WEBMCP AUDIT REPORT

https://textmycardealdemo.dealeron.com/

scanned2026-11-04T17:26:10.328Z
rulepackrulepack-2026.10.1
scannerwebmcp-scanner/0.3.0
tools24
$ node scanner/bin/webmcp-scan.js https://textmycardealdemo.dealeron.com/
dark Dark (flagged only)

Registered under the flag only, invisible to every real user. Nobody without that experimental flag or an origin-trial token sees these tools yet. Reason: token present but native surface still absent (possible browser/implementation divergence).

C
security grade from deterministic rules only
0critical
1high
0medium
0low
2info

Origin trial tokens

kindfeatureoriginexpirysubdomainorigin matchesstatus
meta WebMCP https://textmycardealdemo.dealeron.com:443 2027-03-30T00:00:00.000Z no no valid

Agent readiness: 17 of 18 checks pass

Can an AI agent find, open and understand this page? These checks read robots.txt, llms.txt, the sitemap, security.txt and the page's own metadata. They never affect the security grade; each one links to its fix and to the vendor document it rests on.

statuscheckevidencefinding
pass Page opens for a bot HTTP 200, "Dover Kia Dealer in Dover DE | Kia Dealership Delaware"
pass robots.txt present 2 group(s), 1 sitemap line(s)
pass Page allowed for every crawler User-agent: * allows /
pass On-demand assistant fetchers allowed ChatGPT-User, Claude-User, Perplexity-User allowed
pass AI search crawlers allowed OAI-SearchBot, Claude-SearchBot, PerplexityBot, Googlebot, Bingbot, Applebot allowed
pass Training crawlers none blocked (vendor default)
pass AI usage policy stated Content-Signal: ai-train=no, search=yes, ai-input=yes
pass Sitemap reachable urlset, 1066 <loc> entries (via robots.txt)
pass Sitemap declared in robots.txt https://textmycardealdemo.dealeron.com/sitemap.xml
pass llms.txt "Text My Car Deal OnMarketplace Partner", 41 link(s), 7 section(s), llms-full.txt too
info security.txt (RFC 9116) HTTP 404 site.security-txt-missing
n/a MCP: AI Catalog and Server Card no AI Catalog: no MCP server advertised
n/a MCP in llms.txt no MCP server advertised
pass Indexable (no noindex) index,follow,noydir,noodp
pass <title> present "Dover Kia Dealer in Dover DE | Kia Dealership Delaware"
pass Meta description present 104 chars
pass Canonical URL declared https://textmycardealdemo.dealeron.com/
pass Structured data (JSON-LD) AutoDealer, WebSite
pass Open Graph preview Dover Kia Dealer in Dover DE | Kia Dealership Dela, no image
pass Document language en

Coverage

techniquestatustimeevidence
Native, flag offcomplete34431 ms3 frame(s), 0 tool(s)
Native, flag forced oncomplete34227 ms3 frame(s), 24 tool(s)
Document-start capture hookcomplete34232 ms3 frame(s), 12 tool(s)

No explicit Permissions-Policy: tools=… directive was observed; the specification default is self.

Tools

nametitledescriptionoriginsourceannotationsschema props
list_offer_vehicles List vehicles on this page that have an exclusive price offer. Returns stock number, a short title and whether the price is already unlocked for this visitor. https://textmycardealdemo.dealeron.com native readOnlyHint: true untrustedContentHint: true 0
go_to_inventory Open the dealer's new or used vehicle inventory page. Use when the user wants to browse cars or this page has no vehicles. The page reloads; then call list_offe… https://textmycardealdemo.dealeron.com native 1
open_vehicle_details Open the full details page of one vehicle from list_offer_vehicles. Only when the user asks for more details or photos of that car; otherwise stay on this page,… https://textmycardealdemo.dealeron.com native 1
unlock_vehicle_price Open the price unlock form for a vehicle and prefill the customer's details. Before calling, ask the user for their first name, last name, phone number and ZIP … https://textmycardealdemo.dealeron.com native readOnlyHint: false untrustedContentHint: false 7
accept_consent_and_submit Tick the SMS consent box on the open price unlock form and submit it, which texts a verification code to the customer. Call ONLY after you showed the user the e… https://textmycardealdemo.dealeron.com native readOnlyHint: false untrustedContentHint: false 1
submit_otp_code Enter the 6-digit verification code the user received by text into the open price unlock form and verify it, which completes the request. Ask the user for the c… https://textmycardealdemo.dealeron.com native readOnlyHint: false untrustedContentHint: false 1
check_availability Ask the dealer to confirm a vehicle is still available (the "Confirm Availability" button on the page). Use when the user asks if a car is in stock or available… https://textmycardealdemo.dealeron.com native readOnlyHint: false untrustedContentHint: false 6
confirm_availability Tick the SMS consent box on the filled availability request form and submit it. Call ONLY after you showed the user the exact consent text from check_availabili… https://textmycardealdemo.dealeron.com native readOnlyHint: false untrustedContentHint: false 1
submit_availability_code Enter the 6-digit verification code the user received by text into the open availability request form and verify it, which completes the request. Ask the user f… https://textmycardealdemo.dealeron.com native readOnlyHint: false untrustedContentHint: false 1
schedule_test_drive Book a test drive. Call first with only stock_number to get open dates, times and any optional extras. Ask the user to pick a date and time, and ask for their f… https://textmycardealdemo.dealeron.com native readOnlyHint: false untrustedContentHint: false 10
confirm_test_drive Tick the SMS consent box on the filled test drive form and submit it. Call ONLY after you showed the user the exact consent text from schedule_test_drive and th… https://textmycardealdemo.dealeron.com native readOnlyHint: false untrustedContentHint: false 1
submit_test_drive_code Enter the 6-digit verification code the user received by text into the open test drive form and verify it, which completes the request. Ask the user for the cod… https://textmycardealdemo.dealeron.com native readOnlyHint: false untrustedContentHint: false 1
accept_consent_and_submit Tick the SMS consent box on the open price unlock form and submit it, which texts a verification code to the customer. Call ONLY after you showed the user the e… null native readOnlyHint: false untrustedContentHint: false 1
check_availability Ask the dealer to confirm a vehicle is still available (the "Confirm Availability" button on the page). Use when the user asks if a car is in stock or available… null native readOnlyHint: false untrustedContentHint: false 6
confirm_availability Tick the SMS consent box on the filled availability request form and submit it. Call ONLY after you showed the user the exact consent text from check_availabili… null native readOnlyHint: false untrustedContentHint: false 1
confirm_test_drive Tick the SMS consent box on the filled test drive form and submit it. Call ONLY after you showed the user the exact consent text from schedule_test_drive and th… null native readOnlyHint: false untrustedContentHint: false 1
go_to_inventory Open the dealer's new or used vehicle inventory page. Use when the user wants to browse cars or this page has no vehicles. The page reloads; then call list_offe… null native 1
list_offer_vehicles List vehicles on this page that have an exclusive price offer. Returns stock number, a short title and whether the price is already unlocked for this visitor. null native readOnlyHint: true untrustedContentHint: true 0
open_vehicle_details Open the full details page of one vehicle from list_offer_vehicles. Only when the user asks for more details or photos of that car; otherwise stay on this page,… null native 1
schedule_test_drive Book a test drive. Call first with only stock_number to get open dates, times and any optional extras. Ask the user to pick a date and time, and ask for their f… null native readOnlyHint: false untrustedContentHint: false 10
submit_availability_code Enter the 6-digit verification code the user received by text into the open availability request form and verify it, which completes the request. Ask the user f… null native readOnlyHint: false untrustedContentHint: false 1
submit_otp_code Enter the 6-digit verification code the user received by text into the open price unlock form and verify it, which completes the request. Ask the user for the c… null native readOnlyHint: false untrustedContentHint: false 1
submit_test_drive_code Enter the 6-digit verification code the user received by text into the open test drive form and verify it, which completes the request. Ask the user for the cod… null native readOnlyHint: false untrustedContentHint: false 1
unlock_vehicle_price Open the price unlock form for a vehicle and prefill the customer's details. Before calling, ask the user for their first name, last name, phone number and ZIP … null native readOnlyHint: false untrustedContentHint: false 7

Findings

DEPLOYMENT 1

HIGH DEPLOYMENT deterministic
deploy.dark-integration

WebMCP integration is registered but invisible to every real user

Tools register when the WebMCP Blink flag is forced on, but document.modelContext is NOT exposed without it: token present but native surface still absent (possible browser/implementation divergence). No real visitor's browser exposes this integration; a naive "N tools found" audit would misreport success.

field origin-trial
{"feature":"WebMCP","origin":"https://textmycardealdemo.dealeron.com:443","expiry":"2027-03-30T00:00:00.000Z","is_subdomain":true}
$ mcpaudit-webmcp-scan --url 'https://textmycardealdemo.dealeron.com/' --check deploy.dark-integration
How to fix

Register the origin for the WebMCP origin trial and serve the token in an Origin-Trial response header or a <meta http-equiv="origin-trial"> tag on every page that registers tools. Re-audit: the status should turn Live.

<meta http-equiv="origin-trial" content="TOKEN_FROM_CHROME_ORIGIN_TRIALS">
full explanation of deploy.dark-integration

RECOMMENDED 2

INFO RECOMMENDED deterministic
schema.no-required

Schema has properties but no required list

Tool "go_to_inventory"'s inputSchema declares properties but no `required` array. Opinion: most tools have at least one mandatory argument; an empty required list often just means the author never filled it in.

tool go_to_inventory · field inputSchema.required
(absent)
$ mcpaudit-webmcp-scan --url 'https://textmycardealdemo.dealeron.com/' --check schema.no-required
How to fix

List the arguments the tool cannot run without.

required: ["query"]
full explanation of schema.no-required
INFO RECOMMENDED deterministic
schema.no-required

Schema has properties but no required list

Tool "schedule_test_drive"'s inputSchema declares properties but no `required` array. Opinion: most tools have at least one mandatory argument; an empty required list often just means the author never filled it in.

tool schedule_test_drive · field inputSchema.required
(absent)
$ mcpaudit-webmcp-scan --url 'https://textmycardealdemo.dealeron.com/' --check schema.no-required
How to fix

List the arguments the tool cannot run without.

required: ["query"]
full explanation of schema.no-required

READINESS 1

Registering your own tools?

Start from a config the checks above already pass.

Build your own WebMCP config

Need a detailed audit?

On request we run a detailed MCP audit and prepare everything you need: findings, fixes and ready configs.

Order an audit

This is an automated, point-in-time report from three browser observations of the page: native without a forced flag, native with the experimental feature forced on, and a document-start registration capture. No tool or declarative form was executed, no account was used, and hidden or interaction-only states may not be represented. Agent-readiness checks fetch robots.txt, llms.txt, the sitemap, security.txt and the AI Catalog once each and never affect the grade. The grade, when shown, reflects deterministic checks only and is not a certification. Job 9547befc3a71285a. Rulepack rulepack-2026.10.1.