WEBMCP AUDIT REPORT

https://isembard.com/

scanned2026-11-07T20:52:56.100Z
rulepackrulepack-2026.10.1
scannerwebmcp-scanner/0.3.0
tools4
$ node scanner/bin/webmcp-scan.js https://isembard.com/
live Live

Visible to real users: tools are registered through the native, flag-free WebMCP API. Any capable agent visiting this page today can see and call them.

A
security grade from deterministic rules only
0critical
0high
0medium
0low
4info

Origin trial tokens

kindfeatureoriginexpirysubdomainorigin matchesstatus
meta WebMCP https://isembard.com:443 2027-03-30T00:00:00.000Z no no valid

Agent readiness: 16 of 18 checks pass

Can an AI agent find, open and understand this page? These checks read robots.txt, llms.txt, the sitemap, security.txt and the page's own metadata. They never affect the security grade; each one links to its fix and to the vendor document it rests on.

statuscheckevidencefinding
pass Page opens for a bot HTTP 200, "Isembard"
pass robots.txt present 9 group(s), 1 sitemap line(s)
pass Page allowed for every crawler User-agent: * allows /
pass On-demand assistant fetchers allowed ChatGPT-User, Claude-User, Perplexity-User allowed
pass AI search crawlers allowed OAI-SearchBot, Claude-SearchBot, PerplexityBot, Googlebot, Bingbot, Applebot allowed
info Training crawlers blocked: GPTBot, ClaudeBot, Google-Extended, Applebot-Extended, CCBot site.robots-blocks-training
pass AI usage policy stated Content-Signal: search=yes, ai-input=yes, ai-train=no
pass Sitemap reachable urlset, 85 <loc> entries (via robots.txt)
pass Sitemap declared in robots.txt https://isembard.com/sitemap.xml
pass llms.txt "Isembard", 775 link(s), 74 section(s), llms-full.txt too
info security.txt (RFC 9116) HTTP 404 site.security-txt-missing
n/a MCP: AI Catalog and Server Card no AI Catalog: no MCP server advertised
n/a MCP in llms.txt no MCP server advertised
pass Indexable (no noindex) index,follow,max-image-preview:large
pass <title> present "Isembard"
pass Meta description present 111 chars
pass Canonical URL declared https://isembard.com/de/
pass Structured data (JSON-LD) Organization, WebSite, WebPage
pass Open Graph preview Isembard, image
pass Document language de-DE

Coverage

techniquestatustimeevidence
Native, flag offcomplete7868 ms1 frame(s), 4 tool(s)
Native, flag forced oncomplete7517 ms1 frame(s), 4 tool(s)
Document-start capture hookcomplete7492 ms1 frame(s), 4 tool(s)

Permissions-Policy: accelerometer=(), autoplay=(self), camera=(), display-capture=(), encrypted-media=(), fullscreen=(self), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), usb=(), xr-spatial-tracking=()

Tools

nametitledescriptionoriginsourceannotationsschema props
get_company_overview Returns Isembard's company guide, its legal and contact details in an edition, and a map of every public page. Use it first to understand the company, or to fin… https://isembard.com native readOnlyHint: true untrustedContentHint: true 1
find_roles Lists Isembard's open roles, open applications and opportunities, each with its department, places, advert language and links to its page, Markdown and applicat… https://isembard.com native readOnlyHint: true untrustedContentHint: true 7
find_news Lists Isembard's own news, announcements and press releases in an edition, newest first, with dates, summaries and links. Use it for company news; read_page ret… https://isembard.com native readOnlyHint: true untrustedContentHint: true 4
read_page Returns one public page of this site in full as Markdown: a page, a Home chapter, a news article or a job advert. Use it to read what another tool or the site m… https://isembard.com native readOnlyHint: true untrustedContentHint: true 1

Findings

RECOMMENDED 4

INFO RECOMMENDED deterministic
schema.no-required

Schema has properties but no required list

Tool "get_company_overview"'s inputSchema declares properties but no `required` array. Opinion: most tools have at least one mandatory argument; an empty required list often just means the author never filled it in.

tool get_company_overview · field inputSchema.required
(absent)
$ mcpaudit-webmcp-scan --url 'https://isembard.com/' --check schema.no-required
How to fix

List the arguments the tool cannot run without.

required: ["query"]
full explanation of schema.no-required
INFO RECOMMENDED deterministic
schema.no-required

Schema has properties but no required list

Tool "find_roles"'s inputSchema declares properties but no `required` array. Opinion: most tools have at least one mandatory argument; an empty required list often just means the author never filled it in.

tool find_roles · field inputSchema.required
(absent)
$ mcpaudit-webmcp-scan --url 'https://isembard.com/' --check schema.no-required
How to fix

List the arguments the tool cannot run without.

required: ["query"]
full explanation of schema.no-required
INFO RECOMMENDED deterministic
schema.no-required

Schema has properties but no required list

Tool "find_news"'s inputSchema declares properties but no `required` array. Opinion: most tools have at least one mandatory argument; an empty required list often just means the author never filled it in.

tool find_news · field inputSchema.required
(absent)
$ mcpaudit-webmcp-scan --url 'https://isembard.com/' --check schema.no-required
How to fix

List the arguments the tool cannot run without.

required: ["query"]
full explanation of schema.no-required
INFO RECOMMENDED deterministic
schema.no-required

Schema has properties but no required list

Tool "read_page"'s inputSchema declares properties but no `required` array. Opinion: most tools have at least one mandatory argument; an empty required list often just means the author never filled it in.

tool read_page · field inputSchema.required
(absent)
$ mcpaudit-webmcp-scan --url 'https://isembard.com/' --check schema.no-required
How to fix

List the arguments the tool cannot run without.

required: ["query"]
full explanation of schema.no-required

READINESS 2

INFO READINESS deterministic
site.robots-blocks-training

Training crawlers blocked: GPTBot, ClaudeBot, Google-Extended, Applebot-Extended, CCBot

A deliberate policy, reported for completeness: blocking GPTBot, ClaudeBot, Google-Extended, Applebot-Extended or CCBot keeps content out of model training without affecting search or on-demand fetches, as each vendor documents.

GPTBot, ClaudeBot, Google-Extended, Applebot-Extended, CCBot
How to fix

Nothing to fix if intended. Each vendor documents that blocking the training token does not affect search inclusion or user-requested fetches.

full explanation of site.robots-blocks-training

Registering your own tools?

Start from a config the checks above already pass.

Build your own WebMCP config

Need a detailed audit?

On request we run a detailed MCP audit and prepare everything you need: findings, fixes and ready configs.

Order an audit

This is an automated, point-in-time report from three browser observations of the page: native without a forced flag, native with the experimental feature forced on, and a document-start registration capture. No tool or declarative form was executed, no account was used, and hidden or interaction-only states may not be represented. Agent-readiness checks fetch robots.txt, llms.txt, the sitemap, security.txt and the AI Catalog once each and never affect the grade. The grade, when shown, reflects deterministic checks only and is not a certification. Job c194e9623887ffdf. Rulepack rulepack-2026.10.1.