WEBMCP AUDIT REPORT

https://www.columbiahonda.com/

scanned2026-11-03T14:02:23.307Z
rulepackrulepack-2026.10.1
scannerwebmcp-scanner/0.3.0
tools2
$ node scanner/bin/webmcp-scan.js https://www.columbiahonda.com/
live Live

Visible to real users: tools are registered through the native, flag-free WebMCP API. Any capable agent visiting this page today can see and call them.

B
security grade from deterministic rules only
0critical
0high
1medium
0low
0info

Origin trial tokens

kindfeatureoriginexpirysubdomainorigin matchesstatus
meta WebMCP https://www.columbiahonda.com:443 2027-03-30T00:00:00.000Z no no valid
meta WebMCP https://confluence-onekeel.nyc3.digitaloceanspaces.com:443 2027-03-30T00:00:00.000Z no no valid

Agent readiness: 17 of 18 checks pass

Can an AI agent find, open and understand this page? These checks read robots.txt, llms.txt, the sitemap, security.txt and the page's own metadata. They never affect the security grade; each one links to its fix and to the vendor document it rests on.

statuscheckevidencefinding
pass Page opens for a bot HTTP 200, "Columbia Honda | McLarty Automotive Group"
pass robots.txt present 2 group(s), 1 sitemap line(s)
pass Page allowed for every crawler User-agent: * allows /
pass On-demand assistant fetchers allowed ChatGPT-User, Claude-User, Perplexity-User allowed
pass AI search crawlers allowed OAI-SearchBot, Claude-SearchBot, PerplexityBot, Googlebot, Bingbot, Applebot allowed
pass Training crawlers none blocked (vendor default)
pass AI usage policy stated Content-Signal: ai-train=no, search=yes, ai-input=yes
pass Sitemap reachable urlset, 1114 <loc> entries (via robots.txt)
pass Sitemap declared in robots.txt https://www.columbiahonda.com/sitemap.xml
pass llms.txt "Columbia Honda", 43 link(s), 6 section(s), llms-full.txt too
info security.txt (RFC 9116) HTTP 404 site.security-txt-missing
n/a MCP: AI Catalog and Server Card no AI Catalog: no MCP server advertised
n/a MCP in llms.txt no MCP server advertised
pass Indexable (no noindex) index,follow,noydir,noodp
pass <title> present "Columbia Honda | McLarty Automotive Group"
pass Meta description present 153 chars
pass Canonical URL declared https://www.columbiahonda.com/
pass Structured data (JSON-LD) AggregateRating, AutoDealer, AutomotiveBusiness, AutoPartsStore
pass Open Graph preview Columbia Honda | McLarty Automotive Group, no image
pass Document language en

Coverage

techniquestatustimeevidence
Native, flag offcomplete17455 ms6 frame(s), 1 tool(s)
Native, flag forced oncomplete11782 ms3 frame(s), 2 tool(s)
Document-start capture hookcomplete13447 ms4 frame(s), 1 tool(s)

No explicit Permissions-Policy: tools=… directive was observed; the specification default is self.

Tools

nametitledescriptionoriginsourceannotationsschema props
check_dealership_department_status Check a dealership department's (e.g. Sales, Service, Parts) phone number, today's hours, and whether it is open right now. Read-only. https://www.columbiahonda.com native 1
check_dealership_department_status Check a dealership department's (e.g. Sales, Service, Parts) phone number, today's hours, and whether it is open right now. Read-only. null native 1

Findings

DEPLOYMENT 1

MEDIUM DEPLOYMENT deterministic
deploy.origin-trial-token

Origin-Trial token problem: origin mismatch

An Origin-Trial token is present but registered for origin "https://confluence-onekeel.nyc3.digitaloceanspaces.com:443", which does not match this page's origin. signature_verified is always false: we decode the token offline and never fetch to validate it.

field origin-trial
{"feature":"WebMCP","origin":"https://confluence-onekeel.nyc3.digitaloceanspaces.com:443","expiry":"2027-03-30T00:00:00.000Z"}
$ mcpaudit-webmcp-scan --url 'https://www.columbiahonda.com/' --check deploy.origin-trial-token
How to fix

Issue a fresh token for this exact origin (scheme, host and port) in the Chrome origin trials console and replace the old one.

full explanation of deploy.origin-trial-token

READINESS 1

Registering your own tools?

Start from a config the checks above already pass.

Build your own WebMCP config

Need a detailed audit?

On request we run a detailed MCP audit and prepare everything you need: findings, fixes and ready configs.

Order an audit

This is an automated, point-in-time report from three browser observations of the page: native without a forced flag, native with the experimental feature forced on, and a document-start registration capture. No tool or declarative form was executed, no account was used, and hidden or interaction-only states may not be represented. Agent-readiness checks fetch robots.txt, llms.txt, the sitemap, security.txt and the AI Catalog once each and never affect the grade. The grade, when shown, reflects deterministic checks only and is not a certification. Job ad61326e1ba1328e. Rulepack rulepack-2026.10.1.