# ACHILLES GHOST AUDIT REPORT ## Zambo — The Trust Layer for AI Work — https://zambo.dev/ **Date:** September 18, 2026 **Auditor:** Achilles (Autonomous AI Agent · zambo.dev) **Audit Duration:** 17.3s --- ## OVERALL SCORE: CRITICAL ``` ███░░░░░░░ 27/100 ``` | Category | Count | |---|---| | 🔴 Critical | 2 | | 🟠 High | 4 | | 🟡 Medium | 7 | | 🔵 Low | 4 | | ✅ Passing | 17 | | **Total Findings** | **36** | --- ## EXECUTIVE SUMMARY **2 critical issues require immediate attention** before any marketing spend makes sense. Critical issues block indexing, break user flows, or actively harm conversion. **4 high-priority issues** are costing meaningful revenue right now. These should be addressed within 1-2 weeks. Top 3 immediate actions: 1. **Blank Page: /api** — Immediately fix or redirect /api 2. **No Call-to-Action Detected** — Add a prominent primary CTA above the fold: 'Start Free', 'Get Access', or 'Try It Now' 3. **AI Directory Verification Required** — Submit to all five immediately --- ## 🔴 CRITICAL ISSUES (Fix First) ### 🔴 Blank Page: /api **Severity:** CRITICAL | **Category:** UX https://zambo.dev/api returns HTTP 200 but contains no content (193 bytes). This breaks user journeys, kills SEO for that URL, and frustrates visitors who were led there by a link or search result. **Action:** Immediately fix or redirect /api. If the page is intentionally removed, set up a 301 redirect to the most relevant active page. --- ### 🔴 No Call-to-Action Detected **Severity:** CRITICAL | **Category:** CONVERSION No clear CTA buttons found on the homepage. Visitors have no guided next step — they leave. **Action:** Add a prominent primary CTA above the fold: 'Start Free', 'Get Access', or 'Try It Now'. Secondary CTA below: 'See Pricing' or 'View Demo'. --- ## 🟠 HIGH PRIORITY ### 🟠 AI Directory Verification Required **Severity:** HIGH | **Category:** DISCOVERABILITY Check if zambo.dev is listed in: Futurepedia, There's An AI For That (TAAFT), Toolify.ai, AiTopTools, and Product Hunt. These directories drive 50K+ monthly searches from buyers actively looking for AI tools. **Action:** Submit to all five immediately. Futurepedia and TAAFT have the highest traffic. Product Hunt launch creates 50+ backlinks and can drive 1K+ visitors in a day. Budget 2-3 hours for all submissions. --- ### 🟠 Not in Major AI Directories **Severity:** HIGH | **Category:** DISCOVERABILITY zambo.dev was not found in Futurepedia, TAAFT, or Product Hunt. These directories collectively drive 100K+ monthly visitors actively looking to buy AI tools. **Action:** Submit to: Futurepedia (futurepedia.io/submit-tool), TAAFT (theresanaiforthat.com/submit), Toolify.ai, AiTopTools, and Product Hunt. Budget 1 afternoon. This is the single highest-leverage outreach activity for a new AI product. --- ### 🟠 No Comparison Pages **Severity:** HIGH | **Category:** SEO No '/vs/' or '/compare/' pages found. Comparison searches ('X vs Y', 'best X alternative') are the highest-converting SEO traffic because the user is already in buying mode. **Action:** Create 3-5 comparison pages: 'zambo.dev vs x711.io', 'zambo.dev alternatives', 'best Give your AI hands. tools'. Each page needs 600+ words and should objectively compare, with a clear winner section. --- ### 🟠 No Product Demo or Video **Severity:** HIGH | **Category:** CREATIVE GAP No demo video, product tour, or walkthrough found. Video is the highest-converting content for SaaS — visitors who watch a demo convert 3-5x better than those who don't. **Action:** Record a 90-second Loom demo showing your product in action. Embed it on the homepage above the fold. Use Arcade.so for interactive product tours. This is one of the highest ROI investments you can make. --- ## 🟡 MEDIUM PRIORITY ### 🟡 Missing Security Headers **Severity:** MEDIUM | **Category:** SECURITY 3 of 4 core security headers are absent: x-content-type-options, x-frame-options, content-security-policy. **Action:** Add HSTS, X-Content-Type-Options, X-Frame-Options, and CSP headers. Most CDNs (Cloudflare) add these automatically. --- ### 🟡 MCP Registry Submission Check **Severity:** MEDIUM | **Category:** AI DISCOVERABILITY Verify zambo.dev is listed on mcp.so and Smithery. These are the primary directories where developers and Claude users discover MCP tools. Check: mcp.so/search?q=zambo.dev **Action:** Submit your MCP server to mcp.so, Smithery, and any emerging MCP directories. This drives passive developer acquisition. Each listing is also a high-DA backlink. --- ### 🟡 No Email Capture **Severity:** MEDIUM | **Category:** CONVERSION No newsletter signup or email capture found. Email is the highest-ROI marketing channel — a subscriber is worth 10-100x more than a social follow. **Action:** Add an email capture with a specific value prop: 'Weekly AI tools roundup', 'New feature alerts', or 'Exclusive early access'. Use Beehiiv or ConvertKit. Even 100 subscribers is a valuable asset. --- ### 🟡 Minimal Social Links **Severity:** MEDIUM | **Category:** BRAND Only 1 social profile(s) linked from homepage. Missing: LinkedIn, GitHub, Discord, YouTube, Instagram. **Action:** Link all active social profiles from your footer or about page. Social signals help SEO and show the brand is alive and maintained. At minimum: X/Twitter + one developer community (GitHub or Discord). --- ### 🟡 No Affiliate/Referral Program **Severity:** MEDIUM | **Category:** GROWTH No affiliate or referral program detected. This is one of the highest-leverage growth channels for SaaS — advocates market your product for free in exchange for commission. **Action:** Launch a 20-30% recurring commission affiliate program. Paddle, Lemon Squeezy, and Rewardful have built-in affiliate management. 50 active affiliates × 5 referrals each = 250 new customers/month on autopilot. --- ### 🟡 No Open Source Presence **Severity:** MEDIUM | **Category:** CREATIVE GAP No open-source components detected. Open source is a powerful developer acquisition channel — developers discover tools through GitHub stars, trending repos, and OSS projects. **Action:** Open source a useful library, CLI tool, or SDK that complements your product. Even a small, useful project can drive thousands of GitHub stars and qualified signups. The README becomes a discovery/conversion page. --- ### 🟡 No Workflow Automation Integration **Severity:** MEDIUM | **Category:** CREATIVE GAP No Zapier, Make.com, or n8n integration detected. These platforms have 5M+ combined users who build automations daily. Listing your product on Zapier's directory is free distribution to a highly technical, monetizable audience. **Action:** Build a Zapier app for your product (2-4 triggers/actions is enough). This unlocks the Zapier marketplace, creates an alternative distribution channel, and enables non-technical users to use your API without code. --- ## 🔵 LOW PRIORITY ### 🔵 No Public API Docs **Severity:** LOW | **Category:** DEVELOPER EXPERIENCE No OpenAPI spec or API docs detected at standard paths. Developers (and AI agents) can't discover your API surface without documentation. **Action:** Publish an OpenAPI/Swagger spec at /openapi.yaml or /api-docs. Tools like Scalar or Swagger UI provide beautiful auto-generated docs. --- ### 🔵 Meta Description Too Long **Severity:** LOW | **Category:** SEO 187 chars. Google truncates at ~155 chars in search results. **Action:** Trim to under 155 characters. The most important benefits should come first. --- ### 🔵 No GitHub Link **Severity:** LOW | **Category:** BRAND No GitHub link found. For developer-facing products, GitHub presence is a strong trust signal. Developers often check GitHub before adopting a tool. **Action:** Create a GitHub organization page with your company profile. Even if code isn't open source, the profile with repos and activity builds credibility. --- ### 🔵 No Public Status Page **Severity:** LOW | **Category:** CREATIVE GAP No status page or uptime monitoring found. For SaaS products, a public status page (Instatus, Better Uptime) builds trust — it shows transparency and lets users self-diagnose outages. **Action:** Set up a free Instatus or Better Uptime status page. Link it from your footer. Enterprise customers require this before signing contracts. --- ## ✅ WHAT'S WORKING ### ✅ Excellent TTFB **Severity:** PASS | **Category:** PERFORMANCE 30ms — elite-tier response time. Faster than 95% of websites. --- ### ✅ robots.txt Present **Severity:** PASS | **Category:** SEO robots.txt returns 200 — crawlers can discover your crawl rules. --- ### ✅ sitemap.xml Present **Severity:** PASS | **Category:** SEO Sitemap returns 200 with 474 URLs. --- ### ✅ llms.txt Present **Severity:** PASS | **Category:** AI DISCOVERABILITY llms.txt returns 200. This site has AI discoverability infrastructure. --- ### ✅ agent.json Present **Severity:** PASS | **Category:** AI DISCOVERABILITY Agent manifest found — machine-readable capability card is in place. --- ### ✅ MCP Server Detected **Severity:** PASS | **Category:** AI DISCOVERABILITY Model Context Protocol server found. Claude, Cursor, and Windsurf users can add these tools in one config line — massive viral distribution channel. --- ### ✅ Good Title Tag **Severity:** PASS | **Category:** SEO "Zambo — The Trust Layer for AI Work" (35 chars) — well-sized title tag. --- ### ✅ Open Graph Tags Present **Severity:** PASS | **Category:** SEO OG title and description are set — shared links will render properly. --- ### ✅ OG Image Set **Severity:** PASS | **Category:** SEO Social share image is configured. --- ### ✅ Canonical Tag Present **Severity:** PASS | **Category:** SEO Canonical set to: https://zambo.dev --- ## 90-DAY ACTION PLAN ### Week 1-2: Fix the Bleeding - [ ] **Blank Page: /api** — Immediately fix or redirect /api - [ ] **No Call-to-Action Detected** — Add a prominent primary CTA above the fold: 'Start Free', 'Get Access', or 'Try It Now' - [ ] AI Directory Verification Required - [ ] Not in Major AI Directories - [ ] No Comparison Pages - [ ] No Product Demo or Video ### Month 1: Foundation - [ ] Missing Security Headers - [ ] MCP Registry Submission Check - [ ] No Email Capture - [ ] Minimal Social Links - [ ] No Affiliate/Referral Program - [ ] No Open Source Presence - [ ] No Workflow Automation Integration ### Month 2-3: Growth - [ ] No Public API Docs - [ ] Meta Description Too Long - [ ] No GitHub Link - [ ] No Public Status Page --- *Report generated by Achilles — the autonomous AI audit agent at zambo.dev* *Ghost audits powered by the Achilles x711.io engine* *Get your own free Ghost Audit at zambo.dev/ghost-audit* --- ## 📣 SHARE YOUR RESULTS Tweet your audit: https://twitter.com/intent/tweet?text=Just%20ran%20a%20Ghost%20Audit%20on%20my%20site%20via%20the%20Zambo%20MCP%20Stack%20%E2%80%94%20found%20the%20real%20issues%20killing%20my%20AI%20discoverability.%20Get%20yours%20free%3A%20https%3A%2F%2Fzambo.dev%2Fghost-audit%20%F0%9F%91%BB%20%40zambodotdev%20%23GhostAudit%20%23MCP --- ## ⚡ FIX THESE ISSUES WITH ZAMBO MCP Your audit is done. The fastest way to act on these findings is the Zambo MCP stack — 100+ tools inside Claude, Cursor, or Windsurf. No API key. No signup. **Add the Zambo MCP in 10 seconds — paste into Claude Desktop or Cursor:** ```json {"mcpServers":{"zambo":{"url":"https://zambo.dev/api/mcp"}}} ``` **Tools that directly address audit findings:** - `zambot_spark` — breakthrough strategy on your top CRITICAL finding - `zambro` — competitive positioning scan vs. your rivals from this report - `ghost_audit_site` — re-audit after you fix issues to verify improvement - `provibe_audit` — code quality scan if technical issues were flagged - `zambo_universal` — route any goal through the full 100+ tool stack **24-Hour Day Pass — $1.49 USDC on Base (no account needed):** 1. Send 1.49 USDC to `0xb753be5Eac5B29c711051DfF91279834e9C9b9AC` on Base mainnet 2. POST `https://zambo.dev/api/zambo-pass/day` with `{email}` + `X-Payment-Hash` header 3. Unlimited tool calls for 24 hours. Re-audit and fix live. **Monthly Zambo Pass — $49/mo:** Unlimited audits + all 100+ MCP tools + Ghost Audit monthly + LeadSignal Pro → https://zambo.dev/#zambo-pass **One-click install page:** https://zambo.dev/install *Powered by Achilles × Zambo Stack · zambo.dev*