WEBMCP AUDIT REPORT

https://columbiahonda.com/

scanned2026-11-09T09:50:30.016Z
rulepackrulepack-2026.10.1
scannerwebmcp-scanner/0.3.0
tools18
$ node scanner/bin/webmcp-scan.js https://columbiahonda.com/
live Live

Visible to real users: tools are registered through the native, flag-free WebMCP API. Any capable agent visiting this page today can see and call them.

D
security grade from deterministic rules only
0critical
0high
3medium
0low
2info

Origin trial tokens

kindfeatureoriginexpirysubdomainorigin matchesstatus
meta WebMCP https://www.columbiahonda.com:443 2027-03-30T00:00:00.000Z no no valid
meta WebMCP https://cdn-okp.confluencelocalmarketing.com:443 2027-03-30T00:00:00.000Z no no valid

Agent readiness: 18 of 19 checks pass

Can an AI agent find, open and understand this page? These checks read robots.txt, llms.txt, the sitemap, security.txt and the page's own metadata. They never affect the security grade; each one links to its fix and to the vendor document it rests on.

statuscheckevidencefinding
pass Page opens for a bot HTTP 200, "Columbia Honda | McLarty Automotive Group"
pass robots.txt present 2 group(s), 1 sitemap line(s)
pass Page allowed for every crawler User-agent: * allows /
pass On-demand assistant fetchers allowed ChatGPT-User, Claude-User, Perplexity-User allowed
pass AI search crawlers allowed OAI-SearchBot, Claude-SearchBot, PerplexityBot, Googlebot, Bingbot, Applebot allowed
pass Training crawlers none blocked (vendor default)
pass AI usage policy stated Content-Signal: ai-train=no, search=yes, ai-input=yes
pass Sitemap reachable urlset, 1114 <loc> entries (via robots.txt)
pass Sitemap declared in robots.txt https://www.columbiahonda.com/sitemap.xml
pass llms.txt "Columbia Honda", 49 link(s), 8 section(s), llms-full.txt too
info security.txt (RFC 9116) HTTP 404 site.security-txt-missing
n/a MCP: AI Catalog and Server Card no AI Catalog: no MCP server advertised
pass MCP in llms.txt links https://mcp.columbiahonda.com/columbia-honda/mcp
pass Indexable (no noindex) index,follow,noydir,noodp
pass <title> present "Columbia Honda | McLarty Automotive Group"
pass Meta description present 153 chars
pass Canonical URL declared https://www.columbiahonda.com/
pass Structured data (JSON-LD) AutoDealer, WebSite
pass Open Graph preview Columbia Honda | McLarty Automotive Group, no image
pass Document language en

Coverage

techniquestatustimeevidence
Native, flag offcomplete12625 ms4 frame(s), 9 tool(s)
Native, flag forced oncomplete11523 ms3 frame(s), 18 tool(s)
Document-start capture hookcomplete15279 ms7 frame(s), 9 tool(s)

No explicit Permissions-Policy: tools=… directive was observed; the specification default is self.

Tools

nametitledescriptionoriginsourceannotationsschema props
check_dealership_department_status Check a dealership department's (e.g. Sales, Service, Parts) phone number, today's hours, and whether it is open right now. Read-only. https://www.columbiahonda.com native readOnlyHint: true untrustedContentHint: false 1
check_dealership_awards List this dealership's awards, recognitions, and press mentions (e.g. manufacturer President's Awards, service-department wins), each with a title, date, publis… https://www.columbiahonda.com native readOnlyHint: true untrustedContentHint: false 0
check_ai_discovery_profile Get this dealership's real review rating (value, review count) and a list of its structured-data API endpoints (business, vehicle inventory, offers, shopper Q&A… https://www.columbiahonda.com native readOnlyHint: true untrustedContentHint: false 0
search_inventory Search the dealership's current new or used vehicle inventory by condition, make, model, and/or price range. Returns real matching vehicles with price, mileage,… https://www.columbiahonda.com native readOnlyHint: true untrustedContentHint: false 6
open_vehicle_page Navigate this browser tab to a specific vehicle's own detail page. Use the 'url' field from a search_inventory result. Only works for pages on this same dealer'… https://www.columbiahonda.com native 1
open_filtered_inventory Find vehicles matching the given filters AND open the dealer's real inventory page with those same filters already applied and visible. Use this (not search_inv… https://www.columbiahonda.com native 7
check_vehicle_availability Open this vehicle's 'Confirm It's Available' request form and fill it in with the given contact details. Only works on that specific vehicle's own detail page -… https://www.columbiahonda.com native 7
check_booking_availability Check whether a vehicle model can be booked for a test drive at this dealership, and which dates/times are open. Read-only: nothing is booked or opened. Pass 'm… https://www.columbiahonda.com native readOnlyHint: true untrustedContentHint: false 4
book_test_drive Stage a test drive request: opens the dealership's 'Schedule A Test Drive' page (if not already there) and fills in the vehicle, contact details and preferred d… https://www.columbiahonda.com native 11
book_test_drive Stage a test drive request: opens the dealership's 'Schedule A Test Drive' page (if not already there) and fills in the vehicle, contact details and preferred d… null native 11
check_ai_discovery_profile Get this dealership's real review rating (value, review count) and a list of its structured-data API endpoints (business, vehicle inventory, offers, shopper Q&A… null native readOnlyHint: true untrustedContentHint: false 0
check_booking_availability Check whether a vehicle model can be booked for a test drive at this dealership, and which dates/times are open. Read-only: nothing is booked or opened. Pass 'm… null native readOnlyHint: true untrustedContentHint: false 4
check_dealership_awards List this dealership's awards, recognitions, and press mentions (e.g. manufacturer President's Awards, service-department wins), each with a title, date, publis… null native readOnlyHint: true untrustedContentHint: false 0
check_dealership_department_status Check a dealership department's (e.g. Sales, Service, Parts) phone number, today's hours, and whether it is open right now. Read-only. null native readOnlyHint: true untrustedContentHint: false 1
check_vehicle_availability Open this vehicle's 'Confirm It's Available' request form and fill it in with the given contact details. Only works on that specific vehicle's own detail page -… null native 7
open_filtered_inventory Find vehicles matching the given filters AND open the dealer's real inventory page with those same filters already applied and visible. Use this (not search_inv… null native 7
open_vehicle_page Navigate this browser tab to a specific vehicle's own detail page. Use the 'url' field from a search_inventory result. Only works for pages on this same dealer'… null native 1
search_inventory Search the dealership's current new or used vehicle inventory by condition, make, model, and/or price range. Returns real matching vehicles with price, mileage,… null native readOnlyHint: true untrustedContentHint: false 6

Findings

DEPLOYMENT 1

MEDIUM DEPLOYMENT deterministic
deploy.origin-trial-token

Origin-Trial token problem: origin mismatch

An Origin-Trial token is present but registered for origin "https://cdn-okp.confluencelocalmarketing.com:443", which does not match this page's origin. signature_verified is always false: we decode the token offline and never fetch to validate it.

field origin-trial
{"feature":"WebMCP","origin":"https://cdn-okp.confluencelocalmarketing.com:443","expiry":"2027-03-30T00:00:00.000Z"}
$ mcpaudit-webmcp-scan --url 'https://columbiahonda.com/' --check deploy.origin-trial-token
How to fix

Issue a fresh token for this exact origin (scheme, host and port) in the Chrome origin trials console and replace the old one.

full explanation of deploy.origin-trial-token

SECURITY 2

MEDIUM SECURITY LLM08 deterministic
missing-annotations

Mutating tool ships without readOnlyHint

Tool "check_vehicle_availability" looks state-changing but declares no readOnlyHint. Agents use that flag to gate risky calls; without it they cannot tell this tool apart from a safe read.

tool check_vehicle_availability · field annotations
{}
$ mcpaudit-webmcp-scan --url 'https://columbiahonda.com/' --check missing-annotations
How to fix

Set readOnlyHint explicitly on every tool: true for reads, false for anything that changes state.

annotations: { readOnlyHint: false }
full explanation of missing-annotations
MEDIUM SECURITY LLM05 deterministic
schema-freeform-sink

Unvalidated free-form input on a sink-like parameter

Parameter "url" of tool "open_vehicle_page" accepts a free-form string with no enum/pattern/format. If it reaches a shell, filesystem, or outbound request, it is an injection/SSRF surface.

tool open_vehicle_page · field inputSchema.properties.url
{"type":"string","description":"A vehicle detail page url, as returned by search
$ mcpaudit-webmcp-scan --url 'https://columbiahonda.com/' --check schema-freeform-sink
How to fix

Constrain the schema (enum, pattern, format, maxLength) and validate again inside execute(): a schema is documentation for the agent, not authorisation.

url: { type: "string", format: "uri", pattern: "^https://example\\.com/", maxLength: 2048 }
full explanation of schema-freeform-sink

RECOMMENDED 2

INFO RECOMMENDED deterministic
schema.no-required

Schema has properties but no required list

Tool "search_inventory"'s inputSchema declares properties but no `required` array. Opinion: most tools have at least one mandatory argument; an empty required list often just means the author never filled it in.

tool search_inventory · field inputSchema.required
(absent)
$ mcpaudit-webmcp-scan --url 'https://columbiahonda.com/' --check schema.no-required
How to fix

List the arguments the tool cannot run without.

required: ["query"]
full explanation of schema.no-required
INFO RECOMMENDED deterministic
schema.no-required

Schema has properties but no required list

Tool "check_booking_availability"'s inputSchema declares properties but no `required` array. Opinion: most tools have at least one mandatory argument; an empty required list often just means the author never filled it in.

tool check_booking_availability · field inputSchema.required
(absent)
$ mcpaudit-webmcp-scan --url 'https://columbiahonda.com/' --check schema.no-required
How to fix

List the arguments the tool cannot run without.

required: ["query"]
full explanation of schema.no-required

READINESS 1

Registering your own tools?

Start from a config the checks above already pass.

Build your own WebMCP config

Need a detailed audit?

On request we run a detailed MCP audit and prepare everything you need: findings, fixes and ready configs.

Order an audit

This is an automated, point-in-time report from three browser observations of the page: native without a forced flag, native with the experimental feature forced on, and a document-start registration capture. No tool or declarative form was executed, no account was used, and hidden or interaction-only states may not be represented. Agent-readiness checks fetch robots.txt, llms.txt, the sitemap, security.txt and the AI Catalog once each and never affect the grade. The grade, when shown, reflects deterministic checks only and is not a certification. Job 5d56d64d397228ba. Rulepack rulepack-2026.10.1.