD | Not met | OpenAPI spec published (fail).; No OpenAPI/Swagger specification found | | AR-ACT-03; MCP over Streamable HTTP | SHOULD | Partly | MCP server / manifest (partial), Listed in MCP registries (not applicable), MCP PKCE S256 support (not applicable), MCP OAuth metadata (not applicable).; First-party MCP server published by product org (npm, @sap-ux/fiori-mcp-server, 12988 score). Add live handshake at /.well-known/mcp for full credit. | | AR-ACT-04; MCP server card | MAY | Not met | MCP server-card.json (fail).; No MCP server card found (checked /.well-known/mcp/server-card.json, the site's ai-catalog.json, servers[].card in mcp.json, and /server-card) | | AR-ACT-05; MCP Apps view | MAY | No Ora check | MCP Apps support (not applicable). | | AR-ACT-06; SDKs and a CLI | SHOULD | Partly | CLI tool available (pass), Multi-language SDK packages (partial), NPM/PyPI SDK package (pass).; CLI package found on npm: hana-cli | | AR-ACT-07; WebMCP tools | SHOULD | Not met | WebMCP support (fail).; No WebMCP support detected - no tool-attribute forms and no document.modelContext / navigator.modelContext usage found | | AR-ACT-08; Agent payments | MAY | No Ora check | x402 payment protocol (not applicable), MPP payment protocol (not applicable), UCP - Universal Commerce Protocol (not applicable), ACP - Agentic Commerce Protocol (not applicable), ACP delegate payment (not applicable). | | AR-ACT-09; NLWeb /ask endpoint | MAY | Met | NLWeb /ask endpoint (pass).; NLWeb /ask endpoint exists but requires authentication (HTTP 403, via GET) | | AR-ACT-10; An MCP server or a CLI | MUST | Partly | MCP server / manifest (partial), CLI tool available (pass).; First-party MCP server published by product org (npm, @sap-ux/fiori-mcp-server, 12988 score). Add live handshake at /.well-known/mcp for full credit. | | CF-CONTENT-SIGNALS; Content-Signal line | cloudflare | No Ora check | No check in Ora's catalogue names this row. | | CF-MARKDOWN-NEGOTIATION; Markdown by Accept | cloudflare | Not met | Markdown content negotiation (acceptmarkdown.com) (fail), Markdown agent docs (fail).; Homepage https://sap.com does not meet the Markdown negotiation requirements: Accept: text/markdown returned text/html; Vary header missing Accept (got "none") | | CF-PAY-PER-CRAWL; Pay per crawl, HTTP 402 | cloudflare | No Ora check | No check in Ora's catalogue names this row. | | CF-OAUTH-DISCOVERY; OAuth discovery files | cloudflare | Not met | OAuth Protected Resource metadata (RFC 9728) (fail).; No /.well-known/oauth-protected-resource found (RFC 9728) | | CF-AGENT-SKILLS; Agent Skills index | cloudflare | No Ora check | Agent Skills index conformance (v0.2.0) (not applicable). | | VERCEL-NEGOTIATION-HEADERS; Markdown headers | vercel | Not met | Markdown content negotiation (acceptmarkdown.com) (fail).; Homepage https://sap.com does not meet the Markdown negotiation requirements: Accept: text/markdown returned text/html; Vary header missing Accept (got "none") | | VERCEL-ROBOTS-EXCLUSIONS; Robots exclusions | vercel | Met | robots.txt AI crawler policy (pass), robots.txt agent-user policy (pass).; Training: 2/2. Search: 3/3 page/crawler pairs permitted. No applicable crawl or usage restriction found for 5 training and search crawlers (gptbot, claudebot, oai-searchbot, claude-searchbot, | ## The fixes worth most points Ora attaches an estimate to each failing or partial check: how many points the site would gain by passing it. These are the 5 with the largest estimates for SAP, each tied to the checklist row whose recipes cover it. OpenAPI spec published Fail, 0 of 7, about 4.7 points to gain. Ora saw: No OpenAPI/Swagger specification found. Row [AR-ACT-02](https://agentreadychecklist.com/checklist/ar-act-02/), OpenAPI contract. WebMCP support Fail, 0 of 5, about 3.8 points to gain. Ora saw: No WebMCP support detected - no tool-attribute forms and no document.modelContext / navigator.modelContext usage found. Row [AR-ACT-07](https://agentreadychecklist.com/checklist/ar-act-07/), WebMCP tools. Brand name discoverability Partial, 1 of 3, about 3.7 points to gain. Ora saw: sap.com ranks #7 for "sap" (searched your brand name alone: we could not read a product term from your site). No checklist row names this check. JSON error responses Fail, 0 of 4, about 3.1 points to gain. Ora saw: API does not return JSON error responses (or no API detected). No checklist row names this check. GraphQL typed error model Fail, 0 of 3, about 2.3 points to gain. Ora saw: GraphQL introspection auth-gated and no typed graphql error model documentation found on GraphQL-tagged pages. No checklist row names this check. ## Our read SAP is the richest act layer in this set and one of the worst doors. developers.sap.com is a real portal with an llms.txt at developers.sap.com/llms.txt, SDKs on npm and a hana-cli package, an OpenID Connect discovery endpoint at accounts.sap.com, and a first-party MCP server package on npm, @sap-ux/fiori-mcp-server, that Ora credits without a live handshake; the one gap on that layer is an OpenAPI specification for what the portal documents. Then the home page: bot management challenged GPTBot, ClaudeBot, ChatGPT-User, PerplexityBot and Applebot-Extended, while robots.txt allows every training and search crawler Ora checked, so sap.com could not be read, its content could not be scored and there is no sitemap to follow. Europe's largest software company has built the agent surfaces and parked them behind a challenge page. The checklist's door rows come first for exactly this case. ## Verify your own site The scan above is free and needs no account: enter a domain at [ora.ai](https://ora.ai/?utm_source=agentreadychecklist.com&utm_medium=referral&utm_campaign=check) and read the same four layers for your own site, then take each failing row to its recipe on this site. The command below runs the same audit from a terminal and exits with 1 under the score you set, so it can gate a deploy. Payments did not apply to this company; a site that sells is read on that layer too. [Why Ora, and its limits](https://agentreadychecklist.com/verify-with-ora/). ```bash npx ax@0.10 audit https://example.com --min-score 70 ``` [All 360 checks](https://agentreadychecklist.com/blog/), one company a day. Corrections to [the corrections page](https://agentreadychecklist.com/corrections/). ## Sources - [ora.ai/api/score/sap.com, Ora's scan (vendor)](https://ora.ai/api/score/sap.com?utm_source=agentreadychecklist.com&utm_medium=referral&utm_campaign=check)read 2026-11-09 - [ora.ai/api/checks, contract 1.38.0 (vendor)](https://ora.ai/api/checks?utm_source=agentreadychecklist.com&utm_medium=referral&utm_campaign=check)read 2026-11-05 - [sap.com, the company's site](https://www.sap.com/)read 2026-11-09 Edition Data 2026-11-04 Reviewed 2026-11-05 Spec AgentReady v2.0, 273d2d7 Crawl 13,071 rows, 2026-11-04 Ora 132 checks, contract 1.38.0, 2026-11-05 Verify with Ora The scanner this site recommends for the whole checklist. 132 checks, a score out of 100, no account. `npx ax@0.10 audit --min-score ` [Why Ora, and its limits](https://agentreadychecklist.com/verify-with-ora/) Method - [How rows, commands and rates are made](https://agentreadychecklist.com/method/) - [How an Ora check is matched to a row](https://agentreadychecklist.com/checklist/ora-checks/) - [Pass rates by rank band](https://agentreadychecklist.com/data/by-rank/) Sources and read dates sit at the foot of the page. Last reviewed 2026-11-09. AgentReady v2.0, read 2026-11-04.