# AX Check: paloaltonetworks.com
Checked 2026-11-05.

Docs guide agents well, but pricing stays a guessing game
The homepage links to a well-organized docs index and quickstart, but no pricing page was ever found, forcing agents to estimate costs from outside knowledge.

## Onboarding needs a login

## Coding sessions
All three independent sessions completed. Two (DeepSeek V4.1 Flash, Kimi K3) produced ballpark price figures by inferring from general licensing patterns rather than a sourced pricing page, while Qwen 3.8 Max described the subscription and quote-based model but gave no cost estimate at all, since no pricing content was ever retrieved.

### DeepSeek V4.1 Flash
[View public run](https://agents.withgauge.com/p/runs/198fffc8-450d-4125-968b-3e6994f9bf7b) · [Read transcript](https://www.ax-check.com/paloaltonetworks.com/sessions/deepseek.json)
Gave ballpark costs per product line with stated assumptions: US list prices, hardware model tier, per-user or per-endpoint per year, PAYG vs BYOL, quote-based sales and a 30-day trial. The figures came from memory, not fetched sources. (seq 64)
#### End-to-end onboarding
- **Onboarding needs a login**: The agent never obtained real Prisma Cloud credentials during the session. It explicitly checked the environment for Palo Alto/Prisma credentials and found none, then wrote an example script and tested it with dummy credentials, which correctly reached the hosted login endpoint but failed authentication with a 401 invalid_credentials error. No authenticated operation against the real product was ever demonstrated.
  Event 6:

  ```text
  Network is up and Python 3.12 is present, but I see no Palo Alto credentials or tenant in the environment.
  ```
  Event 61:

  ```text
  Status Code: 401
  API (https://api.prismacloud.io/login) responded with an error
  {"message":"invalid_credentials"}
  ```
  Event 64:

  ```text
  The single blocker is that this sandbox has no Palo Alto tenant or keys.
  ```

#### Hallucinated URLs
None identified in this transcript.

#### Blockers
- **No Prisma Cloud tenant or access key available**: The sandbox environment contains no Palo Alto Networks or Prisma Cloud credentials, and none could be self-provisioned (Prisma Cloud requires a paid/trial tenant with console-issued access keys). This is a missing-credentials limitation of the test environment, not a product defect—confirmed when dummy credentials correctly reached the live login endpoint but were rejected with a standard 401.
  Event 9:

  ```text
  I see no Palo Alto credentials or tenant in the environment.
  ```
  Event 61:

  ```text
  Status Code: 401
  API (https://api.prismacloud.io/login) responded with an error
  {"message":"invalid_credentials"}
  ```
- **prismacloud-api SDK missing a declared dependency**: Installing the official prismacloud-api package (v5.3.0) via pip and importing it immediately failed because the package does not declare update-checker as a dependency, forcing a manual second install before the SDK could be used. This is a product/packaging defect in the official SDK, not an agent or environment issue.
  Event 28:

  ```text
  ModuleNotFoundError: No module named 'update_checker'
  ```

#### Suggested Changes
- **Add update-checker as a declared dependency of prismacloud-api**: In the prismacloud-api package's setup.py/pyproject.toml (PyPI release 5.3.0), add update-checker to install_requires so a fresh 'pip install prismacloud-api' does not fail on import with ModuleNotFoundError. Verify by installing the package into a clean virtualenv and running 'python3 -c "from prismacloud.api import pc_api"' without a separate manual install step.
  Event 28:

  ```text
  ModuleNotFoundError: No module named 'update_checker'
  ```

### Kimi K3
[View public run](https://agents.withgauge.com/p/runs/e67676bb-0ed4-4abf-b476-5cc95c33814e) · [Read transcript](https://www.ax-check.com/paloaltonetworks.com/sessions/kimi.json)
The agent gave price figures with their basis: about $1–2/hr VM-Series pay-as-you-go plus cloud compute, BYOL in the low tens of thousands, and XSOAR per-seat or per-GB annual. No sources were checked. (seq 2)
#### End-to-end onboarding
- **End-to-end onboarding not demonstrated**: The agent never attempted to obtain credentials or call any Palo Alto Networks product/API. It reasoned entirely from prior knowledge that no self-serve API key or free tier exists, and stopped without issuing any tool calls, API requests, or sign-up attempts. No credentials were obtained and no authenticated operation was performed.
  Event 2:

  ```text
  There's no developer workflow I can act on, so I'm stopping rather than faking a demo.
  ```
  Event 2:

  ```text
  No self-serve account creation — trials need sales approval.
  ```

#### Hallucinated URLs
None identified in this transcript.

#### Blockers
- **No self-serve API access for Palo Alto Networks products**: The agent determined (without making any tool calls to verify) that Palo Alto Networks offerings (PAN-OS/NGFW, Cortex XSOAR, Prisma Cloud, Strata Cloud Manager) all require enterprise licensing, sales-approved trials, or self-hosted infrastructure rather than an instant-signup API key. This is a product/market characteristic (enterprise sales model) rather than an agent error, though it's worth noting the agent did not attempt any live tool call, request, or sign-up flow to confirm this firsthand before stopping.
  Event 2:

  ```text
  Palo Alto Networks doesn't have a lightweight, hosted developer product with a free tier and instant API credentials that I can act on.
  ```
  Event 2:

  ```text
  No public sandbox or demo API endpoint I can hit without credentials.
  ```
- **Only free option requires a local Docker stack, which was disallowed**: Cortex XSOAR Community Edition was identified as the one free path, but it requires standing up a self-hosted server, which conflicts with the session's explicit instruction to avoid local service stacks. This is a mismatch between session constraints and product offering, not a product defect.
  Event 2:

  ```text
  The one "free" option (XSOAR Community Edition) is a self-hosted Docker stack, which you asked me to avoid.
  ```

#### Suggested Changes
None identified in this transcript.

### Qwen 3.8 Max
[View public run](https://agents.withgauge.com/p/runs/bb9ba105-6723-4653-85ac-3f21ebd2f5a2) · [Read transcript](https://www.ax-check.com/paloaltonetworks.com/sessions/qwen.json)
Described the license, subscription and credit model but gave no cost figure or estimate, citing quote-based pricing. It fetched no pricing source, so the model is unsourced and still has no cost basis. (seq 81, seq 82)
#### End-to-end onboarding
- **Onboarding needs a login**: The agent never obtained real Palo Alto Networks credentials during the session. It checked environment variables and found none, attempted to reach a cloud API hostname which failed DNS resolution, and the live code path explicitly exits with an error demanding PAN_HOST and PAN_API_KEY. Only an offline, local dry-run (no network call to the actual product) was verified; the authenticated --live path against a real firewall or Panorama instance was never exercised.
  Event 6:

  ```text
  PI_CODING_AGENT=true
  PI_REASONING_LEVEL=<redacted>
  PI_SESSION_FILE=<redacted>
  PI_PROVIDER=<redacted>
  PI_MODEL=<redacted>
  PI_SESSION_ID=<redacted>
  PI_GATEWAY_API_KEY=<redacted>
  ```
  Event 11:

  ```text
  curl: (6) Could not resolve host: api.scm.paloaltonetworks.com
  api.scm:000
  ```
  Event 80:

  ```text
  Missing credentials. Set PAN_HOST plus PAN_API_KEY (or PAN_USERNAME + PAN_PASSWORD), or run without --live.
  exit=2
  ```
  Event 82:

  ```text
  No `PAN_*` env vars, no API key, no reachable firewall or Panorama instance.
  ```

#### Hallucinated URLs
None identified in this transcript.

#### Blockers
- **No PAN-OS device credentials or reachable instance available**: The sandbox had no PAN_HOST, PAN_API_KEY, or PAN_USERNAME/PASSWORD set, and no firewall or Panorama instance was reachable. This is a missing-credentials/test-environment limitation rather than a product defect -- the product legitimately requires a licensed device or Panorama instance to test against, and there is no free developer sandbox.
  Event 82:

  ```text
  No `PAN_*` env vars, no API key, no reachable firewall or Panorama instance.
  ```
  Event 80:

  ```text
  Missing credentials. Set PAN_HOST plus PAN_API_KEY (or PAN_USERNAME + PAN_PASSWORD), or run without --live.
  exit=2
  ```
- **Cloud API hostname unreachable from sandbox network**: A guessed/expected Strata Cloud Manager API hostname failed to resolve from the sandbox, which appears to be a network/test-environment limitation (DNS egress restriction) rather than a confirmed product or agent error, since pan.dev and PyPI were reachable fine.
  Event 11:

  ```text
  curl: (6) Could not resolve host: api.scm.paloaltonetworks.com
  api.scm:000
  ```

#### Suggested Changes
- **Offer a free or trial developer sandbox for pan-os-python**: Testing surfaced that there is no way to rehearse SDK calls against a real PAN-OS device without a paid license or lab hardware. Add a hosted trial firewall/Panorama instance (or a documented free sandbox) referenced from the pan-os-python PyPI page or GitHub README so developers can validate --live code paths without owning hardware. Verify by having a fresh developer run the SDK's create()/commit() against the trial instance successfully.
  Event 82:

  ```text
  there is no free developer sandbox, so I have no way to rehearse against a real device
  ```
- **Clarify which API (XML vs Strata Cloud Manager JSON/OAuth2) applies to a given deployment**: The agent had to infer, without authoritative guidance, that PAN-OS XML API and Strata Cloud Manager's JSON/OAuth2 API are separate systems requiring different credentials. Add a decision note early in the pan-os-python README or pan.dev quickstart stating which product line (legacy firewall/Panorama vs Strata Cloud Manager) uses which API and credential type, so developers do not have to guess hostnames like api.scm.paloaltonetworks.com. Verify by confirming a new reader can determine the correct API/hostname before writing code.
  Event 11:

  ```text
  curl: (6) Could not resolve host: api.scm.paloaltonetworks.com
  api.scm:000
  ```
  Event 82:

  ```text
  PAN runs two divergent APIs at once (legacy XML on PAN-OS vs. OAuth2/JSON on Strata Cloud Manager), so I have to know which world a deployment lives in before writing a line.
  ```

### Task given to each agent
Help me build a simple example using Palo Alto Networks. Tell me how pricing works, and briefly tell me whether this product will be easy for you to manage. Let me know if you get blocked. If this product has no developer workflow you can act on, say so plainly and stop. Stay light: use the hosted product through its SDK or API. Do not start local service stacks or wait for long-running commands; if the quickstart requires either, say so plainly and stop.

No product credentials were supplied and no purchases were authorized.

## Score: B · 76/100 (provisional)
Grades come from completed site checks. Coding sessions and skipped checks do not affect the score.

### Clarity
- **Failed** — Homepage answers Markdown requests

  ```text
  Homepage returned text/html for a text/markdown request; no Markdown representation served.
  ```

- **Pass** — llms.txt provides an actionable documentation index

  ```text
  llms.txt returns 200 with organized product sections linking to docs and product pages.
  ```

- **Pass** — llms.txt provides navigation guidance

  ```text
  llms.txt groups links under labeled sections (Cortex, Network Security, SASE, Identity) with descriptions.
  ```

- **Pass** — llms.txt mentions offered API, MCP, and skills

  ```text
  llms.txt mentions MCP data access under Agentic Identities and links API/cloud security surfaces.
  ```

- **Pass** — A compact guide representation exists

  ```text
  llms.txt served as text/markdown with organized sections linking docs and product surfaces.
  ```

- **Pass** — A focused guide is directly retrievable

  ```text
  llms.txt is directly retrievable as a standalone Markdown guide with starting guidance.
  ```

- **Pass** — Equivalent instructions fit a token budget

  ```text
  llms.txt is 4155 tokens, well under the 8000-token budget.
  ```

- **Skipped** — Product-docs links survive format changes

  ```text
  Homepage Markdown unsupported, so link preservation across formats cannot be measured.
  ```

- **Skipped** — The compact guide is independently actionable

  ```text
  No standalone compact agent guide was fetched; only a datasheet and docs index.
  ```

- **Pass** — Install and next-step links resolve

  ```text
  Sampled install/next-step links (docs.paloaltonetworks.com/ngfw, QuickStart datasheet) returned HTTP 200.
  ```


### Onboarding
- **Pass** — Docs lead to a relevant quickstart

  ```text
  NGFW docs page lists a Quick Start section and Getting Started Guide with concrete steps.
  ```

- **Skipped** — Installation commands are extractable

  ```text
  Fetched docs are firewall admin guides; no install commands for a developer package appear.
  ```

- **Skipped** — Code examples are available without interaction

  ```text
  No code examples appear in the fetched NGFW docs or datasheet pages.
  ```

- **Skipped** — Prerequisites and auth boundaries are explicit

  ```text
  No API auth or prerequisite section was fetched for a developer product.
  ```


### Pricing
- **Failed** — Agents identify pricing and its assumptions

  ```text
  3 of 3 sessions were judged on pricing; 1 fell short. DeepSeek V4.1 Flash: Gave ballpark costs per product line with stated assumptions: US list prices, hardware model tier, per-user or per-endpoint per year, PAYG vs BYOL, quote-based sales and a 30-day trial. The figures came from memory, not fetched sources. (seq 64) Kimi K3: The agent gave price figures with their basis: about $1–2/hr VM-Series pay-as-you-go plus cloud compute, BYOL in the low tens of thousands, and XSOAR per-seat or per-GB annual. No sources were checked. (seq 2) Qwen 3.8 Max: Described the license, subscription and credit model but gave no cost figure or estimate, citing quote-based pricing. It fetched no pricing source, so the model is unsourced and still has no cost basis. (seq 81, seq 82) This behavioural item does not affect the fast grade.
  ```

- **Skipped** — Pricing is readable without interaction

  ```text
  Only the homepage was fetched; no pricing page content was retrieved for Palo Alto Networks.
  ```

- **Skipped** — Prices are stated, not gated

  ```text
  No pricing page was fetched, so stated prices cannot be confirmed or denied.
  ```

- **Skipped** — Pricing units and limits are explicit

  ```text
  No pricing page was fetched, so units and limits are not evidenced.
  ```


### Activation
- **Skipped** — An API reference or OpenAPI spec is reachable

  ```text
  No API reference or OpenAPI spec was fetched; docs pages are product guides, not API references.
  ```

- **Skipped** — An MCP server is documented and well-formed

  ```text
  No MCP server documentation was fetched; llms.txt only mentions MCP in an identity-security marketing blurb.
  ```

- **Skipped** — A CLI install path is documented

  ```text
  No CLI install path was fetched; docs cover firewall/PAN-OS administration, not a developer CLI.
  ```

- **Skipped** — SDK packages resolve on their registries

  ```text
  No SDK or package registry lookup was supplied, so package resolution cannot be judged.
  ```

- **Skipped** — Agent skills are published

  ```text
  No agent skills were offered or fetched in the supplied evidence.
  ```



[Full report data](https://www.ax-check.com/paloaltonetworks.com/report.json)