Scovant Core — https://example.com/step4

Profile: commerce (requested auto, confidence 85%)

Core version: 0.20.1

12 PASS, 26 WARN, 10 FAIL, 20 N/A, 0 ERROR (68 checks)

Technical Readiness

57 / 100

Grade: D · Status: OK · Coverage: 100% · Model: R2.1@7389c208c89e

Diagnostics (50 readiness checks): 4 pass · 24 warn · 8 fail

Capabilities detected (descriptive, not scored): mcp: absent · webmcp: absent · ucp: invalid · llms_txt: invalid · openapi: not_checked · oauth: not_checked · content_signal: invalid · security_txt: invalid

Standards: AgentReady v1.0 (descriptive, not scored): MUST 3/3 measured — 1 warn, 2 fail · SHOULD 4/12 measured — 3 warn, 1 fail · MAY none measured (0/3) — Mapping: docs/standards/agentready.md

Findings

Experimental (not scored)

• CORE-ACCESS-011 (PASS) — llms.txt links useful same-origin pages and carries no misplaced policy or template text.
• CORE-INTERFACE-008 (WARN) — A UCP profile is published but fails validation.
• CORE-OPERABILITY-011 (WARN) — 2 of 2 machine surface(s) are not linked from anything an agent reads: llms_txt, ucp.
• CORE-SECURITY-011 (PASS) — No indicators found.
• CORE-SECURITY-012 (PASS) — No indicators found.
• CORE-SECURITY-013 (PASS) — No indicators found.
• CORE-SECURITY-014 (PASS) — No indicators found.
• CORE-SECURITY-015 (PASS) — No indicators found.

N/A: CORE-INTERFACE-004, CORE-INTERFACE-009, CORE-MACHINE-012, CORE-OPERABILITY-007, CORE-SECURITY-009, CORE-SECURITY-010, CORE-SECURITY-016, CORE-SECURITY-017, CORE-SECURITY-018

Evidence

{
  "final_url": "https://example.com/step4",
  "input_url": "https://example.com/",
  "redirect_chain": [
    "https://example.com/",
    "https://example.com/step1",
    "https://example.com/step2",
    "https://example.com/step3"
  ],
  "redirect_count": 4,
  "status": 200
}

{
  "error": null,
  "resource": "https://example.com/robots.txt",
  "served_as_html": false,
  "sha256": "901c28336f0ee2ceb8b00545721bc3a75c09d539b54d031ab78f34d43f7e5294",
  "sitemap_count": 0,
  "status": 200,
  "unknown_directives": []
}

{
  "declared_policy": {
    "Applebot": false,
    "Bingbot": false,
    "Claude-SearchBot": false,
    "Googlebot": false,
    "OAI-SearchBot": false,
    "PerplexityBot": false
  },
  "http_status": 200,
  "resource": "https://example.com/robots.txt",
  "robots_present": true,
  "user_fetch_policy": {
    "ChatGPT-User": false,
    "Claude-User": false,
    "DuckAssistBot": false,
    "Perplexity-User": false
  }
}

{
  "explicit_separation": false,
  "http_status": 200,
  "resource": "https://example.com/robots.txt",
  "search_blocked": [
    "OAI-SearchBot",
    "Claude-SearchBot",
    "PerplexityBot",
    "Applebot",
    "Googlebot",
    "Bingbot"
  ],
  "training_blocked": [
    "GPTBot",
    "ClaudeBot",
    "Applebot-Extended",
    "CCBot",
    "Google-Extended"
  ]
}

{
  "entry_count": 0,
  "exists": false,
  "kind": null,
  "parse_error": null,
  "probe_error": null,
  "probe_status": 404,
  "served_as_html": false,
  "url": null,
  "valid": false
}

{
  "url": null
}

{
  "canonical_url": "https://example.org/elsewhere",
  "entry_url": "https://example.com/step4"
}

{
  "robots_meta": "noindex",
  "x_robots_tag": null
}

{
  "errors": [],
  "references_broken": [
    "https://example.com/does-not-exist"
  ],
  "references_checked": 1,
  "references_unresolved": [],
  "resource": "https://example.com/llms.txt",
  "valid": true
}

{
  "declared": true,
  "dimensions": {
    "ai-input": "unset",
    "ai-train": "unset",
    "search": "unset"
  },
  "syntax_errors": [
    "unrecognized value for 'search': 'maybe' (expected yes|no)"
  ]
}

{
  "exists": false,
  "http_status": 404,
  "resource": "https://example.com/.well-known/mcp.json",
  "server_card": false,
  "valid": false
}

{
  "pages_scanned": 1,
  "pages_with_marker": []
}

{
  "pages": [
    {
      "parsed": 1,
      "raw": 2,
      "url": "https://example.com/step4"
    }
  ],
  "parsed_total": 1,
  "raw_total": 2
}

{
  "found": false,
  "pages_parsed": 1
}

{
  "found": false,
  "pages_parsed": 1
}

{
  "has_identifiers": false,
  "pages_parsed": 1,
  "product_pages": [
    "https://example.com/step4"
  ]
}

{
  "availability": null,
  "currency": null,
  "missing": [
    "price",
    "priceCurrency",
    "availability"
  ],
  "price": null,
  "url": "https://example.com/step4"
}

{
  "count": 0,
  "identifier_keys": [],
  "pages_parsed": 1
}

{
  "entry_url": "https://example.com/step4",
  "issues": [
    "og:title",
    "og:description"
  ],
  "meta_description": "A synthetic fixture site with several broken agent-readiness signals.",
  "missing": [
    "og:title",
    "og:description"
  ],
  "title": "Example Bad Shop"
}

{
  "entry_url": "https://example.com/step4",
  "h1_count": 2,
  "heading_count": 2,
  "issues": [
    "multiple H1"
  ],
  "levels": [
    "h1",
    "h1"
  ]
}

{
  "entry_url": "https://example.com/step4",
  "html_lang": null
}

{
  "covered": 0,
  "empty_alt": 0,
  "pages_parsed": 1,
  "ratio": 0.0,
  "total": 1,
  "with_alt": 0
}

{
  "entry_url": "https://example.com/step4",
  "spa_shell_marker": false,
  "visible_text_chars": 148
}

{
  "redirect_chain": [
    "https://example.com/",
    "https://example.com/step1",
    "https://example.com/step2",
    "https://example.com/step3"
  ],
  "redirect_count": 4
}

{
  "cache_control": null,
  "etag": null,
  "last_modified": null
}

{
  "broken": [
    {
      "source": "canonical",
      "status": 404,
      "url": "https://example.org/elsewhere"
    },
    {
      "source": "llms",
      "status": 404,
      "url": "https://example.com/does-not-exist"
    }
  ],
  "broken_count": 2,
  "inconclusive": [],
  "refs_checked": 2,
  "refs_resolved": 2,
  "unresolved": []
}

{
  "dom_nodes": 16,
  "estimated_tokens": 37,
  "html_bytes": 725,
  "level": "LOW",
  "link_count": 0,
  "script_bytes": 88,
  "script_ratio": 0.12137931034482759,
  "structured_bytes": 88,
  "text_chars": 148,
  "token_chars_ratio": 4
}

{
  "totals": {
    "forms": 1,
    "inputs": 1,
    "unlabeled_inputs": 1,
    "unlabeled_selects": 0,
    "unnamed_buttons": 0
  }
}

{
  "final_url": "https://example.com/scovant-core-probe-9b580505",
  "probed_url": "https://example.com/scovant-core-probe-9b580505",
  "redirected": false,
  "served_html": false,
  "status": 404
}

{
  "observed": []
}

{
  "honest_challenges": 0,
  "pages": [],
  "pages_checked": 2
}

{
  "downgrade_attempted": true,
  "downgrade_status": 301,
  "final_scheme": "https",
  "redirected_to_https": true
}

{
  "header": null,
  "max_age": null
}

{
  "csp_present": false,
  "csp_report_only": false,
  "frame_ancestors": false,
  "x_frame_options": null
}

{
  "missing": [
    "referrer-policy",
    "x-content-type-options"
  ],
  "referrer_policy": null,
  "x_content_type_options": null
}

{
  "canonical_location": true,
  "canonical_uris": [],
  "contact": false,
  "expired": true,
  "expires": "2020-01-01T00:00:00Z",
  "found_url": "https://example.com/.well-known/security.txt"
}

{
  "hit_count": 0,
  "hits": [],
  "surfaces_scanned": 4
}

{
  "hits": [],
  "surfaces_scanned": 4
}

{
  "contact_url": null,
  "kind": null
}

{
  "contact": false,
  "expires": "2020-01-01T00:00:00Z",
  "expires_valid": false,
  "found_url": "https://example.com/.well-known/security.txt",
  "status": 200
}

Remediation

• CORE-ACCESS-001 — Collapse the redirect chain to at most one hop.
• CORE-ACCESS-002 — Scope Disallow rules to specific paths instead of blocking `/` for `*`.
• CORE-ACCESS-003 — Allow search/retrieval crawlers (OAI-SearchBot, Claude-SearchBot, PerplexityBot, …) in robots.txt while keeping any training restrictions separate.
• CORE-ACCESS-004 — Restrict only the training-purpose crawler tokens; leave search/retrieval crawlers allowed.
• CORE-ACCESS-005 — Publish /sitemap.xml and declare it in robots.txt.
• CORE-ACCESS-007 — Point the canonical tag at a URL on this site's own host.
• CORE-ACCESS-008 — Remove the noindex directive from the meta robots tag or X-Robots-Tag header.
• CORE-ACCESS-009 — Remove or fix the broken references in llms.txt.
• CORE-ACCESS-010 — Fix the Content-Signal directive, e.g. "Content-Signal: search=yes, ai-input=yes, ai-train=no".
• CORE-MACHINE-001 — Fix the malformed JSON-LD blocks so every one parses (validate with a JSON linter before publishing).
• CORE-MACHINE-002 — Add JSON-LD with "@type": "Organization" declaring at least name and url.
• CORE-MACHINE-003 — Add JSON-LD with "@type": "WebSite" or "WebPage".
• CORE-MACHINE-004 — Add a stable identifier (sku, gtin, mpn, or brand) to the Product entity.
• CORE-MACHINE-005 — Add an Offer with price, priceCurrency, and availability to the Product entity.
• CORE-MACHINE-006 — Add a stable identifier (sku, gtin, mpn, or brand) to the Product entity.
• CORE-MACHINE-008 — Add the missing metadata tags and give title and description distinct content.
• CORE-MACHINE-009 — Use exactly one H1 per page and avoid skipping heading levels (e.g. h1 to h3).
• CORE-MACHINE-010 — Add a valid `lang` attribute to the `<html>` tag (e.g. `lang="en"`).
• CORE-MACHINE-011 — Add an alt attribute (or an explicit empty alt for decorative images) to every image.
• CORE-OPERABILITY-001 — Server-render (or statically pre-render) the core content so an agent's plain HTTP fetch sees it.
• CORE-OPERABILITY-002 — Collapse the redirect chain to at most one hop.
• CORE-OPERABILITY-003 — Add an ETag or Last-Modified header so agents can issue conditional GETs.
• CORE-OPERABILITY-004 — Fix or remove the broken references (sitemap, llms.txt, OpenAPI spec, policy links) so agents don't hit dead links.
• CORE-OPERABILITY-006 — Add a <label> (or aria-label/aria-labelledby) to every input/select, and a name or accessible text to every button.
• CORE-SECURITY-002 — Send Strict-Transport-Security: max-age=31536000 (add includeSubDomains once every subdomain is https).
• CORE-SECURITY-003 — Send a Content-Security-Policy with frame-ancestors, or at least X-Frame-Options: DENY.
• CORE-SECURITY-005 — Send Referrer-Policy: strict-origin-when-cross-origin and X-Content-Type-Options: nosniff.
• CORE-SECURITY-006 — Set Expires to a future date (RFC 3339) and keep it fresh.
• CORE-TRUST-001 — Add a clearly labeled contact or support link (a page or a mailto link) to the entry page.
• CORE-TRUST-002 — Publish a shipping policy page (cost, timing, carriers) and link it from the entry page's nav or footer.
• CORE-TRUST-003 — Publish a returns/refund policy page and link it from the entry page's nav or footer.
• CORE-TRUST-004 — Publish a privacy policy page and link it from the entry page's nav or footer.
• CORE-TRUST-005 — Publish a terms/conditions page and link it from the entry page's nav or footer.
• CORE-TRUST-006 — Add a Contact field (RFC 9116) to security.txt.

Limitations

• Scovant Core evaluates declared and static evidence only; it does not observe real agent traffic.
• Only reachability and syntax are checked; per-agent policy is evaluated by the other CORE-ACCESS checks.
• Only the declared robots.txt policy is evaluated; whether the crawler is actually served is not observed.
• Only the declared robots.txt policy is evaluated.
• Only the first-declared sitemap (or its first child, for a sitemap index) is fetched and validated.
• Only ISO 8601 date-formatted lastmod values are parsed; malformed dates are ignored, not penalised.
• Only the entry page's declared canonical is evaluated.
• Only the entry page's own robots meta tag and X-Robots-Tag header are checked.
• Absence is not penalised; the convention is emerging. Reference checks are HTTP status only.
• Absence is not penalised; the convention is emerging.
• Only `/.well-known/mcp.json` and the two candidate server-card paths are probed; a custom discovery location is not found.
• Only the `mcpServers` object at /.well-known/mcp.json is parsed; a server card is not covered by this check.
• This is a static text scan of already-fetched HTML for a marker string; the browser-side registration was not executed, so a marker's presence does not confirm the tools actually register or work.
• Only a fixed set of conventional paths, plus same-origin entry-page links naming openapi/swagger, are probed.
• Only the conventional /.well-known/oauth-authorization-server path is probed.
• Only the conventional /.well-known/oauth-protected-resource path is probed.
• Only well-formed-JSON parseability is checked; schema.org vocabulary correctness is not validated.
• Only the schema_org nodes on the sampled pages are checked; an Organization declared elsewhere on the site is not evaluated.
• Only the schema_org nodes on the sampled pages are checked.
• Only the sampled pages are checked; a product catalog not represented in the sample is not evaluated.
• Only the first sampled page that exposes a Product entity is checked.
• Only the non-entry pages in the sampled set are checked.
• Only the entry page's metadata is checked.
• Only the entry page's heading outline is checked.
• Only the entry page's `<html lang>` attribute is checked.
• Only the images on the sampled pages are counted.
• Static-HTML signal only: the raw fetched response is inspected, never rendered in a browser, so a site that hydrates real content very quickly may still be flagged here.
• Only the entry URL's own redirect chain is inspected; redirects encountered while fetching other sampled pages are not counted here.
• Only the entry response's own headers are checked; per-page-type validator strategy is not inspected.
• Only the capped set of references collected by the machine_links gatherer are checked; endpoints not linked from any declared document are not found. A declared MCP endpoint is recorded but never judged — Core does not perform the MCP handshake.
• `estimated_tokens` is a character-count estimate (chars / token_chars_ratio), never a real tokenizer count, and only the entry page is measured.
• Only forms on the sampled page set are inspected; a form behind client-side rendering that never appears in the static HTML is not seen.
• One extra request to a path that cannot exist (the URL is in evidence); a site that deliberately serves a 200 landing page for every path fails this check by design. The shell heuristic errs on the lenient side: a very short 200 page that carries a script bundle is reported as an application shell (WARN) even when it is in fact a terse, genuinely server-rendered soft-404.
• Core never induces throttling; only 429 responses that happened to occur during the scan are examined, so most scans report N/A.
• Only the entry response and the sampled pages are inspected; a challenge served with an honest 403/429/503 is not a defect here (the access checks cover blocking).
• Passive signal only. Scovant Core did not authenticate, submit forms or invoke tools; observed authorization behaviour is not tested.
• Passive signal only. Scovant Core reports declaration and exposure in public machine-facing documents; it never tests exploitability, authenticates or invokes tools.
• Only the entry page's anchors are scanned; a contact method reachable only from a deeper page is not found.
• Only a same-origin link discovered from the entry page's nav/footer/anchors is followed; a shipping policy reachable only from a deeper page is not found.
• Only a same-origin link discovered from the entry page's nav/footer/anchors is followed; a returns policy reachable only from a deeper page is not found.
• Only a same-origin link discovered from the entry page's nav/footer/anchors is followed; a privacy policy reachable only from a deeper page is not found.
• Only a same-origin link discovered from the entry page's nav/footer/anchors is followed; terms reachable only from a deeper page are not found.
• Only the conventional /.well-known/security.txt and legacy /security.txt paths are probed.
• Pricing-page discovery follows only a same-origin link from the entry page; the structured-price fallback checks only the sampled pages.

Agentic Security & Trust

PASSIVE SIGNALS ONLY

• Observed authorization: NOT TESTED
• Verified agent identity: NOT TESTED
• Prompt-injection resilience: NOT TESTED
• Tool invocation safety: NOT TESTED

This section evaluates tested AI-agent security controls and machine-facing security signals. It is not an overall website or application security rating.

Not tested by Scovant Core

• Observed WAF access
• Real agent tasks
• MCP tool execution
• WebMCP state parity
• Multi-model reliability
• Regression stability

Core vs Cloud

Scovant Core measures passive, machine-facing signals. Scovant Cloud verifies how real agents actually behave, across providers, browser runtimes, security layers and time.

Methodology

Technical Readiness is the open R2 rating over the passive evidence Core gathered. Each rule outcome counts PASS = 1, WARN = 0.5, FAIL = 0 within its category, and the categories combine into a 0–100 rating. Coverage is the severity-adjusted share of the applicable rules Core could measure. A rule Core could not measure is listed as not measured, with a reason, and lowers coverage; it is never a FAIL. Below the coverage floor there is no number (INSUFFICIENT_EVIDENCE); an under-covered or errored measurement is DEGRADED (a number, no grade). Formula, category shares and outcome states: docs/r2.md. Checks are diagnostics: each reports its own verdict and evidence and none feeds the rating.

Provenance

scan_id

local-golden

started_at

2026-09-04T00:00:00Z

completed_at

2026-09-04T00:00:00Z

schema_version

2.1

core_version

0.20.1

profile_detector_version

1.0

ruleset_version

2026.10

ruleset_digest

e7426fb13abe

python

<runtime>

platform

<runtime>

user_agent

ScovantCore/0.20.1 (+https://github.com/Scovant/scovant-core)

timeout

60.0

max_pages

5

network_mode

fixture

experimental

False

allow_private_networks

False

scan_scope

CANONICAL

included_checks

[]

excluded_checks

[]

error_count

0

dependencies

<runtime>

environment_digest

<runtime>