WEBMCP AUDIT REPORT

https://textmycardealdemo.dealeron.com/searchnew.aspx

scanned2026-11-04T14:32:53.753Z
rulepackrulepack-2026.10.1
scannerwebmcp-scanner/0.3.0
tools24
$ node scanner/bin/webmcp-scan.js https://textmycardealdemo.dealeron.com/searchnew.aspx
dark Dark (flagged only)

Registered under the flag only, invisible to every real user. Nobody without that experimental flag or an origin-trial token sees these tools yet. Reason: token present but native surface still absent (possible browser/implementation divergence).

C
security grade from deterministic rules only
0critical
1high
0medium
0low
0info

Origin trial tokens

kindfeatureoriginexpirysubdomainorigin matchesstatus
meta WebMCP https://textmycardealdemo.dealeron.com:443 2027-03-30T00:00:00.000Z no no valid

Agent readiness: 17 of 18 checks pass

Can an AI agent find, open and understand this page? These checks read robots.txt, llms.txt, the sitemap, security.txt and the page's own metadata. They never affect the security grade; each one links to its fix and to the vendor document it rests on.

statuscheckevidencefinding
pass Page opens for a bot HTTP 200, "Kia Vehicle Inventory - Dover Kia dealer in Dover DE - New a"
pass robots.txt present 2 group(s), 1 sitemap line(s)
pass Page allowed for every crawler User-agent: * allows /searchnew.aspx
pass On-demand assistant fetchers allowed ChatGPT-User, Claude-User, Perplexity-User allowed
pass AI search crawlers allowed OAI-SearchBot, Claude-SearchBot, PerplexityBot, Googlebot, Bingbot, Applebot allowed
pass Training crawlers none blocked (vendor default)
pass AI usage policy stated Content-Signal: ai-train=no, search=yes, ai-input=yes
pass Sitemap reachable urlset, 1066 <loc> entries (via robots.txt)
pass Sitemap declared in robots.txt https://textmycardealdemo.dealeron.com/sitemap.xml
pass llms.txt "Text My Car Deal OnMarketplace Partner", 41 link(s), 7 section(s), llms-full.txt too
info security.txt (RFC 9116) HTTP 404 site.security-txt-missing
n/a MCP: AI Catalog and Server Card no AI Catalog: no MCP server advertised
n/a MCP in llms.txt no MCP server advertised
pass Indexable (no noindex) index,follow,noydir,noodp
pass <title> present "Kia Vehicle Inventory - Dover Kia dealer in Dover DE - New and Used Ki"
pass Meta description present 67 chars
pass Canonical URL declared https://textmycardealdemo.dealeron.com/searchnew.aspx
pass Structured data (JSON-LD) ItemList, AutoDealer, WebSite
pass Open Graph preview Kia Vehicle Inventory - Dover Kia dealer in Dover , no image
pass Document language en

Coverage

techniquestatustimeevidence
Native, flag offcomplete8151 ms3 frame(s), 0 tool(s)
Native, flag forced oncomplete8292 ms3 frame(s), 36 tool(s)
Document-start capture hookcomplete7464 ms3 frame(s), 0 tool(s)

No explicit Permissions-Policy: tools=… directive was observed; the specification default is self.

Tools

nametitledescriptionoriginsourceannotationsschema props
accept_consent_and_submit Tick the SMS consent box on the open price unlock form and submit it, which texts a verification code to the customer. Call ONLY after you showed the user the e… https://textmycardealdemo.dealeron.com native readOnlyHint: false untrustedContentHint: false 1
check_availability Ask the dealer to confirm a vehicle is still available (the "Confirm Availability" button on the page). Use when the user asks if a car is in stock or available… https://textmycardealdemo.dealeron.com native readOnlyHint: false untrustedContentHint: false 6
confirm_availability Tick the SMS consent box on the filled availability request form and submit it. Call ONLY after you showed the user the exact consent text from check_availabili… https://textmycardealdemo.dealeron.com native readOnlyHint: false untrustedContentHint: false 1
confirm_test_drive Tick the SMS consent box on the filled test drive form and submit it. Call ONLY after you showed the user the exact consent text from schedule_test_drive and th… https://textmycardealdemo.dealeron.com native readOnlyHint: false untrustedContentHint: false 1
go_to_inventory Open the dealer's new or used vehicle inventory page. Use when the user wants to browse cars or this page has no vehicles. The page reloads; then call list_offe… https://textmycardealdemo.dealeron.com native 1
list_offer_vehicles List vehicles on this page that have an exclusive price offer. Returns stock number, a short title and whether the price is already unlocked for this visitor. https://textmycardealdemo.dealeron.com native readOnlyHint: true untrustedContentHint: true 0
open_vehicle_details Open the full details page of one vehicle from list_offer_vehicles. Only when the user asks for more details or photos of that car; otherwise stay on this page,… https://textmycardealdemo.dealeron.com native 1
schedule_test_drive Book a test drive. Call first with only stock_number to get open dates, times and any optional extras. Ask the user to pick a date and time, and ask for their f… https://textmycardealdemo.dealeron.com native readOnlyHint: false untrustedContentHint: false 10
submit_availability_code Enter the 6-digit verification code the user received by text into the open availability request form and verify it, which completes the request. Ask the user f… https://textmycardealdemo.dealeron.com native readOnlyHint: false untrustedContentHint: false 1
submit_otp_code Enter the 6-digit verification code the user received by text into the open price unlock form and verify it, which completes the request. Ask the user for the c… https://textmycardealdemo.dealeron.com native readOnlyHint: false untrustedContentHint: false 1
submit_test_drive_code Enter the 6-digit verification code the user received by text into the open test drive form and verify it, which completes the request. Ask the user for the cod… https://textmycardealdemo.dealeron.com native readOnlyHint: false untrustedContentHint: false 1
unlock_vehicle_price Open the price unlock form for a vehicle and prefill the customer's details. Before calling, ask the user for their first name, last name, phone number and ZIP … https://textmycardealdemo.dealeron.com native readOnlyHint: false untrustedContentHint: false 7
accept_consent_and_submit Tick the SMS consent box on the open price unlock form and submit it, which texts a verification code to the customer. Call ONLY after you showed the user the e… null native readOnlyHint: false untrustedContentHint: false 1
check_availability Ask the dealer to confirm a vehicle is still available (the "Confirm Availability" button on the page). Use when the user asks if a car is in stock or available… null native readOnlyHint: false untrustedContentHint: false 6
confirm_availability Tick the SMS consent box on the filled availability request form and submit it. Call ONLY after you showed the user the exact consent text from check_availabili… null native readOnlyHint: false untrustedContentHint: false 1
confirm_test_drive Tick the SMS consent box on the filled test drive form and submit it. Call ONLY after you showed the user the exact consent text from schedule_test_drive and th… null native readOnlyHint: false untrustedContentHint: false 1
go_to_inventory Open the dealer's new or used vehicle inventory page. Use when the user wants to browse cars or this page has no vehicles. The page reloads; then call list_offe… null native 1
list_offer_vehicles List vehicles on this page that have an exclusive price offer. Returns stock number, a short title and whether the price is already unlocked for this visitor. null native readOnlyHint: true untrustedContentHint: true 0
open_vehicle_details Open the full details page of one vehicle from list_offer_vehicles. Only when the user asks for more details or photos of that car; otherwise stay on this page,… null native 1
schedule_test_drive Book a test drive. Call first with only stock_number to get open dates, times and any optional extras. Ask the user to pick a date and time, and ask for their f… null native readOnlyHint: false untrustedContentHint: false 10
submit_availability_code Enter the 6-digit verification code the user received by text into the open availability request form and verify it, which completes the request. Ask the user f… null native readOnlyHint: false untrustedContentHint: false 1
submit_otp_code Enter the 6-digit verification code the user received by text into the open price unlock form and verify it, which completes the request. Ask the user for the c… null native readOnlyHint: false untrustedContentHint: false 1
submit_test_drive_code Enter the 6-digit verification code the user received by text into the open test drive form and verify it, which completes the request. Ask the user for the cod… null native readOnlyHint: false untrustedContentHint: false 1
unlock_vehicle_price Open the price unlock form for a vehicle and prefill the customer's details. Before calling, ask the user for their first name, last name, phone number and ZIP … null native readOnlyHint: false untrustedContentHint: false 7

Findings

DEPLOYMENT 1

HIGH DEPLOYMENT deterministic
deploy.dark-integration

WebMCP integration is registered but invisible to every real user

Tools register when the WebMCP Blink flag is forced on, but document.modelContext is NOT exposed without it: token present but native surface still absent (possible browser/implementation divergence). No real visitor's browser exposes this integration; a naive "N tools found" audit would misreport success.

field origin-trial
{"feature":"WebMCP","origin":"https://textmycardealdemo.dealeron.com:443","expiry":"2027-03-30T00:00:00.000Z","is_subdomain":true}
$ mcpaudit-webmcp-scan --url 'https://textmycardealdemo.dealeron.com/searchnew.aspx' --check deploy.dark-integration
How to fix

Register the origin for the WebMCP origin trial and serve the token in an Origin-Trial response header or a <meta http-equiv="origin-trial"> tag on every page that registers tools. Re-audit: the status should turn Live.

<meta http-equiv="origin-trial" content="TOKEN_FROM_CHROME_ORIGIN_TRIALS">
full explanation of deploy.dark-integration

READINESS 1

Registering your own tools?

Start from a config the checks above already pass.

Build your own WebMCP config

Need a detailed audit?

On request we run a detailed MCP audit and prepare everything you need: findings, fixes and ready configs.

Order an audit

This is an automated, point-in-time report from three browser observations of the page: native without a forced flag, native with the experimental feature forced on, and a document-start registration capture. No tool or declarative form was executed, no account was used, and hidden or interaction-only states may not be represented. Agent-readiness checks fetch robots.txt, llms.txt, the sitemap, security.txt and the AI Catalog once each and never affect the grade. The grade, when shown, reflects deterministic checks only and is not a certification. Job 963ee6b8edc4796a. Rulepack rulepack-2026.10.1.