WEBMCP AUDIT REPORT

https://frankletamitsubishi.com/

scanned2026-11-03T14:04:33.419Z
rulepackrulepack-2026.10.1
scannerwebmcp-scanner/0.3.0
tools22
$ node scanner/bin/webmcp-scan.js https://frankletamitsubishi.com/
live Live

Visible to real users: tools are registered through the native, flag-free WebMCP API. Any capable agent visiting this page today can see and call them.

E
security grade from deterministic rules only
0critical
0high
4medium
9low
7info

Origin trial tokens

kindfeatureoriginexpirysubdomainorigin matchesstatus
meta WebMCP https://cdn-okp.confluencelocalmarketing.com:443 2027-03-30T00:00:00.000Z no no valid

Agent readiness: 19 of 19 checks pass

Can an AI agent find, open and understand this page? These checks read robots.txt, llms.txt, the sitemap, security.txt and the page's own metadata. They never affect the security grade; each one links to its fix and to the vendor document it rests on.

statuscheckevidencefinding
pass Page opens for a bot HTTP 200, "Mitsubishi Dealer near St. Louis, MO | Frank Leta Mitsubishi"
pass robots.txt present 2 group(s), 1 sitemap line(s)
pass Page allowed for every crawler User-agent: * allows /
pass On-demand assistant fetchers allowed ChatGPT-User, Claude-User, Perplexity-User allowed
pass AI search crawlers allowed OAI-SearchBot, Claude-SearchBot, PerplexityBot, Googlebot, Bingbot, Applebot allowed
pass Training crawlers none blocked (vendor default)
pass AI usage policy stated Content-Signal: search=yes, ai-input=yes, ai-train=yes
pass Sitemap reachable index, 6 <loc> entries (via robots.txt)
pass Sitemap declared in robots.txt https://frankletamitsubishi.com/sitemap_index.xml
pass llms.txt "Frank Leta Mitsubishi", 85 link(s), 10 section(s), llms-full.txt too
pass security.txt (RFC 9116) Contact and Expires present
n/a MCP: AI Catalog and Server Card no AI Catalog: no MCP server advertised
pass MCP in llms.txt links https://frankletamitsubishi.com/mcp
pass Indexable (no noindex) index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1 index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1
pass <title> present "Mitsubishi Dealer near St. Louis, MO | Frank Leta Mitsubishi"
pass Meta description present 158 chars
pass Canonical URL declared https://frankletamitsubishi.com/
pass Structured data (JSON-LD) WebSite, WebPage, Organization,LocalBusiness,AutoDealer, FAQPage
pass Open Graph preview Mitsubishi Dealer near St. Louis, MO, image
pass Document language en

Coverage

techniquestatustimeevidence
Native, flag offcomplete8975 ms1 frame(s), 22 tool(s)
Native, flag forced oncomplete7937 ms1 frame(s), 22 tool(s)
Document-start capture hookcomplete9159 ms1 frame(s), 23 tool(s)

No explicit Permissions-Policy: tools=… directive was observed; the specification default is self.

Tools

nametitledescriptionoriginsourceannotationsschema props
open_inventory Show vehicles for sale on this site, optionally filtered by condition, make, model or body style. https://frankletamitsubishi.com native 4
open_vehicle Open the detail page (photos, price, features) for a vehicle by VIN or stock number. https://frankletamitsubishi.com native 1
start_financing_application Open the secure pre-approval application (no impact on credit score). The customer fills it in themselves. https://frankletamitsubishi.com native 0
start_trade_in Open the instant cash offer tool to sell or trade in a car (license plate, VIN, or make and model). https://frankletamitsubishi.com native 0
schedule_service Open the online service appointment scheduler. https://frankletamitsubishi.com native 0
open_incentives Open the current Mitsubishi incentives and special offers page. https://frankletamitsubishi.com native 0
search_inventory Search new, used, and certified pre-owned vehicles currently for sale at Frank Leta Mitsubishi (Bridgeton, MO). Returns price, mileage, specs, VIN, and a link f… https://frankletamitsubishi.com native readOnlyHint: true untrustedContentHint: false 13
get_vehicle Full details for one vehicle by VIN or dealer stock number, or a not-found message if it is no longer for sale. https://frankletamitsubishi.com native readOnlyHint: true untrustedContentHint: false 1
list_incentives Current Mitsubishi cash rebates, special APR financing, and lease programs available at this dealership, by model year and model, with expiration dates. https://frankletamitsubishi.com native readOnlyHint: true untrustedContentHint: false 3
get_dealer_info Address, phone numbers, sales/service/parts hours, and whether each department is open right now at Frank Leta Mitsubishi. https://frankletamitsubishi.com native readOnlyHint: true untrustedContentHint: false 0
list_service_specials Current service department coupons and specials, with expiration dates and fine print. https://frankletamitsubishi.com native readOnlyHint: true untrustedContentHint: false 0
search_faqs Answers to common questions about buying, financing, trade-ins, warranties, and service at this dealership. https://frankletamitsubishi.com native readOnlyHint: true untrustedContentHint: false 1
get_financing_options How to finance a vehicle at Frank Leta Mitsubishi: pre-approval with no credit score impact, options for bad credit, no credit and first-time buyers, current ma… https://frankletamitsubishi.com native readOnlyHint: true untrustedContentHint: false 1
sell_or_trade_info How to sell a car or trade it in at Frank Leta Mitsubishi: instant cash offer online by license plate, VIN, or make/model, and how to request an appraisal. https://frankletamitsubishi.com native readOnlyHint: true untrustedContentHint: false 0
submit_lead Send the customer's request to Frank Leta Mitsubishi's sales, finance, or service team: a vehicle inquiry, test drive, trade-in, financing question, service app… https://frankletamitsubishi.com native readOnlyHint: false untrustedContentHint: false 14
check_dealership_awards List this dealership's awards, recognitions, and press mentions (e.g. manufacturer President's Awards, service-department wins), each with a title, date, publis… https://frankletamitsubishi.com native 0
check_ai_discovery_profile Get this dealership's real review rating (value, review count) and a list of its structured-data API endpoints (business, vehicle inventory, offers, shopper Q&A… https://frankletamitsubishi.com native 0
open_vehicle_page Navigate this browser tab to a specific vehicle's own detail page. Use the 'url' field from a search_inventory result. Only works for pages on this same dealer'… https://frankletamitsubishi.com native 1
open_filtered_inventory Find vehicles matching the given filters AND open the dealer's real inventory page with those same filters already applied and visible. Use this (not search_inv… https://frankletamitsubishi.com native 7
check_vehicle_availability Open this vehicle's 'Confirm It's Available' request form and fill it in with the given contact details. Only works on that specific vehicle's own detail page -… https://frankletamitsubishi.com native 7
check_booking_availability Check whether a vehicle model can be booked for a test drive at this dealership, and which dates/times are open. Read-only: nothing is booked or opened. Pass 'm… https://frankletamitsubishi.com native 4
book_test_drive Stage a test drive request: opens the dealership's 'Schedule A Test Drive' page (if not already there) and fills in the vehicle, contact details and preferred d… https://frankletamitsubishi.com native 11

Findings

DEPLOYMENT 1

MEDIUM DEPLOYMENT deterministic
deploy.origin-trial-token

Origin-Trial token problem: origin mismatch

An Origin-Trial token is present but registered for origin "https://cdn-okp.confluencelocalmarketing.com:443", which does not match this page's origin. signature_verified is always false: we decode the token offline and never fetch to validate it.

field origin-trial
{"feature":"WebMCP","origin":"https://cdn-okp.confluencelocalmarketing.com:443","expiry":"2027-03-30T00:00:00.000Z"}
$ mcpaudit-webmcp-scan --url 'https://frankletamitsubishi.com/' --check deploy.origin-trial-token
How to fix

Issue a fresh token for this exact origin (scheme, host and port) in the Chrome origin trials console and replace the old one.

full explanation of deploy.origin-trial-token

SECURITY 3

MEDIUM SECURITY LLM08 deterministic
missing-annotations

Mutating tool ships without readOnlyHint

Tool "check_vehicle_availability" looks state-changing but declares no readOnlyHint. Agents use that flag to gate risky calls; without it they cannot tell this tool apart from a safe read.

tool check_vehicle_availability · field annotations
{}
$ mcpaudit-webmcp-scan --url 'https://frankletamitsubishi.com/' --check missing-annotations
How to fix

Set readOnlyHint explicitly on every tool: true for reads, false for anything that changes state.

annotations: { readOnlyHint: false }
full explanation of missing-annotations
MEDIUM SECURITY deterministic
name-duplicate

Two tools share the same name

The name "search_inventory" is registered more than once (origins https://frankletamitsubishi.com and https://frankletamitsubishi.com). An agent cannot disambiguate them, and a duplicate from another frame can shadow a trusted tool.

tool search_inventory · field name
search_inventory
$ mcpaudit-webmcp-scan --url 'https://frankletamitsubishi.com/' --check name-duplicate
How to fix

Give every tool a unique name and register it once per document. Abort the previous registration (AbortController) before re-registering on route changes.

full explanation of name-duplicate
MEDIUM SECURITY LLM05 deterministic
schema-freeform-sink

Unvalidated free-form input on a sink-like parameter

Parameter "url" of tool "open_vehicle_page" accepts a free-form string with no enum/pattern/format. If it reaches a shell, filesystem, or outbound request, it is an injection/SSRF surface.

tool open_vehicle_page · field inputSchema.properties.url
{"type":"string","description":"A vehicle detail page url, as returned by search
$ mcpaudit-webmcp-scan --url 'https://frankletamitsubishi.com/' --check schema-freeform-sink
How to fix

Constrain the schema (enum, pattern, format, maxLength) and validate again inside execute(): a schema is documentation for the agent, not authorisation.

url: { type: "string", format: "uri", pattern: "^https://example\\.com/", maxLength: 2048 }
full explanation of schema-freeform-sink

COMPATIBILITY 9

LOW COMPATIBILITY deterministic
compat.mcp-only-hints

MCP-only annotation hint has no effect in WebMCP

Tool "search_inventory" sets openWorldHint, which exist in MCP's fuller annotation set but are NOT members of WebMCP's ToolAnnotations (readOnlyHint, untrustedContentHint, consequentialHint, debugging). They will be ignored, not enforced.

tool search_inventory · field openWorldHint
openWorldHint
$ mcpaudit-webmcp-scan --url 'https://frankletamitsubishi.com/' --check compat.mcp-only-hints
How to fix

Express the intent with the WebMCP set: readOnlyHint, consequentialHint, untrustedContentHint, debugging.

full explanation of compat.mcp-only-hints
LOW COMPATIBILITY deterministic
compat.mcp-only-hints

MCP-only annotation hint has no effect in WebMCP

Tool "get_vehicle" sets openWorldHint, which exist in MCP's fuller annotation set but are NOT members of WebMCP's ToolAnnotations (readOnlyHint, untrustedContentHint, consequentialHint, debugging). They will be ignored, not enforced.

tool get_vehicle · field openWorldHint
openWorldHint
$ mcpaudit-webmcp-scan --url 'https://frankletamitsubishi.com/' --check compat.mcp-only-hints
How to fix

Express the intent with the WebMCP set: readOnlyHint, consequentialHint, untrustedContentHint, debugging.

full explanation of compat.mcp-only-hints
LOW COMPATIBILITY deterministic
compat.mcp-only-hints

MCP-only annotation hint has no effect in WebMCP

Tool "list_incentives" sets openWorldHint, which exist in MCP's fuller annotation set but are NOT members of WebMCP's ToolAnnotations (readOnlyHint, untrustedContentHint, consequentialHint, debugging). They will be ignored, not enforced.

tool list_incentives · field openWorldHint
openWorldHint
$ mcpaudit-webmcp-scan --url 'https://frankletamitsubishi.com/' --check compat.mcp-only-hints
How to fix

Express the intent with the WebMCP set: readOnlyHint, consequentialHint, untrustedContentHint, debugging.

full explanation of compat.mcp-only-hints
LOW COMPATIBILITY deterministic
compat.mcp-only-hints

MCP-only annotation hint has no effect in WebMCP

Tool "get_dealer_info" sets openWorldHint, which exist in MCP's fuller annotation set but are NOT members of WebMCP's ToolAnnotations (readOnlyHint, untrustedContentHint, consequentialHint, debugging). They will be ignored, not enforced.

tool get_dealer_info · field openWorldHint
openWorldHint
$ mcpaudit-webmcp-scan --url 'https://frankletamitsubishi.com/' --check compat.mcp-only-hints
How to fix

Express the intent with the WebMCP set: readOnlyHint, consequentialHint, untrustedContentHint, debugging.

full explanation of compat.mcp-only-hints
LOW COMPATIBILITY deterministic
compat.mcp-only-hints

MCP-only annotation hint has no effect in WebMCP

Tool "list_service_specials" sets openWorldHint, which exist in MCP's fuller annotation set but are NOT members of WebMCP's ToolAnnotations (readOnlyHint, untrustedContentHint, consequentialHint, debugging). They will be ignored, not enforced.

tool list_service_specials · field openWorldHint
openWorldHint
$ mcpaudit-webmcp-scan --url 'https://frankletamitsubishi.com/' --check compat.mcp-only-hints
How to fix

Express the intent with the WebMCP set: readOnlyHint, consequentialHint, untrustedContentHint, debugging.

full explanation of compat.mcp-only-hints
LOW COMPATIBILITY deterministic
compat.mcp-only-hints

MCP-only annotation hint has no effect in WebMCP

Tool "search_faqs" sets openWorldHint, which exist in MCP's fuller annotation set but are NOT members of WebMCP's ToolAnnotations (readOnlyHint, untrustedContentHint, consequentialHint, debugging). They will be ignored, not enforced.

tool search_faqs · field openWorldHint
openWorldHint
$ mcpaudit-webmcp-scan --url 'https://frankletamitsubishi.com/' --check compat.mcp-only-hints
How to fix

Express the intent with the WebMCP set: readOnlyHint, consequentialHint, untrustedContentHint, debugging.

full explanation of compat.mcp-only-hints
LOW COMPATIBILITY deterministic
compat.mcp-only-hints

MCP-only annotation hint has no effect in WebMCP

Tool "get_financing_options" sets openWorldHint, which exist in MCP's fuller annotation set but are NOT members of WebMCP's ToolAnnotations (readOnlyHint, untrustedContentHint, consequentialHint, debugging). They will be ignored, not enforced.

tool get_financing_options · field openWorldHint
openWorldHint
$ mcpaudit-webmcp-scan --url 'https://frankletamitsubishi.com/' --check compat.mcp-only-hints
How to fix

Express the intent with the WebMCP set: readOnlyHint, consequentialHint, untrustedContentHint, debugging.

full explanation of compat.mcp-only-hints
LOW COMPATIBILITY deterministic
compat.mcp-only-hints

MCP-only annotation hint has no effect in WebMCP

Tool "sell_or_trade_info" sets openWorldHint, which exist in MCP's fuller annotation set but are NOT members of WebMCP's ToolAnnotations (readOnlyHint, untrustedContentHint, consequentialHint, debugging). They will be ignored, not enforced.

tool sell_or_trade_info · field openWorldHint
openWorldHint
$ mcpaudit-webmcp-scan --url 'https://frankletamitsubishi.com/' --check compat.mcp-only-hints
How to fix

Express the intent with the WebMCP set: readOnlyHint, consequentialHint, untrustedContentHint, debugging.

full explanation of compat.mcp-only-hints
LOW COMPATIBILITY deterministic
compat.mcp-only-hints

MCP-only annotation hint has no effect in WebMCP

Tool "submit_lead" sets destructiveHint, idempotentHint, openWorldHint, which exist in MCP's fuller annotation set but are NOT members of WebMCP's ToolAnnotations (readOnlyHint, untrustedContentHint, consequentialHint, debugging). They will be ignored, not enforced.

tool submit_lead · field destructiveHint,idempotentHint,openWorldHint
destructiveHint, idempotentHint, openWorldHint
$ mcpaudit-webmcp-scan --url 'https://frankletamitsubishi.com/' --check compat.mcp-only-hints
How to fix

Express the intent with the WebMCP set: readOnlyHint, consequentialHint, untrustedContentHint, debugging.

full explanation of compat.mcp-only-hints

RECOMMENDED 7

INFO RECOMMENDED deterministic
schema.no-required

Schema has properties but no required list

Tool "open_inventory"'s inputSchema declares properties but no `required` array. Opinion: most tools have at least one mandatory argument; an empty required list often just means the author never filled it in.

tool open_inventory · field inputSchema.required
(absent)
$ mcpaudit-webmcp-scan --url 'https://frankletamitsubishi.com/' --check schema.no-required
How to fix

List the arguments the tool cannot run without.

required: ["query"]
full explanation of schema.no-required
INFO RECOMMENDED deterministic
schema.no-required

Schema has properties but no required list

Tool "search_inventory"'s inputSchema declares properties but no `required` array. Opinion: most tools have at least one mandatory argument; an empty required list often just means the author never filled it in.

tool search_inventory · field inputSchema.required
(absent)
$ mcpaudit-webmcp-scan --url 'https://frankletamitsubishi.com/' --check schema.no-required
How to fix

List the arguments the tool cannot run without.

required: ["query"]
full explanation of schema.no-required
INFO RECOMMENDED deterministic
schema.no-required

Schema has properties but no required list

Tool "list_incentives"'s inputSchema declares properties but no `required` array. Opinion: most tools have at least one mandatory argument; an empty required list often just means the author never filled it in.

tool list_incentives · field inputSchema.required
(absent)
$ mcpaudit-webmcp-scan --url 'https://frankletamitsubishi.com/' --check schema.no-required
How to fix

List the arguments the tool cannot run without.

required: ["query"]
full explanation of schema.no-required
INFO RECOMMENDED deterministic
schema.no-required

Schema has properties but no required list

Tool "search_faqs"'s inputSchema declares properties but no `required` array. Opinion: most tools have at least one mandatory argument; an empty required list often just means the author never filled it in.

tool search_faqs · field inputSchema.required
(absent)
$ mcpaudit-webmcp-scan --url 'https://frankletamitsubishi.com/' --check schema.no-required
How to fix

List the arguments the tool cannot run without.

required: ["query"]
full explanation of schema.no-required
INFO RECOMMENDED deterministic
schema.no-required

Schema has properties but no required list

Tool "get_financing_options"'s inputSchema declares properties but no `required` array. Opinion: most tools have at least one mandatory argument; an empty required list often just means the author never filled it in.

tool get_financing_options · field inputSchema.required
(absent)
$ mcpaudit-webmcp-scan --url 'https://frankletamitsubishi.com/' --check schema.no-required
How to fix

List the arguments the tool cannot run without.

required: ["query"]
full explanation of schema.no-required
INFO RECOMMENDED deterministic
schema.no-required

Schema has properties but no required list

Tool "search_inventory"'s inputSchema declares properties but no `required` array. Opinion: most tools have at least one mandatory argument; an empty required list often just means the author never filled it in.

tool search_inventory · field inputSchema.required
(absent)
$ mcpaudit-webmcp-scan --url 'https://frankletamitsubishi.com/' --check schema.no-required
How to fix

List the arguments the tool cannot run without.

required: ["query"]
full explanation of schema.no-required
INFO RECOMMENDED deterministic
schema.no-required

Schema has properties but no required list

Tool "check_booking_availability"'s inputSchema declares properties but no `required` array. Opinion: most tools have at least one mandatory argument; an empty required list often just means the author never filled it in.

tool check_booking_availability · field inputSchema.required
(absent)
$ mcpaudit-webmcp-scan --url 'https://frankletamitsubishi.com/' --check schema.no-required
How to fix

List the arguments the tool cannot run without.

required: ["query"]
full explanation of schema.no-required

Registering your own tools?

Start from a config the checks above already pass.

Build your own WebMCP config

Need a detailed audit?

On request we run a detailed MCP audit and prepare everything you need: findings, fixes and ready configs.

Order an audit

This is an automated, point-in-time report from three browser observations of the page: native without a forced flag, native with the experimental feature forced on, and a document-start registration capture. No tool or declarative form was executed, no account was used, and hidden or interaction-only states may not be represented. Agent-readiness checks fetch robots.txt, llms.txt, the sitemap, security.txt and the AI Catalog once each and never affect the grade. The grade, when shown, reflects deterministic checks only and is not a certification. Job 08dea208b68dd198. Rulepack rulepack-2026.10.1.