WEBMCP AUDIT REPORT

https://textmycardealdemo.dealeron.com/searchnew.aspx

scanned2026-11-09T10:10:01.447Z
rulepackrulepack-2026.10.1
scannerwebmcp-scanner/0.3.0
tools24
$ node scanner/bin/webmcp-scan.js https://textmycardealdemo.dealeron.com/searchnew.aspx
live Live

Visible to real users: tools are registered through the native, flag-free WebMCP API. Any capable agent visiting this page today can see and call them.

B
security grade from deterministic rules only
0critical
0high
1medium
0low
2info

Origin trial tokens

kindfeatureoriginexpirysubdomainorigin matchesstatus
meta WebMCP https://textmycardealdemo.dealeron.com:443 2027-03-30T00:00:00.000Z no no valid
meta WebMCP https://widget.textmycardeal.com:443 2027-03-30T00:00:00.000Z no no valid

Agent readiness: 17 of 18 checks pass

Can an AI agent find, open and understand this page? These checks read robots.txt, llms.txt, the sitemap, security.txt and the page's own metadata. They never affect the security grade; each one links to its fix and to the vendor document it rests on.

statuscheckevidencefinding
pass Page opens for a bot HTTP 200, "Kia Vehicle Inventory - Dover Kia dealer in Dover DE - New a"
pass robots.txt present 2 group(s), 1 sitemap line(s)
pass Page allowed for every crawler User-agent: * allows /searchnew.aspx
pass On-demand assistant fetchers allowed ChatGPT-User, Claude-User, Perplexity-User allowed
pass AI search crawlers allowed OAI-SearchBot, Claude-SearchBot, PerplexityBot, Googlebot, Bingbot, Applebot allowed
pass Training crawlers none blocked (vendor default)
pass AI usage policy stated Content-Signal: ai-train=no, search=yes, ai-input=yes
pass Sitemap reachable urlset, 1066 <loc> entries (via robots.txt)
pass Sitemap declared in robots.txt https://textmycardealdemo.dealeron.com/sitemap.xml
pass llms.txt "Text My Car Deal OnMarketplace Partner", 41 link(s), 7 section(s), llms-full.txt too
info security.txt (RFC 9116) HTTP 404 site.security-txt-missing
n/a MCP: AI Catalog and Server Card no AI Catalog: no MCP server advertised
n/a MCP in llms.txt no MCP server advertised
pass Indexable (no noindex) index,follow,noydir,noodp
pass <title> present "Kia Vehicle Inventory - Dover Kia dealer in Dover DE - New and Used Ki"
pass Meta description present 67 chars
pass Canonical URL declared https://textmycardealdemo.dealeron.com/searchnew.aspx
pass Structured data (JSON-LD) ItemList, AutoDealer, WebSite
pass Open Graph preview Kia Vehicle Inventory - Dover Kia dealer in Dover , no image
pass Document language en

Coverage

techniquestatustimeevidence
Native, flag offcomplete7290 ms3 frame(s), 12 tool(s)
Native, flag forced oncomplete6717 ms3 frame(s), 36 tool(s)
Document-start capture hookcomplete7133 ms3 frame(s), 12 tool(s)

No explicit Permissions-Policy: tools=… directive was observed; the specification default is self.

Tools

nametitledescriptionoriginsourceannotationsschema props
list_offer_vehicles List vehicles on this page that have an exclusive price offer. Returns stock number, a short title and whether the price is already unlocked for this visitor. T… https://textmycardealdemo.dealeron.com native readOnlyHint: true untrustedContentHint: true 0
go_to_inventory Open the dealer's new or used vehicle inventory page. Use when the user wants to browse cars or this page has no vehicles. The page reloads; then call list_offe… https://textmycardealdemo.dealeron.com native 1
open_vehicle_details Open the full details page of one vehicle from list_offer_vehicles. Only when the user asks for more details or photos of that car; otherwise stay on this page,… https://textmycardealdemo.dealeron.com native 1
unlock_vehicle_price Open the price unlock form for a vehicle and prefill the customer's details. Before calling, ask the user for their first name, last name, phone number and ZIP … https://textmycardealdemo.dealeron.com native readOnlyHint: false untrustedContentHint: false 7
accept_consent_and_submit Tick the SMS consent box on the open price unlock form and submit it, which texts a verification code to the customer. Call ONLY after you showed the user the e… https://textmycardealdemo.dealeron.com native readOnlyHint: false untrustedContentHint: false 1
submit_otp_code Enter the 6-digit verification code the user received by text into the open price unlock form and verify it, which completes the request. Ask the user for the c… https://textmycardealdemo.dealeron.com native readOnlyHint: false untrustedContentHint: false 1
check_availability Ask the dealer to confirm a vehicle is still available (the "Confirm Availability" button on the page). Use when the user asks if a car is in stock or available… https://textmycardealdemo.dealeron.com native readOnlyHint: false untrustedContentHint: false 6
confirm_availability Tick the SMS consent box on the filled availability request form and submit it. Call ONLY after you showed the user the exact consent text from check_availabili… https://textmycardealdemo.dealeron.com native readOnlyHint: false untrustedContentHint: false 1
submit_availability_code Enter the 6-digit verification code the user received by text into the open availability request form and verify it, which completes the request. Ask the user f… https://textmycardealdemo.dealeron.com native readOnlyHint: false untrustedContentHint: false 1
schedule_test_drive Book a test drive. Call first with only stock_number to get open dates, times and any optional extras. Ask the user to pick a date and time, and ask for their f… https://textmycardealdemo.dealeron.com native readOnlyHint: false untrustedContentHint: false 10
confirm_test_drive Tick the SMS consent box on the filled test drive form and submit it. Call ONLY after you showed the user the exact consent text from schedule_test_drive and th… https://textmycardealdemo.dealeron.com native readOnlyHint: false untrustedContentHint: false 1
submit_test_drive_code Enter the 6-digit verification code the user received by text into the open test drive form and verify it, which completes the request. Ask the user for the cod… https://textmycardealdemo.dealeron.com native readOnlyHint: false untrustedContentHint: false 1
accept_consent_and_submit Tick the SMS consent box on the open price unlock form and submit it, which texts a verification code to the customer. Call ONLY after you showed the user the e… null native readOnlyHint: false untrustedContentHint: false 1
check_availability Ask the dealer to confirm a vehicle is still available (the "Confirm Availability" button on the page). Use when the user asks if a car is in stock or available… null native readOnlyHint: false untrustedContentHint: false 6
confirm_availability Tick the SMS consent box on the filled availability request form and submit it. Call ONLY after you showed the user the exact consent text from check_availabili… null native readOnlyHint: false untrustedContentHint: false 1
confirm_test_drive Tick the SMS consent box on the filled test drive form and submit it. Call ONLY after you showed the user the exact consent text from schedule_test_drive and th… null native readOnlyHint: false untrustedContentHint: false 1
go_to_inventory Open the dealer's new or used vehicle inventory page. Use when the user wants to browse cars or this page has no vehicles. The page reloads; then call list_offe… null native 1
list_offer_vehicles List vehicles on this page that have an exclusive price offer. Returns stock number, a short title and whether the price is already unlocked for this visitor. T… null native readOnlyHint: true untrustedContentHint: true 0
open_vehicle_details Open the full details page of one vehicle from list_offer_vehicles. Only when the user asks for more details or photos of that car; otherwise stay on this page,… null native 1
schedule_test_drive Book a test drive. Call first with only stock_number to get open dates, times and any optional extras. Ask the user to pick a date and time, and ask for their f… null native readOnlyHint: false untrustedContentHint: false 10
submit_availability_code Enter the 6-digit verification code the user received by text into the open availability request form and verify it, which completes the request. Ask the user f… null native readOnlyHint: false untrustedContentHint: false 1
submit_otp_code Enter the 6-digit verification code the user received by text into the open price unlock form and verify it, which completes the request. Ask the user for the c… null native readOnlyHint: false untrustedContentHint: false 1
submit_test_drive_code Enter the 6-digit verification code the user received by text into the open test drive form and verify it, which completes the request. Ask the user for the cod… null native readOnlyHint: false untrustedContentHint: false 1
unlock_vehicle_price Open the price unlock form for a vehicle and prefill the customer's details. Before calling, ask the user for their first name, last name, phone number and ZIP … null native readOnlyHint: false untrustedContentHint: false 7

Findings

DEPLOYMENT 1

MEDIUM DEPLOYMENT deterministic
deploy.origin-trial-token

Origin-Trial token problem: origin mismatch

An Origin-Trial token is present but registered for origin "https://widget.textmycardeal.com:443", which does not match this page's origin. signature_verified is always false: we decode the token offline and never fetch to validate it.

field origin-trial
{"feature":"WebMCP","origin":"https://widget.textmycardeal.com:443","expiry":"2027-03-30T00:00:00.000Z"}
$ mcpaudit-webmcp-scan --url 'https://textmycardealdemo.dealeron.com/searchnew.aspx' --check deploy.origin-trial-token
How to fix

Issue a fresh token for this exact origin (scheme, host and port) in the Chrome origin trials console and replace the old one.

full explanation of deploy.origin-trial-token

RECOMMENDED 2

INFO RECOMMENDED deterministic
schema.no-required

Schema has properties but no required list

Tool "go_to_inventory"'s inputSchema declares properties but no `required` array. Opinion: most tools have at least one mandatory argument; an empty required list often just means the author never filled it in.

tool go_to_inventory · field inputSchema.required
(absent)
$ mcpaudit-webmcp-scan --url 'https://textmycardealdemo.dealeron.com/searchnew.aspx' --check schema.no-required
How to fix

List the arguments the tool cannot run without.

required: ["query"]
full explanation of schema.no-required
INFO RECOMMENDED deterministic
schema.no-required

Schema has properties but no required list

Tool "schedule_test_drive"'s inputSchema declares properties but no `required` array. Opinion: most tools have at least one mandatory argument; an empty required list often just means the author never filled it in.

tool schedule_test_drive · field inputSchema.required
(absent)
$ mcpaudit-webmcp-scan --url 'https://textmycardealdemo.dealeron.com/searchnew.aspx' --check schema.no-required
How to fix

List the arguments the tool cannot run without.

required: ["query"]
full explanation of schema.no-required

READINESS 1

Registering your own tools?

Start from a config the checks above already pass.

Build your own WebMCP config

Need a detailed audit?

On request we run a detailed MCP audit and prepare everything you need: findings, fixes and ready configs.

Order an audit

This is an automated, point-in-time report from three browser observations of the page: native without a forced flag, native with the experimental feature forced on, and a document-start registration capture. No tool or declarative form was executed, no account was used, and hidden or interaction-only states may not be represented. Agent-readiness checks fetch robots.txt, llms.txt, the sitemap, security.txt and the AI Catalog once each and never affect the grade. The grade, when shown, reflects deterministic checks only and is not a certification. Job e014ce22c315bad2. Rulepack rulepack-2026.10.1.