Loading
Six organizations, scanned for AI agents
Two banks, a credit union, an airline, a wireless carrier and a health plan scored between 23 and 47 out of 100. The scan found no MCP server at any of them.
Analysis, October 1, 2026, 5 minute read. By Encore AI.
We scanned the public websites of six organizations on October 1, 2026. Each scan opens the home page and the sign in page the way an agent would, reads the files a site publishes for machines, and runs 23 checks across five areas. The phone line is the sixth area. It is not in these scores yet.
These scores are from October 1 and sit on the original scale, before the calibration curve that the Method page now describes. Every report shows its current score.
| points | |
|---|---|
| Navy Federal Credit Union | 47 |
| Kaiser Permanente | 47 |
| Ally Bank | 35 |
| T Mobile | 32 |
| JPMorgan Chase | 31 |
| Delta Air Lines | 23 |
What the scores show
Navy Federal Credit Union and Kaiser Permanente lead with 47 each. Delta Air Lines is last with 23. Four of the six reach level 2, which means an agent can read the site. Delta Air Lines reaches level 1 and T Mobile level 0. None reaches level 3, which needs a way for an agent to connect and not only read.
What all six have in common
- No MCP server, agent card or browser tool for agents was found.
- Bot management software was detected on every site. Five use Akamai. Kaiser Permanente uses F5 Shape.
- Five publish robots.txt rules that restrict some of the agents that act on a user's request. The T Mobile robots.txt returned an error to the scanner.
0 of 6 organizations with a published MCP server. An agent that wants a structured connection has nothing to connect to yet.
Where they differ
Navy Federal Credit Union is the only one with a developer program. Its API Exchange at developer.navyfederal.org describes a data sharing program, and the site also publishes an llms.txt file.
Kaiser Permanente has the highest identity and delegation score of the six, 70 out of 100. It publishes OAuth metadata with PKCE and a high assurance profile. It has no llms.txt file and no public page on delegate access. Its terms could not be read for a declared agent, so its policy area is left out of the score.
T Mobile answered the scanner's home page request with a 403 error. A standard browser loaded the page. An agent that says who it is was treated worse than an anonymous visitor, which puts T Mobile at level 0. The same block hid robots.txt, llms.txt and the sitemap, so those checks are left out of the score and are not counted as failures. The site does publish OAuth metadata, and its sign in page uses passkeys.
Ally Bank has the best web experience of the six, 100 out of 100. Its sign in fields are labeled and its llms.txt file lists 49 links. It has no developer program.
JPMorgan Chase publishes no llms.txt file, and its Terms of Use name AI agents as unauthorized. T Mobile has a similar line. The next article covers both.
Delta Air Lines sends a home page with almost no text in the first response. 2,944 characters appear only after scripts run. An agent that does not run scripts sees an empty page.
What the scan cannot see
Between 8 and 11 hosts did not answer the scanner at each organization. Authorization servers often sit on those hosts, so a missing OAuth result means none was found on the hosts that answered. A passkey prompt that starts only after a customer types a user name is also invisible to a page load. Each report states these limits next to the finding.
The scan never types into a sign in form and never tries to authenticate. It records what the page offers to a declared agent, which is the first thing a customer’s agent would meet.
What comes next
The phone line is worth 20 of the 100 points. Each organization that publishes a customer service number on its own site gets six recorded test calls. The recordings, transcripts and scores will appear on its report. The scan found no published number for Kaiser Permanente.