What Hunch is
Hunch is a research instrument. It answers one question about a store, can an AI shopping agent reach it, and it gives people who build shopping agents a store to test them against. Nothing here is for sale and nothing is bought.
Two halves
The check. Type in a store domain on the front page and Hunch runs the six read-only probes the Major Matters merchant-readiness index runs weekly on the largest US retailers: robots.txt and what it tells 14 named AI agents, whether the homepage is readable without a browser, JSON-LD structured data, llms.txt, a UCP profile and an A2A agent card. You get a score, the evidence, and what to fix first. Your result is shown to you and to nobody else.
The playground. A reference store that is consistent everywhere an agent might look, ten traps built wrong on purpose with a published answer key, a mock checkout that enforces a spending mandate, and a run record with a report card that shows what an agent actually did.
Who makes it
Hunch is made by Major Labs, an independent research studio for the agentic web. It grew out of the method behind the merchant-readiness index published by Major Matters, a publication on payments, AI and commerce. The studio ships open-source agent-safety primitives and public research; Hunch is one of its instruments. It is not a commercial service and there is no price list.
The read-only promise
- Six GET requests per check, to
/robots.txt,/llms.txt,/.well-known/ucp,/.well-known/agent-card.json,/.well-known/agent.jsonand the homepage. Each times out after eight seconds. - An honest user agent. Every request identifies itself as
MajorLabsReadinessScan/0.2 (+https://shophunch.com/about; independent research; read-only, six requests per check). Hunch never pretends to be a browser or another company's crawler. - No retries after a refusal. A 403, a bot challenge or a timeout is recorded as the answer. Hunch does not try again, change its user agent or attempt to solve a challenge.
- Nothing is logged in, submitted, carted or bought. The check only reads.
- No storage of check results. The report is built in the request and returned to you. It is not saved and no per-store result is published anywhere. The only thing the check writes is a per-address counter (the address is hashed) so that one address gets at most 30 checks an hour; the instrument is not a crawler and cannot be used as one.
- Private hosts are never fetched. Loopback, link-local, private network ranges and names such as
.internalor.localare refused before any request is made.
Run records
A run record exists only if someone starts one with POST /api/run. It holds request metadata (which trap page or API path was fetched, when, and the user agent string) and the bodies of mock orders sent to /api/checkout: SKU, quantity, mandate and the mock order that came back. No payment runs and no personal data is asked for. Records are readable by anyone who has the run id, are kept for about a week, and are excluded from search engines by robots.txt and a noindex header.
To have a run record deleted, email hello@majorlabs.co with the run id (it starts with r_). It will be removed and you will get a one-line confirmation.
A note on robots.txt
The check reads a store's robots.txt but does not need permission from it: it makes six requests to public files that any visitor can open, under a user agent that names this page. If a store would rather not be checked at all, add a rule for the user agent token MajorLabsReadinessScan and the next check of that store will record the refusal as its answer, not work around it:
User-agent: MajorLabsReadinessScan Disallow: /
The playground's own robots.txt works the other way: it welcomes agents in and forbids exactly one path, /traps/robots-block/, so a run record can show whether an agent read the rules before it read the pages.
Questions
Write to hello@majorlabs.co. Source references for the method are on the index page.