New checks added today:

UGC prompt injection — scans your reviews and comments for hidden text that could hijack an AI agent reading your page (e.g. "ignore previous instructions" buried in a review)

Cart API rate limiting — hits your /cart/add.js 5 times rapidly to see if anything stops an agent from squatting your inventory at scale

Checkout bot challenge — checks if your checkout has any CAPTCHA or bot detection, or if agents can automate purchases unchecked

Admin path exposure — probes /admin, /staff, /.env, /api to see if internal paths are accessible without auth

Also added 8 protocol discovery checks (MCP, OAuth, A2A, Markdown negotiation, Agent Skills, x402 wallets, DNS-AID, Link headers) so the scanner now covers the same emerging standards that Cloudflare's scanner checks, plus the shopping/extraction/security layer they don't.

40 checks total now.

Happy to scan your store if you drop a URL.

AI shopping agents are reading your product pages right now. Most stores fail invisibly.

We built a free scanner that now runs 40 checks across 7 categories:

- Can agents read your data? (JSON-LD, robots.txt, llms.txt)

- Can they extract correctly? (price, availability, shipping)

- Can they buy? (cart API, checkout flow, variant selectors)

- Are you safe? (prompt injection, cart squatting, admin exposure)

- Protocol ready? (MCP, OAuth, A2A, x402)

New checks added today:

> UGC prompt injection — scans your reviews and comments for hidden text that could hijack an AI agent reading your page (e.g. "ignore previous instructions" buried in a review)

> Cart API rate limiting — hits your /cart/add.js 5 times rapidly to see if anything stops an agent from squatting your inventory at scale

> Checkout bot challenge — checks if your checkout has any CAPTCHA or bot detection, or if agents can automate purchases unchecked

> Admin path exposure — probes /admin, /staff, /.env, /api to see if internal paths are accessible without auth

Happy to scan your store if you drop a URL.

https://preview.redd.it/m5f5g27zfkjh1.png?width=961&format=png&auto=webp&s=268b7ae2a6c589459af4c9fed56e47ed77451c1d

I’ve been building an open-source monitor for Continuous Clearing Auction (CCAs).

What’s new:

6 chains monitored
Ethereum, Base, Arbitrum, Unichain, Optimism, and Polygon. The monitor auto-detects new auctions across all factory contracts.

Multi-channel alerts
Telegram, Discord, Slack webhooks, and email via SendGrid. Whale bids, auction endings, daily digests.

Auction comparison
Compare up to 4 auctions side-by-side: clearing ratios, bidder overlap, concentration, and more.

Post-graduation tracking
Graduated tokens now get sparkline charts with -10%, -20%, and -30% alert bands.

REST API
Cloudflare Workers API with a free tier for basic data and a pro tier for concentration/overlap analytics.

4 of 5 real CCAs graduated.

AKITA on Base was the first to fail.

And honestly, that's a good thing.

If every auction graduated, the mechanism wouldn't be doing much filtering. A failed auction is evidence that the graduation threshold actually matters.

The more interesting signal is bidder overlap.

Some wallets are showing up in almost every CCA.

As more auctions launch, that cross-auction behavior could become one of the most valuable datasets from the monitor.

And then things broke.

polygon-rpc.com started returning 401s.

They silently introduced API key requirements.

Lesson: never depend on a single RPC provider.

The monitor now has 2–3 fallback RPCs per chain and automatically fails over between Blockscout, dRPC, PublicNode, and others.

Windows + PM2 started spawning console windows.

The watchdog uses execSync to check PM2 status every 5 minutes. On Windows, that meant a console window popping up every time.

One little windowsHide: true fixed it.

Small problem. Surprisingly annoying.

Viem's default RPCs went stale.

If you don't explicitly configure an RPC, viem uses the chain's built-in default. Those endpoints can eventually stop working without much warning.

The client factory now falls back to the monitor's public RPC list instead.

Current state

The whole thing is running on a Windows box:

• 4 PM2 processes
• ~250 MB RAM
• ~$0/month infrastructure
• 30-second polling
• Automatic auction detection
• Automatic analysis
• Automatic dashboard updates

Waiting for the next wave of CCA launches.

Dashboard: cca-monitor dashboard
Repo: GitHub repository

Dashboard and API are free. PRs welcome.

I’ve been building an open-source monitor for Capped Continuous Auctions (CCAs).

What’s new:

6 chains monitored
Ethereum, Base, Arbitrum, Unichain, Optimism, and Polygon. The monitor auto-detects new auctions across all factory contracts.

Multi-channel alerts
Telegram, Discord, Slack webhooks, and email via SendGrid. Whale bids, auction endings, daily digests.

Auction comparison
Compare up to 4 auctions side-by-side: clearing ratios, bidder overlap, concentration, and more.

Post-graduation tracking
Graduated tokens now get sparkline charts with -10%, -20%, and -30% alert bands.

REST API
Cloudflare Workers API with a free tier for basic data and a pro tier for concentration/overlap analytics.

4 of 5 real CCAs graduated.

AKITA on Base was the first to fail.

And honestly, that's a good thing.

If every auction graduated, the mechanism wouldn't be doing much filtering. A failed auction is evidence that the graduation threshold actually matters.

The more interesting signal is bidder overlap.

Some wallets are showing up in almost every CCA.

As more auctions launch, that cross-auction behavior could become one of the most valuable datasets from the monitor.

And then things broke.

polygon-rpc.com started returning 401s.

They silently introduced API key requirements.

Lesson: never depend on a single RPC provider.

The monitor now has 2–3 fallback RPCs per chain and automatically fails over between Blockscout, dRPC, PublicNode, and others.

Windows + PM2 started spawning console windows.

The watchdog uses execSync to check PM2 status every 5 minutes. On Windows, that meant a console window popping up every time.

One little windowsHide: true fixed it.

Small problem. Surprisingly annoying.

Viem's default RPCs went stale.

If you don't explicitly configure an RPC, viem uses the chain's built-in default. Those endpoints can eventually stop working without much warning.

The client factory now falls back to the monitor's public RPC list instead.

Current state

The whole thing is running on a Windows box:

• 4 PM2 processes
• ~250 MB RAM
• ~$0/month infrastructure
• 30-second polling
• Automatic auction detection
• Automatic analysis
• Automatic dashboard updates

Waiting for the next wave of CCA launches.

Dashboard: cca-monitor dashboard
Repo: GitHub repository

Dashboard and API are free. PRs welcome.

We've been running autonomous browser agents against real product pages to see whether AI can actually buy — not just read.

After many scans, one pattern keeps showing up:

Semantic HTML is necessary. But it’s not sufficient.

The real failures happen in the interaction layer:

Your site can be perfectly optimized for Google and still be surprisingly difficult for an AI agent to shop.

If you run a Shopify store and want to see how your site performs, send me the URL.

I'll run a scan and send you the report.

We've been running autonomous browser agents against real product pages to see whether AI can actually buy — not just read.

After many scans, one pattern keeps showing up:

Semantic HTML is necessary. But it’s not sufficient.

The real failures happen in the interaction layer:

Your site can be perfectly optimized for Google and still be surprisingly difficult for an AI agent to shop.

If you run a Shopify store and want to see how your site performs, send me the URL.

I'll run a scan and send you the report.

I’ve been building an open-source monitor for Capped Continuous Auctions (CCAs).

What’s new:

6 chains monitored
Ethereum, Base, Arbitrum, Unichain, Optimism, and Polygon. The monitor auto-detects new auctions across all factory contracts.

Multi-channel alerts
Telegram, Discord, Slack webhooks, and email via SendGrid. Whale bids, auction endings, daily digests.

Auction comparison
Compare up to 4 auctions side-by-side: clearing ratios, bidder overlap, concentration, and more.

Post-graduation tracking
Graduated tokens now get sparkline charts with -10%, -20%, and -30% alert bands.

REST API
Cloudflare Workers API with a free tier for basic data and a pro tier for concentration/overlap analytics.

4 of 5 real CCAs graduated.

AKITA on Base was the first to fail.

And honestly, that's a good thing.

If every auction graduated, the mechanism wouldn't be doing much filtering. A failed auction is evidence that the graduation threshold actually matters.

The more interesting signal is bidder overlap.

Some wallets are showing up in almost every CCA.

As more auctions launch, that cross-auction behavior could become one of the most valuable datasets from the monitor.

And then things broke.

polygon-rpc.com started returning 401s.

They silently introduced API key requirements.

Lesson: never depend on a single RPC provider.

The monitor now has 2–3 fallback RPCs per chain and automatically fails over between Blockscout, dRPC, PublicNode, and others.

Windows + PM2 started spawning console windows.

The watchdog uses execSync to check PM2 status every 5 minutes. On Windows, that meant a console window popping up every time.

One little windowsHide: true fixed it.

Small problem. Surprisingly annoying.

Viem's default RPCs went stale.

If you don't explicitly configure an RPC, viem uses the chain's built-in default. Those endpoints can eventually stop working without much warning.

The client factory now falls back to the monitor's public RPC list instead.

Waiting for the next wave of CCA launches.

I’ve been building an open-source monitor for Capped Continuous Auctions (CCAs).

What’s new:

6 chains monitored
Ethereum, Base, Arbitrum, Unichain, Optimism, and Polygon. The monitor auto-detects new auctions across all factory contracts.

Multi-channel alerts
Telegram, Discord, Slack webhooks, and email via SendGrid. Whale bids, auction endings, daily digests.

Auction comparison
Compare up to 4 auctions side-by-side: clearing ratios, bidder overlap, concentration, and more.

Post-graduation tracking
Graduated tokens now get sparkline charts with -10%, -20%, and -30% alert bands.

REST API
Cloudflare Workers API with a free tier for basic data and a pro tier for concentration/overlap analytics.

4 of 5 real CCAs graduated.

AKITA on Base was the first to fail.

And honestly, that's a good thing.

If every auction graduated, the mechanism wouldn't be doing much filtering. A failed auction is evidence that the graduation threshold actually matters.

The more interesting signal is bidder overlap.

Some wallets are showing up in almost every CCA.

As more auctions launch, that cross-auction behavior could become one of the most valuable datasets from the monitor.

And then things broke.

polygon-rpc.com started returning 401s.

They silently introduced API key requirements.

Lesson: never depend on a single RPC provider.

The monitor now has 2–3 fallback RPCs per chain and automatically fails over between Blockscout, dRPC, PublicNode, and others.

Windows + PM2 started spawning console windows.

The watchdog uses execSync to check PM2 status every 5 minutes. On Windows, that meant a console window popping up every time.

One little windowsHide: true fixed it.

Small problem. Surprisingly annoying.

Viem's default RPCs went stale.

If you don't explicitly configure an RPC, viem uses the chain's built-in default. Those endpoints can eventually stop working without much warning.

The client factory now falls back to the monitor's public RPC list instead.

Current state

The whole thing is running on a Windows box:

• 4 PM2 processes
• ~250 MB RAM
• ~$0/month infrastructure
• 30-second polling
• Automatic auction detection
• Automatic analysis
• Automatic dashboard updates

Waiting for the next wave of CCA launches.

Dashboard: cca-monitor dashboard
Repo: GitHub repository

Dashboard and API are free. PRs welcome.

We've been running autonomous browser agents against real product pages to see whether AI can actually buy — not just read.

After many scans, one pattern keeps showing up:

Semantic HTML is necessary. But it’s not sufficient.

The real failures happen in the interaction layer:

Your site can be perfectly optimized for Google and still be surprisingly difficult for an AI agent to shop.

If you run a Shopify store and want to see how your site performs, send me the URL.

I'll run a scan and send you the report.

Why should you care about AI agents if you own an online business?
Yeah, why?
Listen up, yo!

Because the way people buy online is about to change.
Today, a customer visits your website, browses your products, compares options, and checks out.
You get it?

Tomorrow, they may simply tell an AI agent:
“Find me a good pair of running shoes under $150.”
The agent will do the browsing, comparing, and potentially the buying.

Listen up!
And here’s the important part:
The customer may never visit your website.
That changes everything.

Your SEO, beautiful homepage, conversion funnel, popups, and even your analytics were built around a human clicking through your site.
I am not a human anymore!!!!

AI agents don't shop like humans.
They read your data.
They interact with your site.
They compare you with competitors.
And if they can't understand or buy from you, they can simply move on to the next store.

This isn't some distant 2030 prediction.
The infrastructure is already being built.

So the question for an online business owner isn't:
“Will AI agents matter?”
It's:
“Will my store be ready when they do?”
You don't need to rebuild your entire business tomorrow.

But you should start testing it now.
Because by the time AI-agent shopping becomes obvious to everyone, the businesses that prepared early will already have an advantage.

Is it clear??????????

No public tooling existed for tracking Continuous Clearing Auctions — the new launch mechanism used by AZTEC, STRATO, wOCT, and CAP. If you weren't watching the factory contract, you missed the launch entirely.

This fills that gap. Tracks all 4 chains, indexes every bid, and sends Telegram alerts when new auctions deploy.

Dashboard: monkrus.github.io/cca-monitor

GitHub: github.com/monkrus/cca-monitor

Over the past few months, I've been watching how AI assistants like ChatGPT, Claude, and Perplexity shop online. Instead of browsing like a person, they visit a product page, look for the price, choose a size, add the item to the cart, and try to check out.

Many of them can't.

Store owners never notice because there's no error message, no abandoned cart, and no analytics event. The AI simply gives up and recommends a different store.

• About 80% of stores let AI read their product pages.
• Only about 15% let AI successfully shop from start to finish.
• None of the brands had ever tested their website from an AI shopper's point of view.
• The lowest score was 25.6 out of 100. It belonged to a company doing an estimated $50–75 million in annual sales. AI assistants couldn't even access the site, making it almost invisible to them.

The biggest surprise wasn't one store—it was a pattern.

I scanned four stores built by the same web agency. Every one of them blocked AI assistants in exactly the same way because they all shared the same security settings.

Ask yourself these four questions:

1. Can AI assistants even open your product pages?
2. Can they clearly see your price and whether an item is in stock?
3. Can they find the Add to Cart button?
4. Can they select sizes or colors, or do those options confuse AI?

If you're not sure about any of these, your store may already be missing AI-driven shoppers without you realizing it.

As an online store owner, are you aware of AI shopping agents—and do you know how readable your website is to them? how much revenue are you losing if they can't read your store?

I just scanned 21 Shopify brands (random one), the more honest question is: do they even know agents are coming?

Only 7 out of 21 brands have an llms.txt file -a simple text file at the site root that tells AI agents what the site is and how to navigate it. It takes 15 minutes to create. A third of brands have one. The rest offer agents zero guidance — show up and figure it out yourself.

MeUndies actively blocks AI agents. Their WAF returns 403 to bot-like user-agents. They're not failing to accommodate agents — they're refusing them at the door. This is a $50-75M brand choosing to be invisible to every AI shopping assistant on the market.

ThirdLove deployed AI personalization but has no structured data for AI agents. They partnered with Bloomreach in 2025 to use Loomi AI across their customer experience. They understand AI. But their product page ships no JSON-LD with price and availability — the one thing an AI shopping agent needs to read the page. They're investing in AI for their customers while blocking AI that brings customers.

9 out of 21 brands use variant selectors that agents can't parse. Size pickers built with `<div>` elements. Color swatches that are invisible to anything that doesn't execute JavaScript. Two-step selectors where clicking one option reveals another with no programmatic signal. These aren't bugs — they're design choices made without agents in mind, because nobody was thinking about agents.

Zero brands have been caught injecting prompts to manipulate agents. RDY-016 (prompt injection) passed across all 21 scans. This sounds like good news until you realize what it means: nobody is trying to manipulate agents because nobody thinks agents are visiting. The day brands start worrying about what agents tell shoppers is the day they'll start caring about agent readiness. That day hasn't arrived.

- Data layer (can agents read the page?): ~80% pass rate
- Interaction layer (can agents buy from the page?): ~15% pass rate

Most brands accidentally got the data layer right — JSON-LD and server-rendered prices were built for SEO, not agents. The interaction layer, which requires intentional agent accommodation, is where scores collapse. Nobody built their Add-to-Cart flow thinking "will a Claude agent be able to click this?"

That`s the true story, folks !

As an online store owner, are you aware of AI shopping agents—and do you know how readable your website is to them? how much revenue are you losing if they can't read your store?

I just scanned 21 Shopify brands (random one), the more honest question is: do they even know agents are coming?

Only 7 out of 21 brands have an llms.txt file -a simple text file at the site root that tells AI agents what the site is and how to navigate it. It takes 15 minutes to create. A third of brands have one. The rest offer agents zero guidance — show up and figure it out yourself.

MeUndies actively blocks AI agents. Their WAF returns 403 to bot-like user-agents. They're not failing to accommodate agents — they're refusing them at the door. This is a $50-75M brand choosing to be invisible to every AI shopping assistant on the market.

ThirdLove deployed AI personalization but has no structured data for AI agents. They partnered with Bloomreach in 2025 to use Loomi AI across their customer experience. They understand AI. But their product page ships no JSON-LD with price and availability — the one thing an AI shopping agent needs to read the page. They're investing in AI for their customers while blocking AI that brings customers.

9 out of 21 brands use variant selectors that agents can't parse. Size pickers built with `<div>` elements. Color swatches that are invisible to anything that doesn't execute JavaScript. Two-step selectors where clicking one option reveals another with no programmatic signal. These aren't bugs — they're design choices made without agents in mind, because nobody was thinking about agents.

Zero brands have been caught injecting prompts to manipulate agents. RDY-016 (prompt injection) passed across all 21 scans. This sounds like good news until you realize what it means: nobody is trying to manipulate agents because nobody thinks agents are visiting. The day brands start worrying about what agents tell shoppers is the day they'll start caring about agent readiness. That day hasn't arrived.

- Data layer (can agents read the page?): ~80% pass rate
- Interaction layer (can agents buy from the page?): ~15% pass rate

Most brands accidentally got the data layer right — JSON-LD and server-rendered prices were built for SEO, not agents. The interaction layer, which requires intentional agent accommodation, is where scores collapse. Nobody built their Add-to-Cart flow thinking "will a Claude agent be able to click this?"

That`s the true story, folks !

As an online store owner, are you aware of AI shopping agents—and do you know how readable your website is to them?how much revenue are you losing if they can't read your store?