Skip to content
Good for Bots

Shopify security scanner and future merchant apps

Click badge to copy

Changed your site? Run a new scan.

Claim to rescan

Claiming is free. Verify ownership to request a rescan after deploying your changes.

Unclaimed listings are checked automatically every 90 days.

Good for Bots report

Appnary scores 99 of 100: the whole readable base, 49 of the 50 agent-layer points, no penalties.

Earned

The whole readable base above the line, 49 of the 50 agent-layer points below it.

99

One prompt away

Copy it below ↓

1
Penalties0
How scoring works · current methodology →

Through a bot’s eyes

“Appnary is a Shopify app development company currently building Vigil, a security scanner for merchant stores, alongside future tools for data synchronization and backups.”

Simulated from the response GoodForBotsBot received on , not a live answer from any AI assistant.

What it can read, and what stays hidden →

What a bot can read

A language model reading the provided inputs learns about Appnary, its parent company Binary Labs LLC, and its founder. The homepage and llms.txt describe the flagship product Vigil, future apps like Sync and Backup, and contact information including [email protected]. The homepage provides waitlist details and FAQs, while the llms.txt file adds specific technical scope, stating that Vigil scans staff permission history past 250 events, allows users to turn off flagged scripts, and excludes customer records and order contents in version 1. The provided JSON-LD organization block supplies metadata such as the founding date, founder, and parent organization, while the FAQPage JSON-LD echoes the homepage questions regarding Appnary's current and future offerings.

What stays hidden

Pricing details, exact launch dates, and direct installation links are not provided since the apps are still in development and pending Shopify approval.

What is Appnary?

Appnary is a company founded in Q1 2026 by Harun R. Rayhan as part of Binary Labs LLC.

Read more →

It builds Shopify applications for merchants. The primary product currently in development is Vigil, a security scanner designed to inspect published themes and app embeds, identify external scripts, flag leaked keys, and track staff permission changes. Merchants can also run scans through an AI agent via MCP. In addition to Vigil, Appnary outlines future products named Sync and Backup, which have public waitlists to determine the build order.

3 prompts, 1 point

For Claude Code, Cursor or Codex. The score moves after the next scan.

+1 capabilitybadge capabilities from 0 to 1

Publish an API catalog

No API catalog published.

Read prompt

+1 capabilitybadge capabilities from 1 to 2

Publish an auth.md for agents

No /auth.md published.

Read prompt

Pro

9 more prompts in Pro

Pro shows a prompt for every fix and drafts your llms.txt and robots.txt. It never changes the score.

$9 once, per listingSee Pro

Deployed your fixes? Rescan to update your score →

Select a check to see what we found and how it is graded.

Readable base

50 / 50

Passes.

3.4 of 3.4 points.

robots.txt is valid, with 4 user-agent groups.

Passes.

8.5 of 8.5 points.

Sitemap declared in robots.txt, listing 25 URLs.

Passes.

8.5 of 8.5 points.

All 4 pages read pass. The homepage describes itself to machines as Organization, Person, FAQPage in valid schema.org JSON-LD.

Passes.

10.2 of 10.2 points.

All 4 pages read pass. The homepage marks its content root, its heading outline and its landmarks.

Passes.

8.5 of 8.5 points.

5 of 5 assessed homepage navigation links expose usable destinations.

Passes.

4.2 of 4.2 points.

126 of 126 assessed homepage links and buttons have a nonempty accessible name.

Passes.

2.5 of 2.5 points.

1 of 1 assessed homepage form fields meet the static naming and field-semantics checks.

Passes.

2.5 of 2.5 points.

130 of 130 assessed homepage controls and role declarations meet the static role, state and relationship checks.

Passes.

1.7 of 1.7 points.

All 4 pages read pass. The homepage declares itself as its canonical URL.

Agent layer

48.8 / 50

Passes.

11.3 of 11.3 points.

/llms.txt is well formed: 6 links across 1 section.

Passes.

7.5 of 7.5 points.

/llms.txt is descriptive: a summary plus descriptions on 100% of links. Every description follows the link with something other than ":", the separator the format specifies (`- [name](url): notes`).

Passes.

12.5 of 12.5 points.

/llms-full.txt serves the site's content as markdown (at least 64 KB).

Passes.

10 of 10 points.

3 of 4 pages read pass. Asking the homepage for markdown still returns text/html.

Passes.

5 of 5 points.

States a position on 14 AI crawlers, across 3 purposes (search, user-fetch, training).

Passes.

2.5 of 2.5 points.

Declares AI usage preferences via Content-Signal (robots.txt): ai-train, ai-input, search.

Penalties

− 0

Passes.

Penalty: 0 of 15 points.

Our crawler reaches the page without being challenged.

Passes.

Penalty: 0 of 20 points.

Nothing on the homepage tells a crawler to skip it or to withhold its snippet.

Passes.

Penalty: 0 of 25 points.

The captured homepage HTML contains 297 content words; completeness is not assessed.

Passes.

Penalty: 0 of 25 points.

robots.txt allows every known search and user-fetch crawler to reach the homepage.

Passes.

Penalty: 0 of 10 points.

The homepage is served over HTTPS and returns HTTP 200.

Passes.

Penalty: 0 of 3 points.

The homepage provides both a non-empty title and meta description.

Passes.

Penalty: 0 of 3 points.

The homepage is reached in 0 redirects.

Passes.

Penalty: 0 of 3 points.

The homepage reached a plain crawler in 52 ms.

Agent capabilities

0 of 11 · no points

Each one found adds +1 to the badge.

Not applicable.

Adds +1 to the badge when found.

No API catalog published.

Not applicable.

Adds +1 to the badge when found.

No /auth.md published.

Not applicable.

Adds +1 to the badge when found.

No AI Catalog published, so no MCP server card can be discovered.

Not applicable.

Adds +1 to the badge when found.

No A2A Agent Card at /.well-known/agent-card.json, and none listed in an AI Catalog.

Not applicable.

Adds +1 to the badge when found.

No usable Agent Skills index was found at either well-known path or in the AI Catalog.

Not applicable.

Adds +1 to the badge when found.

No WebMCP declarations were found in the collected HTML or inline scripts. External scripts were not inspected.

Not applicable.

Adds +1 to the badge when found.

No Web Bot Auth key directory at /.well-known/http-message-signatures-directory.

Not applicable.

Adds +1 to the badge when found.

No HTTP 402 payment challenge on the homepage or robots.txt, and no manifest at /.well-known/x402.

Not applicable.

Adds +1 to the badge when found.

No ACP discovery declaration established at /.well-known/acp.json.

Not applicable.

Adds +1 to the badge when found.

No UCP discovery declaration established at /.well-known/ucp.

Not applicable.

Adds +1 to the badge when found.

No public AMP discovery declaration established. Private or hidden agents may not advertise one to our crawler.

Access & usage policy

Who can read this page, and for what purpose?

GoodForBotsBot received HTTP 200 via a direct request. No indexing restriction was observed in the supported homepage directives.

Sampled URL: https://appnary.com/

Declared crawling rules

robots.txt refuses this URL for some listed identities. See the affected crawlers below.

Sources and scope: declared crawling rules
  • Declared allow · Scan admission

    • GoodForBotsBot/1.0 (+https://goodforbots.com/bot)

    The recorded robots admission decision allowed our crawler to proceed.

    GoodForBotsBot admission along the homepage request chain

    https://appnary.com/

    robots.txt is present and valid

  • Declared allow · robots.txt

    • goodforbotsbot (Site diagnostics)
    • * (Default robots group)
    • mistralai-index (ai-search)
    • kimi-searchbot (ai-search)
    • amzn-searchbot (ai-search)
    • meta-webindexer (ai-search)
    • exasearchbot (ai-search)
    • aiwebindex (ai-search)
    • duckassistbot (ai-search)
    • shapbot (ai-search)
    • yandexadditional (ai-search)
    • yandexadditionalbot (ai-search)
    • mistralai-training (ai-training)
    • kimibot (ai-training)
    • ai2bot (Unknown)
    • webzio-extended (ai-training)
    • mistralai-user (user-fetch)
    • kimi-user (user-fetch)
    • amzn-user (user-fetch)
    • diffbot-user (user-fetch)
    • firecrawlagent (extraction)
    • webzio (extraction)

    No matching refusal for this URL in the applicable robots group. This is a declaration, not an access test.

    Acquisition of https://appnary.com/

    https://appnary.com/robots.txt

    User-agent: *
    allow: /

    robots.txt is present and validStates a position on AI crawlersAllows search and user-fetch crawlers

  • Declared allow · robots.txt

    • oai-searchbot (ai-search)
    • claude-searchbot (ai-search)
    • perplexitybot (ai-search)
    • chatgpt-user (user-fetch)
    • claude-user (user-fetch)
    • perplexity-user (user-fetch)
    • meta-externalfetcher (user-fetch, agent)
    • googlebot (search)
    • bingbot (search)
    • applebot (search, ai-training)

    No matching refusal for this URL in the applicable robots group. This is a declaration, not an access test.

    Acquisition of https://appnary.com/

    https://appnary.com/robots.txt

    User-agent: oai-searchbot
    User-agent: chatgpt-user
    User-agent: claude-searchbot
    User-agent: claude-user
    User-agent: perplexitybot
    User-agent: perplexity-user
    User-agent: bingbot
    User-agent: googlebot
    User-agent: applebot
    User-agent: meta-externalfetcher
    allow: /

    robots.txt is present and validStates a position on AI crawlersAllows search and user-fetch crawlers

  • Declared allow · robots.txt

    • gptbot (ai-training)
    • claudebot (ai-training)
    • applebot-extended (ai-training)
    • google-extended (ai-training, grounding)
    • meta-externalagent (ai-training, product-improvement)
    • amazonbot (ai-training, product-improvement)
    • ccbot (open-dataset, ai-training)
    • claude-web (Unknown)
    • anthropic-ai (Unknown)

    No matching refusal for this URL in the applicable robots group. This is a declaration, not an access test.

    Acquisition of https://appnary.com/

    https://appnary.com/robots.txt

    User-agent: gptbot
    User-agent: claudebot
    User-agent: claude-web
    User-agent: anthropic-ai
    User-agent: google-extended
    User-agent: applebot-extended
    User-agent: ccbot
    User-agent: amazonbot
    User-agent: meta-externalagent
    allow: /

    robots.txt is present and validStates a position on AI crawlersAllows search and user-fetch crawlers

  • Declared restriction · robots.txt

    • bytespider (Unknown)
    • petalbot (Unknown)

    A matching refusal for this URL in the applicable robots group. This is a declaration, not an access test.

    Acquisition of https://appnary.com/

    https://appnary.com/robots.txt

    User-agent: bytespider
    User-agent: petalbot
    disallow: /

    robots.txt is present and validStates a position on AI crawlersAllows search and user-fetch crawlers

Observed access

GoodForBotsBot received HTTP 200 via a direct request.

Sources and scope: observed access
Coverage and interpretation
  • Crawler coverage includes the registered identities and up to 50 user-agent entries from robots.txt. Source excerpts and detail groups are bounded; omissions are labelled.
  • Observed access describes GoodForBotsBot only. Other crawler entries describe declared rules, not tests of those operators' access.
  • Coverage is the sampled homepage response and collected robots.txt files. No indexing or citation is guaranteed. Usage preferences are declarations, not a legal determination of permission.
  • This explanation adds no points or penalties. Any score effects belong to the linked checks.
  • AIPREF and Content Signals keep their own definitions. AIPREF search can include processing used exclusively for search; training preferences are not a blanket ruling on every search process.

In its category

1st of 51 in SaaS & Web Apps

Whole category →
  1. 1Appnary · this reportappnary.com
  2. 2BulkSharebulkshare.cloud
  3. 3Maeve Socialmaevesocial.com

Category average 57. The percentile appears once the catalogue holds a few hundred sites.

Scanned

Site profile

Login
Not established
API
Not established
Commerce
Not established

It decides which conditional checks apply. “Not established” means no proof in what we read, not proof of absence.

Scan details

Every scan is kept. Pro draws the history as a chart →

Scanned
13 Oct 2026
Rubric
0.9.0
Requests
23
Fetched
3.6 MB
Took
18.3 s
Homepage
52 ms · direct
Pages read
4
robots.txt
allowed
Which pages the scan read

The homepage and up to three pages from the sitemap and homepage links. Structured data, page structure, Markdown negotiation and typed links check each page read and take the median page; other checks read the homepage.

  • Homepagealways read
  • /blog/calculate-true-roasarticle · from the sitemap · read
  • /docscollection · linked from the homepage · from the sitemap · read
  • /aboutabout · linked from the homepage · from the sitemap · read

More like Appnary:SaaS & Web AppsAI & Machine LearningSecurity & PrivacyStartups

Also AI & Machine Learning

goodforbots.com

Evaluates website readability for AI crawlers and language models with a scoring rubric

Same category

bulkshare.cloud

Branded file delivery on custom domains for agencies and freelancers

Same category

softsync.ai

Flexible B2B CRM for startups with meeting notes and automated follow-ups

Same category

ideahunter.today

Evidence-led app and micro-SaaS ideas for solo founders

Same category

baiivo.com

Client work and payment software for freelancers and small studios

Same category

sellio.chat

Shared inbox and live chat platform with AI support agents for small teams