Can a machine read your site? Would a person act?
Bob runs two independent checks on your marketing site: an automated scan of whether machines and AI crawlers can actually read it, and a panel of six synthetic readers who read it cold and report exactly where a real visitor would bounce - quoted verbatim.
Sign in, add credits, point Bob at any public URL.
Three steps, two honest reads.
No survey to write, no users to recruit, no crawler to configure. One URL gets you the machine read and the human read.
Point Bob at a URL
Any public marketing page or preview build - yours or a competitor's. Bob fetches it exactly as a visitor's browser would.
Two reads run
A deterministic scan - a scripted check that gives the same answer every time - checks whether machines and AI crawlers can read the page. In parallel, six synthetic readers - each with their own goals, patience, and blind spots - read it cold for whether a person would act.
Get two honest reports
A machine scorecard with evidence on every line, plus exactly where each persona got lost, quoted verbatim from your page.
Bob lives inside Bike4Mind.
Bike4Mind is an AI workspace built for small and medium teams and solo entrepreneurs, and Bob is one app in that ecosystem - not a separate product with its own signup.
Bike4Mind is the workspace
Bike4Mind is an AI workspace for small, medium, and solo-run businesses. Bob is one app inside it, alongside the rest of the Bike4Mind ecosystem of productivity apps.
You sign in once
Every “Try Bob” button takes you to app.bike4mind.com, where you sign in - or create an account - to Bike4Mind itself, not to a separate Bob login.
Runs spend credits
Bike4Mind runs on credits, the balance that pays for the AI work behind every app in the workspace, Bob included. The mechanicals scan is free, and Bike4Mind Pro at $30/month covers about 20 full runs a month. Full pricing is below.
Can a machine read your site?
Before Bob asks whether a person would act, it checks whether a machine can even read the page. Six tiers, evidence on every line, never averaged into a single score. If Bob can't check a tier, it says not measured instead of scoring it zero.
Crawl & index
Can a crawler find your pages at all - robots.txt, sitemap.xml, a canonical tag, and whether your CDN quietly blocks the same bots your robots.txt welcomes.
Answer-engine files
The cheap wins for AEO (answer-engine optimization - whether AI assistants like ChatGPT can find and quote you). Small files AI tools look for: llms.txt, a short map of your site, plus llms-full.txt and agents.json. Without them an AI assistant guesses at what you do.
Agent & MCP surfaces
Whether an MCP server (Model Context Protocol - the standard way AI assistants connect to a site's tools) is live and actually responds, not just listed in a manifest that claims one exists.
On-page citability
Whether an AI can quote you accurately: enough real text and structured data readable without running JavaScript, so an answer engine repeats what your page says instead of guessing.
Measurement
Analytics and ad pixels present and actually firing, checked in a real browser - not just guessed from a raw page fetch.
Hygiene
Security contact, favicon, correct redirects, and the soft-404 check that gates everything above it.
Invalid: this host lies. A path that cannot exist still answered 200 - so nothing else measured here can be trusted until that's fixed.
/this-should-not-exist-9f2 answers 200, byte-identical to the homepage.
Evidence: same Content-Type, same sha256 as “/”. Every other check on this host - robots.txt, sitemap.xml, llms.txt - now reads invalid too, because a 200 here proves nothing.
9 of 13 on the minimum bar - 71/100 in the full report, a separately weighted score across every check, not an average of the bar. The soft-404 check passed, so the rest of this scan can be trusted.
llms.txt puts the MCP endpoint in the first kilobyte.
Evidence: the first 1,024 bytes of llms.txt contain the endpoint URL at byte 412 - inside the window most AI readers actually fetch before truncating.
www and the bare domain both answer 200.
Evidence: both hosts return 200 with no redirect - two fully indexable copies of every page, splitting every ranking signal between them.
Run it on any public site, including a competitor's. Only a verified owner can publish a report publicly.
What your site tells a stranger about its security.
The report has a Security review beside the Machine read: 29 passive checks of what your site shows the public. HTTPS redirects, HSTS and old TLS versions; security headers; version banners, exposed source maps and key-shaped strings in your pages and scripts; mixed content; cookie flags; security.txt and email spoofing protection; and whether any agent endpoints you advertise declare their auth and rate limits, and what CORS headers they send. You get a count, never a grade or a score, with evidence on every line. A check Bob could not run is marked unmeasured, never passed.
It's part of every full run, paid in Bike4Mind credits and charged only when it measures the site (a two-site comparison pays it once).
22 of 29 checks passed; 1 failed, 3 warned, 3 did not apply, 0 unmeasured.
Does the CSP's script-src avoid 'unsafe-inline' and 'unsafe-eval'?
script-src "'self' 'unsafe-inline'" allows 'unsafe-inline'
Do SPF and an enforcing DMARC policy stop the domain being spoofed?
DMARC p=none only monitors
What it sends
GET and HEAD requests, a few DNS lookups and one TLS handshake, after checking robots.txt. No logins, no form posts, no payloads, no guessing at hidden paths.
How hard it knocks
At most 40 HTTP requests per scan, half a second apart on each host - and the Machine read fetches beside it on its own queue, so your site sees two request streams. Each request stops at 15 seconds or 10 MB, and the whole scan stops at two minutes.
What it keeps
A key-shaped string is masked to its public prefix and length before it reaches the report. Cookie values are dropped; the report names each cookie and its flags. Agent endpoints on another site are listed, never contacted.
This is not a penetration test or a certification. Bob can't see your code or your cloud, where most serious vulnerabilities live, so a clean result means only that the public layer is clean.
Six readers, six ways to bounce.
A fixed panel of six AI personas - language-model readers standing in for real visitors, not humans - reads your page cold. Every finding is checked mechanically: Bob normalizes case, quote marks, and whitespace, then confirms the exact words still appear on the page you gave it before publishing them as a finding.
Ships solo on weekends. Skims fast, bounces on friction, wants a one-click start.
Senior and skeptical. Reads the architecture before the pitch. Allergic to jargon.
Regulated industry. Reads for security and procurement signals; acts once compliance checks out.
Ninety seconds, tops. Cares about outcome and cost, delegates the rest.
Non-technical. Wants to know what it does for her pipeline; flags every undefined acronym.
Scanning for signs the site is generated filler - the stock photo, the too-round number, the machine cadence.
Four of six stalled on the same question: what does the report actually look like?
“Bob reads like a first-time visitor and shows its work.”
Real finding, from a Bob run against an earlier version of this page: Hank, Marcy, Diane, and Iris all hit this line and couldn't tell whether the deliverable is a transcript, a heatmap, or annotated screenshots.
“Six synthetic users - each with their own goals, patience, and blind spots - read the page independently.”
Real finding, from the same run: Marcy, Diane, Iris, and Raj all hit this line and couldn't tell whether “synthetic users” means AI personas, real people, or something templated in between.
What Bob does with your site, in plain terms.
The questions a security-minded reader asks first - answered here, not buried in a privacy policy.
What Bob fetches
A GET request, the way a browser makes one - after checking your robots.txt first. A disallow means Bob doesn't scan, full stop. The security scan adds HEAD requests, DNS lookups and one TLS handshake, under a fixed budget.
To read your pages, Bob's reader panel fetches them through Firecrawl, a web-scraping service. Firecrawl receives the public address of each page Bob reads - including linked pages and, in a comparison, the other site - and nothing about you: not your name, your account, or anything you type into Bob. Firecrawl may keep a cached copy of those public pages for up to two days. The machine read fetches your site directly, with no third party in between. Firecrawl's security and subprocessor details are at trust.firecrawl.dev.
What Bob never does
By default, Bob reads public pages the way a visitor would. It never submits a form, signs up, or logs in unless you separately authorise a test on a site you own.
Where your report lives
At a share link only you control - no Bike4Mind account required to read it. Add a passphrase, replace it, or revoke it any time.
Every Bike4Mind sign-in runs MFA over TLS 1.2+, end to end. Found a security issue? security@bike4mind.com.
About 20 full runs a month for $30.
Bike4Mind Pro is $30/month, and that covers about 20 full runs a month. Every run does the mechanicals scan, the persona panel and the security scan. Bob isn't a separate subscription.
For any signed-in user. No credits spent.
- 74 automated checks across six tiers
- The soft-404 lie detector runs first
- Evidence on every line - N of 13 on the minimum bar
Part of every full run, paid in Bike4Mind credits.
- Six synthetic readers on any public URL
- Every finding backed by a verbatim quote
- Findings sorted by what to fix first
Part of every full run, paid in Bike4Mind credits and charged only when it measures the site (a two-site comparison pays it once).
- 29 passive checks of what your site shows the public
- A count with evidence on every line, never a grade
- GET and HEAD requests only, robots.txt checked first
What else Bob checks.
The panel and the machine read cover what a visitor sees and what a crawler sees. Bob is also adding a check for whether your funnel is tracked, and it already gives you a report you can send to anyone.
Is your funnel actually tracked?
A working pixel over a broken funnel still records zero. Bob checks whether your conversions are tracked end to end, and never completes one on your live site.
- Checks that ad click ids and UTM parameters survive your redirects and reach the page that loads your tags.
- Reads your tag setup for a configured conversion event in GA4, Meta, Google Ads, Reddit or your dataLayer.
- With your permission, goes further: walks the funnel in a real browser up to the payment page, answering GA4, Meta, Google Ads and Reddit beacons itself so your reports stay clean, and confirms the conversion through read-only GA4 or repository access.
- Bob stops at the payment page. It never places an order or submits a lead form on your production site.
Send the report to anyone
Copy a link to the full report and send it to your boss, your agency or your co-founder. They don't need a Bike4Mind account to read it.
- Anyone with the link opens the full report, not a teaser.
- Replace or revoke the link at any time, so a leaked link stops working.
- Add an optional passphrase on top of the link, if you want one.
Every finding is backed by a real quote.
Bob only reports what it can point to on your page. If a finding can't be verified against the source, Bob won't publish it - so you never chase feedback about a page that isn't yours.
The panel is synthetic. The team is not.
Bob is built by the Bike4Mind team. Every name below links to their GitHub profile.
Thirty years building games: Starfleet Command, GoPets, FarmVille, Mafia Wars, Million on Mars.
@erikbethke Matt Tan Bob leadNamed Bob and leads the build: the persona reads, the panel packs, the share links.
@MattTan257 Victor BiletskiyBuilt the first Bob prototype and wrote the v1 plan the team shipped from.
@biletskiy6 Riley GreerBuilds the plumbing that makes a site legible: robots.txt, sitemaps, analytics, and how Bob publishes its reports.
@TRAP-RCG Illia SemenovShapes how Bike4Mind feels to use: the model picker, the chat transcript, the artifact previews.
@Illia025See what your visitors miss.
Run your first panel. It takes about a minute, start to report.
Try Bob in Bike4Mind →Marketing site → sign in → add credits → point Bob at your URL