Gaps. Discovery works, but trust does not.

Walmart scores 39 out of 100, which lands squarely in the Gaps band, and the diagnosis is almost comic in its clarity: the world's largest retailer welcomes every AI crawler by name in robots.txt, then serves them a PerimeterX challenge page the moment they arrive. This is a company that has done the diplomatic work of agent readiness while forgetting the mechanical work. GPTBot, ClaudeBot, PerplexityBot, and Amazonbot are all explicitly allowed, and every single one of them would hit a wall on 14 of 32 fetched URLs, a 44 percent block rate. You cannot invite guests in through the front door and then station a bouncer in the foyer.

The bot detection posture is the single most expensive failure, zeroing out a six-point check and cascading into the CAPTCHA check (another zero out of four) because PerimeterX gates the homepage, the cart, and the checkout. For an agent trying to transact, this is not friction, it is a full stop. Combined with the guest checkout finding, where the classifier saw only "Sign in or create account" on the cart page and no guest path, Walmart has effectively told autonomous buyers that this store is not open for their business. That is eight points lost to hostility and four more to a login wall.

The second consequential failure is structural: zero out of nine sampled category pages carry Product or Offer schema, and only one of nine surfaces a price in raw HTML (the rest depend on client-side rendering that agents without headless browsers will never see). This is an eight-point loss on price-in-HTML and a six-point loss on structured product data. The evidence is unambiguous. On /cp/agco-ignition-parts/4394062 and six similar URLs, the raw HTML contains nothing but a "Cart contains 0 items Total Amount $0.00" header string. Prices exist, but they exist for browsers, not for machines. Attribute coverage is similarly thin: across nine URLs, zero had two structured attributes, and the "labeled" hits maxed out at brand, color, and material scraped from visible text.

Price transparency compounds the transactability problem. The classifier found no shipping or tax visible pre-authentication on the cart page, costing another four points, and delivery date transparency scored zero despite Walmart clearly having the data (the samples show "arrives Tue, Jul 14" and "Delivery as soon as 13 mins" as visible text, just never wrapped in schema.org/shippingDetails). This is data Walmart already owns, already displays, and simply refuses to structure.

Sitemap freshness is a smaller but telling wound: the category sitemap's most recent lastmod is 2026-04-16, which is either a typo or a signal that nobody is minding the file, and the check flags it as stale by 30 days. And the stated agent policy is silent, another two points forfeited for lack of a public position.

What Walmart does well is almost incidental: return policy is exemplary (full three points, with a machine-readable 90-day window and per-category exceptions), PayPal is present across cart and checkout, and there are no dark patterns. But these are the trust-signal outskirts of a site whose core commerce surfaces are structurally opaque and behaviorally hostile.

The biggest opportunity is unambiguous: turn off PerimeterX for the crawlers already whitelisted in robots.txt, or the welcome mat is a lie.