Scovant Core — https://example.com/

Profile: saas (requested auto, confidence 80%)

Core version: 0.18.0

29 PASS, 12 WARN, 2 FAIL, 25 N/A, 0 ERROR (68 checks)

Technical Readiness

73 / 100

Grade: C · Status: OK · Coverage: 100% · Model: R2.1@67df90af85b0

Diagnostics (50 readiness checks): 22 pass · 8 warn · 0 fail

Capabilities detected (descriptive, not scored): mcp: absent · webmcp: absent · ucp: not_checked · llms_txt: absent · openapi: absent · oauth: invalid · content_signal: absent · security_txt: present

Standards: AgentReady v1.0 (descriptive, not scored): MUST 3/3 measured — 1 pass, 2 warn · SHOULD 4/12 measured — 4 warn · MAY none measured (0/3) — Mapping: docs/standards/agentready.md

Findings

Experimental (not scored)

• CORE-SECURITY-011 (PASS) — No indicators found.
• CORE-SECURITY-012 (PASS) — No indicators found.
• CORE-SECURITY-013 (PASS) — No indicators found.
• CORE-SECURITY-014 (PASS) — No indicators found.
• CORE-SECURITY-017 (WARN) — `authorization_servers` is missing, empty or not a list of URLs.
• CORE-SECURITY-018 (WARN) — `authorization_endpoint` is not declared. `token_endpoint` is not declared. PKCE with S256 is not advertised in `code_challenge_methods_supported` (the server may still enforce it; agents cannot discover that it does). The RFC 9207 `iss` authorization-response parameter is not advertised (the server may still enforce it; agents cannot discover that it does).

N/A: CORE-ACCESS-011, CORE-INTERFACE-004, CORE-INTERFACE-008, CORE-INTERFACE-009, CORE-MACHINE-012, CORE-OPERABILITY-007, CORE-OPERABILITY-011, CORE-SECURITY-009, CORE-SECURITY-010, CORE-SECURITY-015, CORE-SECURITY-016

Evidence

{
  "final_url": "https://example.com/",
  "input_url": "https://example.com/",
  "redirect_chain": [],
  "redirect_count": 0,
  "status": 200
}

{
  "error": null,
  "resource": "https://example.com/robots.txt",
  "served_as_html": false,
  "sha256": "3986b6edab342dfd005c7e59bf3e6876ce79173402727d30bb6c632805c1a1da",
  "sitemap_count": 1,
  "status": 200,
  "unknown_directives": []
}

{
  "declared_policy": {
    "Applebot": true,
    "Bingbot": true,
    "Claude-SearchBot": true,
    "Googlebot": true,
    "OAI-SearchBot": true,
    "PerplexityBot": false
  },
  "http_status": 200,
  "resource": "https://example.com/robots.txt",
  "robots_present": true,
  "user_fetch_policy": {
    "ChatGPT-User": true,
    "Claude-User": true,
    "DuckAssistBot": true,
    "Perplexity-User": true
  }
}

{
  "explicit_separation": false,
  "http_status": 200,
  "resource": "https://example.com/robots.txt",
  "search_blocked": [
    "PerplexityBot"
  ],
  "training_blocked": []
}

{
  "entry_count": 4,
  "exists": true,
  "kind": "urlset",
  "parse_error": null,
  "probe_error": null,
  "probe_status": 200,
  "served_as_html": false,
  "url": "https://example.com/sitemap.xml",
  "valid": true
}

{
  "dated_entry_count": 4,
  "entry_count": 4,
  "newest": "2020-01-01",
  "oldest": "2020-01-01",
  "url": "https://example.com/sitemap.xml"
}

{
  "canonical_url": "https://example.com/",
  "entry_url": "https://example.com/"
}

{
  "robots_meta": null,
  "x_robots_tag": null
}

{
  "http_status": 404,
  "resource": "https://example.com/llms.txt"
}

{
  "declared": false,
  "dimensions": {
    "ai-input": "unset",
    "ai-train": "unset",
    "search": "unset"
  },
  "syntax_errors": []
}

{
  "exists": false,
  "http_status": 404,
  "resource": "https://example.com/.well-known/mcp.json",
  "server_card": false,
  "valid": false
}

{
  "pages_scanned": 4,
  "pages_with_marker": []
}

{
  "candidates_checked": 5,
  "found_url": null,
  "openapi_version": null,
  "parseable": false
}

{
  "has_endpoints": false,
  "http_status": 200,
  "parseable": true,
  "resource": "https://example.com/.well-known/oauth-authorization-server",
  "served_as_html": false
}

{
  "dpop_bound_access_tokens_required": false,
  "http_status": 200,
  "jwks_uri": null,
  "matches_issuer": true,
  "parseable": true,
  "resource": "https://example.com/.well-known/oauth-protected-resource",
  "resource_matches_origin": true,
  "scopes_supported": [],
  "served_as_html": false
}

{
  "pages": [
    {
      "parsed": 2,
      "raw": 2,
      "url": "https://example.com/"
    },
    {
      "parsed": 0,
      "raw": 0,
      "url": "https://example.com/pricing"
    },
    {
      "parsed": 1,
      "raw": 1,
      "url": "https://example.com/docs"
    },
    {
      "parsed": 0,
      "raw": 0,
      "url": "https://example.com/signup"
    }
  ],
  "parsed_total": 3,
  "raw_total": 3
}

{
  "found": true,
  "missing": [
    "url"
  ],
  "pages_parsed": 4
}

{
  "found": true,
  "pages_parsed": 4
}

{
  "has_breadcrumb": true,
  "non_entry_pages": [
    "https://example.com/pricing",
    "https://example.com/docs",
    "https://example.com/signup"
  ],
  "non_entry_parsed": 3
}

{
  "entry_url": "https://example.com/",
  "issues": [],
  "meta_description": "Example SaaS is a synthetic subscription service used to exercise agent-readiness checks.",
  "missing": [],
  "title": "Example SaaS"
}

{
  "entry_url": "https://example.com/",
  "h1_count": 1,
  "heading_count": 1,
  "issues": [],
  "levels": [
    "h1"
  ]
}

{
  "entry_url": "https://example.com/",
  "html_lang": "en"
}

{
  "entry_url": "https://example.com/",
  "spa_shell_marker": false,
  "visible_text_chars": 90
}

{
  "redirect_chain": [],
  "redirect_count": 0
}

{
  "cache_control": null,
  "etag": "\"abc\"",
  "last_modified": null
}

{
  "broken": [],
  "broken_count": 0,
  "inconclusive": [],
  "refs_checked": 4,
  "refs_resolved": 4,
  "unresolved": []
}

{
  "dom_nodes": 26,
  "estimated_tokens": 22,
  "html_bytes": 1278,
  "level": "LOW",
  "link_count": 7,
  "script_bytes": 218,
  "script_ratio": 0.1705790297339593,
  "structured_bytes": 218,
  "text_chars": 90,
  "token_chars_ratio": 4
}

{
  "totals": {
    "forms": 1,
    "inputs": 2,
    "unlabeled_inputs": 1,
    "unlabeled_selects": 0,
    "unnamed_buttons": 0
  }
}

{
  "final_url": "https://example.com/scovant-core-probe-9b580505",
  "probed_url": "https://example.com/scovant-core-probe-9b580505",
  "redirected": false,
  "served_html": false,
  "status": 404
}

{
  "observed": []
}

{
  "honest_challenges": 0,
  "pages": [],
  "pages_checked": 5
}

{
  "downgrade_attempted": true,
  "downgrade_status": 301,
  "final_scheme": "https",
  "redirected_to_https": true
}

{
  "header": null,
  "max_age": null
}

{
  "csp_present": false,
  "csp_report_only": false,
  "frame_ancestors": false,
  "x_frame_options": null
}

{
  "missing": [
    "referrer-policy",
    "x-content-type-options"
  ],
  "referrer_policy": null,
  "x_content_type_options": null
}

{
  "canonical_location": true,
  "canonical_uris": [],
  "contact": true,
  "expired": null,
  "expires": null,
  "found_url": "https://example.com/.well-known/security.txt"
}

{
  "hit_count": 0,
  "hits": [],
  "surfaces_scanned": 3
}

{
  "hits": [],
  "surfaces_scanned": 3
}

{
  "contact_url": "https://example.com/contact",
  "kind": "page"
}

{
  "served_as_html": true,
  "status": 200,
  "text_chars": 342,
  "url": "https://example.com/privacy"
}

{
  "served_as_html": true,
  "status": 200,
  "text_chars": 324,
  "url": "https://example.com/terms"
}

{
  "contact": true,
  "expires": null,
  "expires_valid": null,
  "found_url": "https://example.com/.well-known/security.txt",
  "status": 200
}

{
  "has_price_text": true,
  "has_structured_price": false,
  "status": 200,
  "url": "https://example.com/pricing"
}

Remediation

• CORE-ACCESS-003 — Review whether blocking these retrieval crawlers is intended; they power answer-engine discovery, not model training.
• CORE-ACCESS-004 — Restrict only the training-purpose crawler tokens; leave search/retrieval crawlers allowed.
• CORE-ACCESS-006 — Regenerate the sitemap so lastmod reflects real content changes.
• CORE-INTERFACE-006 — Publish RFC 8414 metadata with `issuer`, `authorization_endpoint`, and `token_endpoint` at /.well-known/oauth-authorization-server.
• CORE-INTERFACE-007 — Publish RFC 9728 metadata with `resource` and a non-empty `authorization_servers` list at /.well-known/oauth-protected-resource.
• CORE-MACHINE-002 — Add the missing fields (url) to the Organization entity.
• CORE-OPERABILITY-001 — Server-render (or statically pre-render) the core content so an agent's plain HTTP fetch sees it.
• CORE-OPERABILITY-006 — Add a <label> (or aria-label/aria-labelledby) to every input/select, and a name or accessible text to every button.
• CORE-SECURITY-002 — Send Strict-Transport-Security: max-age=31536000 (add includeSubDomains once every subdomain is https).
• CORE-SECURITY-003 — Send a Content-Security-Policy with frame-ancestors, or at least X-Frame-Options: DENY.
• CORE-SECURITY-005 — Send Referrer-Policy: strict-origin-when-cross-origin and X-Content-Type-Options: nosniff.
• CORE-SECURITY-006 — Set Expires to a future date (RFC 3339) and keep it fresh.

Limitations

• Scovant Core evaluates declared and static evidence only; it does not observe real agent traffic.
• Only reachability and syntax are checked; per-agent policy is evaluated by the other CORE-ACCESS checks.
• Only the declared robots.txt policy is evaluated; whether the crawler is actually served is not observed.
• Only the declared robots.txt policy is evaluated.
• Only the first-declared sitemap (or its first child, for a sitemap index) is fetched and validated.
• Only ISO 8601 date-formatted lastmod values are parsed; malformed dates are ignored, not penalised.
• Only the entry page's declared canonical is evaluated.
• Only the entry page's own robots meta tag and X-Robots-Tag header are checked.
• Absence is not penalised; the convention is emerging. Reference checks are HTTP status only.
• Absence is not penalised; the convention is emerging.
• Only `/.well-known/mcp.json` and the two candidate server-card paths are probed; a custom discovery location is not found.
• Only the `mcpServers` object at /.well-known/mcp.json is parsed; a server card is not covered by this check.
• This is a static text scan of already-fetched HTML for a marker string; the browser-side registration was not executed, so a marker's presence does not confirm the tools actually register or work.
• Only a fixed set of conventional paths, plus same-origin entry-page links naming openapi/swagger, are probed.
• Only the conventional /.well-known/oauth-authorization-server path is probed.
• Only the conventional /.well-known/oauth-protected-resource path is probed.
• Only well-formed-JSON parseability is checked; schema.org vocabulary correctness is not validated.
• Only the schema_org nodes on the sampled pages are checked; an Organization declared elsewhere on the site is not evaluated.
• Only the schema_org nodes on the sampled pages are checked.
• Only the sampled pages are checked; a product catalog not represented in the sample is not evaluated.
• Only the first sampled page that exposes a Product entity is checked.
• Only the non-entry pages in the sampled set are checked.
• Only the entry page's metadata is checked.
• Only the entry page's heading outline is checked.
• Only the entry page's `<html lang>` attribute is checked.
• Only the images on the sampled pages are counted.
• Static-HTML signal only: the raw fetched response is inspected, never rendered in a browser, so a site that hydrates real content very quickly may still be flagged here.
• Only the entry URL's own redirect chain is inspected; redirects encountered while fetching other sampled pages are not counted here.
• Only the entry response's own headers are checked; per-page-type validator strategy is not inspected.
• Only the capped set of references collected by the machine_links gatherer are checked; endpoints not linked from any declared document are not found. A declared MCP endpoint is recorded but never judged — Core does not perform the MCP handshake.
• `estimated_tokens` is a character-count estimate (chars / token_chars_ratio), never a real tokenizer count, and only the entry page is measured.
• Only forms on the sampled page set are inspected; a form behind client-side rendering that never appears in the static HTML is not seen.
• One extra request to a path that cannot exist (the URL is in evidence); a site that deliberately serves a 200 landing page for every path fails this check by design. The shell heuristic errs on the lenient side: a very short 200 page that carries a script bundle is reported as an application shell (WARN) even when it is in fact a terse, genuinely server-rendered soft-404.
• Core never induces throttling; only 429 responses that happened to occur during the scan are examined, so most scans report N/A.
• Only the entry response and the sampled pages are inspected; a challenge served with an honest 403/429/503 is not a defect here (the access checks cover blocking).
• Passive signal only. Scovant Core did not authenticate, submit forms or invoke tools; observed authorization behaviour is not tested.
• Passive signal only. Scovant Core reports declaration and exposure in public machine-facing documents; it never tests exploitability, authenticates or invokes tools.
• Only the entry page's anchors are scanned; a contact method reachable only from a deeper page is not found.
• Only a same-origin link discovered from the entry page's nav/footer/anchors is followed; a shipping policy reachable only from a deeper page is not found.
• Only a same-origin link discovered from the entry page's nav/footer/anchors is followed; a returns policy reachable only from a deeper page is not found.
• Only a same-origin link discovered from the entry page's nav/footer/anchors is followed; a privacy policy reachable only from a deeper page is not found.
• Only a same-origin link discovered from the entry page's nav/footer/anchors is followed; terms reachable only from a deeper page are not found.
• Only the conventional /.well-known/security.txt and legacy /security.txt paths are probed.
• Pricing-page discovery follows only a same-origin link from the entry page; the structured-price fallback checks only the sampled pages.

Agentic Security & Trust

PASSIVE SIGNALS ONLY

• Observed authorization: NOT TESTED
• Verified agent identity: NOT TESTED
• Prompt-injection resilience: NOT TESTED
• Tool invocation safety: NOT TESTED

This section evaluates tested AI-agent security controls and machine-facing security signals. It is not an overall website or application security rating.

Not tested by Scovant Core

• Observed WAF access
• Real agent tasks
• MCP tool execution
• WebMCP state parity
• Multi-model reliability
• Regression stability

Core vs Cloud

Scovant Core measures passive, machine-facing signals. Scovant Cloud verifies how real agents actually behave, across providers, browser runtimes, security layers and time.

Methodology

Technical Readiness is the open R2 rating over the passive evidence Core gathered. Each rule outcome counts PASS = 1, WARN = 0.5, FAIL = 0 within its category, and the categories are weighted into a 0–100 rating. Coverage is the share of applicable weight Core could measure. A rule Core could not measure is listed as not measured, with a reason, and lowers coverage; it is never a FAIL. Below the coverage floor there is no number (INSUFFICIENT_EVIDENCE); an under-covered or errored measurement is DEGRADED (a number, no grade). Formula, weights and outcome states: docs/r2.md. The five-domain Static Signal Score is deprecated: it prints only with --legacy-score and is removed in 0.19.0.

Provenance

scan_id

local-golden

started_at

2026-09-04T00:00:00Z

completed_at

2026-09-04T00:00:00Z

schema_version

1.2

core_version

0.18.0

profile_detector_version

1.0

ruleset_version

2026.10

ruleset_digest

7f440d6205c3

python

<runtime>

platform

<runtime>

user_agent

ScovantCore/0.18.0 (+https://github.com/Scovant/scovant-core)

timeout

60.0

max_pages

5

network_mode

fixture

experimental

False

allow_private_networks

False

scan_scope

CANONICAL

included_checks

[]

excluded_checks

[]

error_count

0

evidence_min_coverage

0.6

canonical_min_coverage

0.85

dependencies

<runtime>

environment_digest

<runtime>