WEBMCP AUDIT REPORT

https://textmycardealdemo.dealeron.com/searchnew.aspx

scanned2026-11-03T16:40:02.074Z
rulepackrulepack-2026.10.1
scannerwebmcp-scanner/0.3.0
tools10
$ node scanner/bin/webmcp-scan.js https://textmycardealdemo.dealeron.com/searchnew.aspx
dark Dark (flagged only)

Registered under the flag only, invisible to every real user. Nobody without that experimental flag or an origin-trial token sees these tools yet. Reason: token present but native surface still absent (possible browser/implementation divergence).

C
security grade from deterministic rules only
0critical
1high
0medium
0low
1info

Origin trial tokens

kindfeatureoriginexpirysubdomainorigin matchesstatus
meta WebMCP https://textmycardealdemo.dealeron.com:443 2027-03-30T00:00:00.000Z no no valid

Agent readiness: 17 of 18 checks pass

Can an AI agent find, open and understand this page? These checks read robots.txt, llms.txt, the sitemap, security.txt and the page's own metadata. They never affect the security grade; each one links to its fix and to the vendor document it rests on.

statuscheckevidencefinding
pass Page opens for a bot HTTP 200, "Kia Vehicle Inventory - Dover Kia dealer in Dover DE - New a"
pass robots.txt present 2 group(s), 1 sitemap line(s)
pass Page allowed for every crawler User-agent: * allows /searchnew.aspx
pass On-demand assistant fetchers allowed ChatGPT-User, Claude-User, Perplexity-User allowed
pass AI search crawlers allowed OAI-SearchBot, Claude-SearchBot, PerplexityBot, Googlebot, Bingbot, Applebot allowed
pass Training crawlers none blocked (vendor default)
pass AI usage policy stated Content-Signal: ai-train=no, search=yes, ai-input=yes
pass Sitemap reachable urlset, 1066 <loc> entries (via robots.txt)
pass Sitemap declared in robots.txt https://textmycardealdemo.dealeron.com/sitemap.xml
pass llms.txt "Text My Car Deal OnMarketplace Partner", 41 link(s), 7 section(s), llms-full.txt too
info security.txt (RFC 9116) HTTP 404 site.security-txt-missing
n/a MCP: AI Catalog and Server Card no AI Catalog: no MCP server advertised
n/a MCP in llms.txt no MCP server advertised
pass Indexable (no noindex) index,follow,noydir,noodp
pass <title> present "Kia Vehicle Inventory - Dover Kia dealer in Dover DE - New and Used Ki"
pass Meta description present 67 chars
pass Canonical URL declared https://textmycardealdemo.dealeron.com/searchnew.aspx
pass Structured data (JSON-LD) ItemList, AutoDealer, WebSite
pass Open Graph preview Kia Vehicle Inventory - Dover Kia dealer in Dover , no image
pass Document language en

Coverage

techniquestatustimeevidence
Native, flag offcomplete8143 ms3 frame(s), 0 tool(s)
Native, flag forced oncomplete7418 ms3 frame(s), 0 tool(s)
Document-start capture hookcomplete7680 ms3 frame(s), 10 tool(s)

No explicit Permissions-Policy: tools=… directive was observed; the specification default is self.

Tools

nametitledescriptionoriginsourceannotationsschema props
list_offer_vehicles List vehicles on this page that have an exclusive price offer. Returns stock number, a short title and whether the price is already unlocked for this visitor. https://textmycardealdemo.dealeron.com hook readOnlyHint: true untrustedContentHint: true 0
unlock_vehicle_price Open the price unlock form for a vehicle and prefill the customer's details. Before calling, ask the user for their first name, last name, phone number and ZIP … https://textmycardealdemo.dealeron.com hook consequentialHint: true 7
accept_consent_and_submit Tick the SMS consent box on the open price unlock form and submit it, which texts a verification code to the customer. Call ONLY after you showed the user the e… https://textmycardealdemo.dealeron.com hook consequentialHint: true 1
submit_otp_code Enter the 6-digit verification code the user received by text into the open price unlock form and verify it, which completes the request. Ask the user for the c… https://textmycardealdemo.dealeron.com hook consequentialHint: true 1
check_availability Ask the dealer to confirm a vehicle is still available (the "Confirm Availability" button on the page). Use when the user asks if a car is in stock or available… https://textmycardealdemo.dealeron.com hook consequentialHint: true 6
confirm_availability Tick the SMS consent box on the filled availability request form and submit it. Call ONLY after you showed the user the exact consent text from check_availabili… https://textmycardealdemo.dealeron.com hook consequentialHint: true 1
submit_availability_code Enter the 6-digit verification code the user received by text into the open availability request form and verify it, which completes the request. Ask the user f… https://textmycardealdemo.dealeron.com hook consequentialHint: true 1
schedule_test_drive Book a test drive. Call first with only stock_number to get open dates, times and any optional extras. Ask the user to pick a date and time, and ask for their f… https://textmycardealdemo.dealeron.com hook consequentialHint: true 10
confirm_test_drive Tick the SMS consent box on the filled test drive form and submit it. Call ONLY after you showed the user the exact consent text from schedule_test_drive and th… https://textmycardealdemo.dealeron.com hook consequentialHint: true 1
submit_test_drive_code Enter the 6-digit verification code the user received by text into the open test drive form and verify it, which completes the request. Ask the user for the cod… https://textmycardealdemo.dealeron.com hook consequentialHint: true 1

Findings

DEPLOYMENT 1

HIGH DEPLOYMENT deterministic
deploy.dark-integration

WebMCP integration is registered but invisible to every real user

Tools register when the WebMCP Blink flag is forced on, but document.modelContext is NOT exposed without it: token present but native surface still absent (possible browser/implementation divergence). No real visitor's browser exposes this integration; a naive "N tools found" audit would misreport success.

field origin-trial
{"feature":"WebMCP","origin":"https://textmycardealdemo.dealeron.com:443","expiry":"2027-03-30T00:00:00.000Z","is_subdomain":true}
$ mcpaudit-webmcp-scan --url 'https://textmycardealdemo.dealeron.com/searchnew.aspx' --check deploy.dark-integration
How to fix

Register the origin for the WebMCP origin trial and serve the token in an Origin-Trial response header or a <meta http-equiv="origin-trial"> tag on every page that registers tools. Re-audit: the status should turn Live.

<meta http-equiv="origin-trial" content="TOKEN_FROM_CHROME_ORIGIN_TRIALS">
full explanation of deploy.dark-integration

RECOMMENDED 1

INFO RECOMMENDED deterministic
schema.no-required

Schema has properties but no required list

Tool "schedule_test_drive"'s inputSchema declares properties but no `required` array. Opinion: most tools have at least one mandatory argument; an empty required list often just means the author never filled it in.

tool schedule_test_drive · field inputSchema.required
(absent)
$ mcpaudit-webmcp-scan --url 'https://textmycardealdemo.dealeron.com/searchnew.aspx' --check schema.no-required
How to fix

List the arguments the tool cannot run without.

required: ["query"]
full explanation of schema.no-required

READINESS 1

Registering your own tools?

Start from a config the checks above already pass.

Build your own WebMCP config

Need a detailed audit?

On request we run a detailed MCP audit and prepare everything you need: findings, fixes and ready configs.

Order an audit

This is an automated, point-in-time report from three browser observations of the page: native without a forced flag, native with the experimental feature forced on, and a document-start registration capture. No tool or declarative form was executed, no account was used, and hidden or interaction-only states may not be represented. Agent-readiness checks fetch robots.txt, llms.txt, the sitemap, security.txt and the AI Catalog once each and never affect the grade. The grade, when shown, reflects deterministic checks only and is not a certification. Job 50e32c4136614ced. Rulepack rulepack-2026.10.1.