@certscore/mcp 0.2.16 → 0.2.17

package/dist/certscore-mcp.mjs

@@ -14405,8 +14405,8 @@ var CertScoreClient = class {
       }
       const elapsedMs = Date.now() - options.startedAt;
       const fallbackMs = options.adaptivePolling ? adaptivePollIntervalMs(elapsedMs) : options.pollIntervalMs;
-      const delay = Math.min(retryDelayMs(status, retryAfterSeconds, fallbackMs), Math.max(0, options.maxWaitMs - elapsedMs));
-      await sleep(delay, options.signal);
+      const delay2 = Math.min(retryDelayMs(status, retryAfterSeconds, fallbackMs), Math.max(0, options.maxWaitMs - elapsedMs));
+      await sleep(delay2, options.signal);
       const pollUrl = this.statusUrlFor(status);
       const response = await this.fetch(pollUrl, { signal: options.signal });
       if (response.status === 202 || response.status === 200 || response.status === 429) {
@@ -14442,8 +14442,8 @@ var CertScoreClient = class {
       }
       const elapsedMs = Date.now() - options.startedAt;
       const fallbackMs = options.adaptivePolling ? adaptivePollIntervalMs(elapsedMs) : options.pollIntervalMs;
-      const delay = Math.min(retryDelayMs(status, void 0, fallbackMs), Math.max(0, options.maxWaitMs - elapsedMs));
-      await sleep(delay, options.signal);
+      const delay2 = Math.min(retryDelayMs(status, void 0, fallbackMs), Math.max(0, options.maxWaitMs - elapsedMs));
+      await sleep(delay2, options.signal);
       let response = await this.fetch(this.scanResourceStatusUrlFor(status), { signal: options.signal, internalMcpOperation: options.internalMcpOperation });
       if (response.status === 404 && status.jobId) {
         response = await this.fetch(this.statusUrlFor(status), { signal: options.signal, internalMcpOperation: options.internalMcpOperation });
@@ -18675,6 +18675,131 @@ var coerce = {
 };
 var NEVER = INVALID;
 
+// ../certscore-api-contracts/src/scan-observation-results.ts
+var apiV2PostRefusalObservationSchema = external_exports.object({
+  status: external_exports.enum(["confirmed_observation", "confirmed_clean", "unconfirmed", "not_attempted", "unsupported", "aborted"]),
+  refusalExercised: external_exports.boolean(),
+  observationCount: external_exports.number().int().min(0),
+  productionProjectable: external_exports.boolean(),
+  evidenceDisposition: external_exports.enum(["confirmed", "indeterminate"]),
+  indeterminateReason: external_exports.string().min(1).max(160).nullable(),
+  verdict: external_exports.enum([
+    "eligible_nonessential_activity_observed_after_confirmed_refusal",
+    "retained_consent_signal_contradiction_observed_after_confirmed_refusal",
+    "no_eligible_nonessential_activity_observed_during_completed_window",
+    "no_confirmed_post_refusal_verdict"
+  ]),
+  interpretation: external_exports.string().min(1).max(500),
+  observationStrategy: external_exports.enum(["stop_on_first_eligible_activity", "not_applicable"]),
+  termination: external_exports.object({
+    kind: external_exports.enum(["evidence_satisfied", "window_elapsed", "unavailable"]),
+    intentional: external_exports.boolean(),
+    trigger: external_exports.enum([
+      "non_essential_request_observed",
+      "non_essential_storage_write_observed",
+      "refusal_signal_contradiction_observed",
+      "window_elapsed",
+      "reject_path_timeout",
+      "worker_failed",
+      "unavailable"
+    ])
+  }).strict(),
+  completedAt: external_exports.string().nullable(),
+  coverageLimitations: external_exports.array(external_exports.string()).max(24),
+  /** @deprecated Use coverageLimitations. Retained for API compatibility. */
+  limitations: external_exports.array(external_exports.string()).max(24)
+}).strict();
+var apiV2PostAcceptObservationSchema = external_exports.object({
+  status: external_exports.enum(["confirmed_observation", "confirmed_clean", "unconfirmed", "not_attempted", "unsupported", "aborted"]),
+  acceptanceExercised: external_exports.boolean(),
+  observationCount: external_exports.number().int().min(0),
+  productionProjectable: external_exports.boolean(),
+  evidenceDisposition: external_exports.enum(["confirmed", "indeterminate"]),
+  indeterminateReason: external_exports.string().min(1).max(160).nullable(),
+  verdict: external_exports.enum([
+    "eligible_nonessential_activity_observed_after_confirmed_acceptance",
+    "retained_consent_signal_contradiction_observed_after_confirmed_acceptance",
+    "no_eligible_nonessential_activity_observed_during_completed_window",
+    "no_confirmed_post_accept_verdict"
+  ]),
+  interpretation: external_exports.string().min(1).max(500),
+  observationStrategy: external_exports.enum(["stop_on_first_eligible_activity", "not_applicable"]),
+  termination: external_exports.object({
+    kind: external_exports.enum(["evidence_satisfied", "window_elapsed", "unavailable"]),
+    intentional: external_exports.boolean(),
+    trigger: external_exports.enum([
+      "non_essential_request_observed",
+      "non_essential_storage_write_observed",
+      "acceptance_signal_contradiction_observed",
+      "window_elapsed",
+      "accept_control_not_observed",
+      "accept_path_timeout",
+      "accept_observation_window_truncated",
+      "worker_failed",
+      "unavailable"
+    ])
+  }).strict(),
+  completedAt: external_exports.string().nullable(),
+  coverageLimitations: external_exports.array(external_exports.string()).max(24),
+  /** @deprecated Use coverageLimitations. Retained for API compatibility. */
+  limitations: external_exports.array(external_exports.string()).max(24)
+}).strict();
+var apiV2GpcComparisonDeltaSchema = external_exports.object({
+  baselineCount: external_exports.number().int().nonnegative(),
+  gpcCount: external_exports.number().int().nonnegative(),
+  countDelta: external_exports.number().int(),
+  baselineOnly: external_exports.array(external_exports.string().min(1).max(500)).max(100),
+  gpcOnly: external_exports.array(external_exports.string().min(1).max(500)).max(100),
+  shared: external_exports.array(external_exports.string().min(1).max(500)).max(100)
+}).strict();
+var apiV2GpcResponseSchema = external_exports.object({
+  status: external_exports.enum(["responsive", "no_observable_response", "indeterminate"]),
+  findingTitle: external_exports.enum(["GPC response", "No observable GPC response"]),
+  summary: external_exports.string().min(1).max(2e3),
+  scoreEffect: external_exports.literal("none"),
+  legalInterpretation: external_exports.literal("not_assessed"),
+  comparison: external_exports.object({
+    comparable: external_exports.boolean(),
+    protocol: external_exports.literal("passive_baseline_with_sec_gpc"),
+    baselineArtifact: external_exports.object({
+      lane: external_exports.literal("runtime_evidence"),
+      sha256: external_exports.string().regex(/^[a-f0-9]{64}$/),
+      sizeBytes: external_exports.number().int().nonnegative()
+    }).strict(),
+    gpcArtifact: external_exports.object({
+      lane: external_exports.literal("gpc_observation"),
+      sha256: external_exports.string().regex(/^[a-f0-9]{64}$/),
+      sizeBytes: external_exports.number().int().nonnegative()
+    }).strict(),
+    enabledProof: external_exports.object({
+      secGpcHeaderValue: external_exports.literal("1"),
+      requestsWithSecGpc: external_exports.number().int().nonnegative(),
+      requestEventIds: external_exports.array(external_exports.string().min(1).max(160)).max(100),
+      navigatorGlobalPrivacyControl: external_exports.literal(true)
+    }).strict(),
+    deltas: external_exports.object({
+      cookies: apiV2GpcComparisonDeltaSchema,
+      trackers: apiV2GpcComparisonDeltaSchema,
+      advertisingOrMeasurementActivity: apiV2GpcComparisonDeltaSchema,
+      consentOrCmpBehavior: apiV2GpcComparisonDeltaSchema
+    }).strict(),
+    limitationKeys: external_exports.array(external_exports.string().min(1).max(160)).max(24)
+  }).strict(),
+  californiaPolicy: external_exports.object({
+    applied: external_exports.boolean(),
+    deductionPoints: external_exports.union([external_exports.literal(0), external_exports.literal(15)])
+  }).strict(),
+  evidenceUrl: external_exports.string().url()
+}).strict().superRefine((response, context) => {
+  if (response.californiaPolicy.applied !== (response.californiaPolicy.deductionPoints === 15)) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      message: "California GPC policy application must match its deduction.",
+      path: ["californiaPolicy"]
+    });
+  }
+});
+
 // ../certscore-api-contracts/src/scan-no-go.ts
 var publicScanNoGoReasonCodes = [
   "blank_or_unusable_page",
@@ -18878,6 +19003,9 @@ var pulseResponseSchema = external_exports.object({
   scanStatus: external_exports.string().optional(),
   resultDisposition: scanResultDispositionSchema.optional(),
   noGo: scanNoGoResultSchema.optional(),
+  gpcResponse: apiV2GpcResponseSchema.nullable().optional(),
+  postAcceptObservation: apiV2PostAcceptObservationSchema.nullable().optional(),
+  postRefusalObservation: apiV2PostRefusalObservationSchema.nullable().optional(),
   summary: pulseSummarySchema.optional(),
   topFindings: external_exports.array(pulseFindingSchema).optional(),
   transportSecurity: pulseTransportSecuritySchema.optional(),
@@ -18929,6 +19057,7 @@ var pulseErrorSchema = external_exports.object({
   type: external_exports.literal("certscore_pulse_error"),
   error: external_exports.object({
     code: pulseErrorCodeSchema,
+    reasonCode: external_exports.enum(["non_public_target"]).nullable().optional(),
     message: external_exports.string(),
     retryAfterSeconds: external_exports.number().int().nullable().optional(),
     recommendedNextAction: external_exports.string().nullable().optional(),
@@ -18968,47 +19097,6 @@ function isCanonicalScanId(value) {
 }
 var apiV2Disclaimer = "CertScore outputs are automated public-web observations for human and agentic review. They are not legal advice, certification, or a compliance determination.";
 var apiV2ScanStatusSchema = external_exports.enum(["queued", "running", "finalizing", "completed", "completed_limited", "failed", "expired", "rate_limited"]);
-var apiV2PostRefusalObservationSchema = external_exports.object({
-  status: external_exports.enum([
-    "confirmed_observation",
-    "confirmed_clean",
-    "unconfirmed",
-    "not_attempted",
-    "unsupported",
-    "aborted"
-  ]),
-  refusalExercised: external_exports.boolean(),
-  observationCount: external_exports.number().int().min(0),
-  productionProjectable: external_exports.boolean(),
-  verdict: external_exports.enum([
-    "eligible_nonessential_activity_observed_after_confirmed_refusal",
-    "retained_consent_signal_contradiction_observed_after_confirmed_refusal",
-    "no_eligible_nonessential_activity_observed_during_completed_window",
-    "no_confirmed_post_refusal_verdict"
-  ]),
-  interpretation: external_exports.string().min(1).max(500),
-  observationStrategy: external_exports.enum([
-    "stop_on_first_eligible_activity",
-    "not_applicable"
-  ]),
-  termination: external_exports.object({
-    kind: external_exports.enum(["evidence_satisfied", "window_elapsed", "unavailable"]),
-    intentional: external_exports.boolean(),
-    trigger: external_exports.enum([
-      "non_essential_request_observed",
-      "non_essential_storage_write_observed",
-      "refusal_signal_contradiction_observed",
-      "window_elapsed",
-      "reject_path_timeout",
-      "worker_failed",
-      "unavailable"
-    ])
-  }).strict(),
-  completedAt: external_exports.string().nullable(),
-  coverageLimitations: external_exports.array(external_exports.string()).max(24),
-  /** @deprecated Use coverageLimitations. Retained for API compatibility. */
-  limitations: external_exports.array(external_exports.string()).max(24)
-}).strict();
 var apiV2ScanFreshnessSchema = external_exports.enum(["latest", "refresh"]);
 var apiV2ScanFromSchema = external_exports.enum(["eu_de", "eu_ie", "california"]);
 var apiV2FindingCriticalitySchema = external_exports.enum(["critical", "high", "medium", "low", "info", "unknown"]);
@@ -19031,6 +19119,96 @@ var apiV2ScanCreationMetadataShape = {
   upgradeMessage: external_exports.string().nullable().optional(),
   recommendedNextTool: external_exports.enum(["certscore_get_scan_status", "certscore_get_scan_bundle"]).optional()
 };
+var apiV2PreConsentRuntimePreviewSchema = external_exports.object({
+  type: external_exports.literal("certscore_pre_consent_preview"),
+  resultStage: external_exports.literal("preliminary"),
+  final: external_exports.literal(false),
+  sourceLane: external_exports.literal("runtime_evidence"),
+  generatedAt: external_exports.string().datetime(),
+  runtimeCoverage: external_exports.object({
+    status: external_exports.enum(["usable", "limited_partial", "limited_none", "not_applicable"]),
+    limitationKeys: external_exports.array(external_exports.string().min(1).max(120)).max(16)
+  }).strict(),
+  summary: external_exports.object({
+    cookieCount: external_exports.number().int().min(0),
+    returnedCookieCount: external_exports.number().int().min(0).optional(),
+    trackerCount: external_exports.number().int().min(0),
+    trackingVendorCount: external_exports.number().int().min(0).optional(),
+    returnedTrackingVendorCount: external_exports.number().int().min(0).optional(),
+    operationalVendorCount: external_exports.number().int().min(0).optional(),
+    returnedOperationalVendorCount: external_exports.number().int().min(0).optional(),
+    thirdPartyRequestCount: external_exports.number().int().min(0),
+    vendorCount: external_exports.number().int().min(0)
+  }).strict(),
+  cookies: external_exports.array(external_exports.object({
+    name: external_exports.string().min(1).max(256),
+    domain: external_exports.string().min(1).max(253).nullable(),
+    party: external_exports.enum(["first_party", "third_party", "unknown"]),
+    purpose: external_exports.enum([
+      "analytics",
+      "advertising",
+      "marketing",
+      "personalization",
+      "session_replay",
+      "consent_management",
+      "tag_management",
+      "infrastructure",
+      "security",
+      "performance_monitoring",
+      "customer_support",
+      "unknown"
+    ]),
+    essentiality: external_exports.enum(["essential", "non_essential", "unknown"]),
+    observedAtMs: external_exports.number().int().min(0).nullable()
+  }).strict()).max(20),
+  trackers: external_exports.array(external_exports.object({
+    vendor: external_exports.string().min(1).max(160),
+    product: external_exports.string().min(1).max(160).nullable(),
+    purpose: external_exports.enum([
+      "analytics",
+      "advertising",
+      "marketing",
+      "personalization",
+      "session_replay",
+      "consent_management",
+      "tag_management",
+      "infrastructure",
+      "security",
+      "performance_monitoring",
+      "customer_support",
+      "unknown"
+    ]),
+    confidence: external_exports.number().min(0).max(1),
+    domains: external_exports.array(external_exports.string().min(1).max(253)).max(8)
+  }).strict()).max(20),
+  operationalVendors: external_exports.array(external_exports.object({
+    vendor: external_exports.string().min(1).max(160),
+    product: external_exports.string().min(1).max(160).nullable(),
+    purpose: external_exports.enum([
+      "analytics",
+      "advertising",
+      "marketing",
+      "personalization",
+      "session_replay",
+      "consent_management",
+      "tag_management",
+      "infrastructure",
+      "security",
+      "performance_monitoring",
+      "customer_support",
+      "unknown"
+    ]),
+    confidence: external_exports.number().min(0).max(1),
+    domains: external_exports.array(external_exports.string().min(1).max(253)).max(8)
+  }).strict()).max(20).optional(),
+  truncated: external_exports.object({
+    cookies: external_exports.boolean(),
+    trackers: external_exports.boolean(),
+    operationalVendors: external_exports.boolean().optional()
+  }).strict(),
+  mustContinuePolling: external_exports.literal(true),
+  observationOnlyDisclaimer: external_exports.string().min(1).max(500)
+}).strict();
 var apiV2LinksSchema = external_exports.object({
   self: external_exports.string().optional(),
   status: external_exports.string().optional(),
@@ -19044,6 +19222,7 @@ var apiV2ErrorSchema = external_exports.object({
   type: external_exports.literal("certscore_api_error"),
   error: external_exports.object({
     code: external_exports.enum(["invalid_request", "invalid_url", "not_found", "rate_limited", "unauthorized", "forbidden", "scan_unavailable", "internal_error"]),
+    reasonCode: external_exports.enum(["non_public_target"]).nullable().optional(),
     message: external_exports.string(),
     retryable: external_exports.boolean(),
     retryAfterSeconds: external_exports.number().int().nullable(),
@@ -19099,7 +19278,10 @@ var apiV2ScanJobSchema = external_exports.object({
   scoreVersion: external_exports.string().nullable().optional(),
   scoreUpdatedAt: external_exports.string().nullable().optional(),
   riskLevel: external_exports.string().nullable().optional(),
+  gpcResponse: apiV2GpcResponseSchema.nullable().optional(),
+  postAcceptObservation: apiV2PostAcceptObservationSchema.nullable().optional(),
   postRefusalObservation: apiV2PostRefusalObservationSchema.nullable().optional(),
+  preConsentPreview: apiV2PreConsentRuntimePreviewSchema.optional(),
   coverage: external_exports.object({
     status: external_exports.string().optional(),
     summary: external_exports.string().optional(),
@@ -19144,6 +19326,8 @@ var apiV2ScanResourceSchema = external_exports.object({
   scoreVersion: external_exports.string().nullable().optional(),
   scoreUpdatedAt: external_exports.string().nullable().optional(),
   riskLevel: external_exports.string().nullable().optional(),
+  gpcResponse: apiV2GpcResponseSchema.nullable().optional(),
+  postAcceptObservation: apiV2PostAcceptObservationSchema.nullable().optional(),
   postRefusalObservation: apiV2PostRefusalObservationSchema.nullable().optional(),
   coverage: external_exports.object({
     status: external_exports.string().optional(),
@@ -19386,6 +19570,14 @@ var apiV2PreConsentCookiesTrackersRowSchema = external_exports.object({
 var apiV2PreConsentCookiesTrackersSummarySchema = external_exports.object({
   rowCount: external_exports.number().int().min(0),
   trackerCount: external_exports.number().int().min(0),
+  trackerCountScope: external_exports.literal("canonical_inventory_rows_including_operational").optional(),
+  trackerCategoryCounts: external_exports.object({
+    advertising: external_exports.number().int().min(0),
+    analytics: external_exports.number().int().min(0),
+    essential: external_exports.number().int().min(0),
+    functional: external_exports.number().int().min(0),
+    review: external_exports.number().int().min(0)
+  }).strict().optional(),
   cookieCount: external_exports.number().int().min(0),
   requestCount: external_exports.number().int().min(0),
   vendorCount: external_exports.number().int().min(0).default(0),
@@ -19412,15 +19604,15 @@ var mcpCreateScanInputSchema = {
   url: external_exports.string().min(1).describe("Public URL or domain to scan."),
   detail: mcpPulseDetailSchema.optional().describe("Pulse detail level. Defaults to summary."),
   format: mcpPulseFormatSchema.optional().describe("Response format for completed immediate responses. Defaults to json."),
-  freshness: mcpPulseFreshnessSchema.optional().describe("Prefer latest for ordinary website checks so an eligible recent completed scan can be reused and new-scan allowance is not consumed unnecessarily; CertScore may still start a scan when no suitable result exists. Use refresh only when the user explicitly requests a fresh, new, or repeated scan; ordinary check, scan, audit, inspect, review, or assess wording alone does not request refresh."),
-  scanFrom: mcpScanFromSchema.optional().describe("Optional execution region for a newly queued scan. Omit when the user did not request a jurisdiction or regional perspective; use eu_de or eu_ie for explicit EU/GDPR/ePrivacy requests and california for explicit California/CCPA/CPRA requests. Do not use multiple regions unless comparison is requested, and do not infer EU from consent or California from a U.S. user location.")
+  freshness: mcpPulseFreshnessSchema.optional().describe("Scan freshness policy. latest allows eligible recent completed-result reuse when available; refresh requests a new scan. Defaults to latest."),
+  scanFrom: mcpScanFromSchema.optional().describe("Optional execution region for a newly queued scan: eu_de, eu_ie, california, or the service default when omitted.")
 };
 var mcpScanSiteInputSchema = {
   url: mcpCreateScanInputSchema.url,
   freshness: mcpCreateScanInputSchema.freshness,
   scanFrom: mcpCreateScanInputSchema.scanFrom,
-  waitForCompletion: external_exports.boolean().optional().describe("Wait for a completed scan resource within this tool call's wall-clock budget. Defaults to true. Set false only for an explicitly asynchronous workflow."),
-  maxWaitSeconds: external_exports.number().int().min(1).max(45).optional().describe("Total wall-clock budget for scan creation plus optional completion waiting. Defaults to 25 seconds. Creation time is deducted from polling; budget exhaustion returns the accepted active scan and stable scanId without an error.")
+  waitForCompletion: external_exports.boolean().optional().describe("Deprecated compatibility field; accepted but ignored. certscore_scan_site never waits for a new scan to finish, though MCP Light may briefly wait within a bounded preview window for preliminary pre-consent observations."),
+  maxWaitSeconds: external_exports.number().int().min(1).max(45).optional().describe("Deprecated compatibility field; accepted but ignored. The bounded preliminary-preview wait is controlled by CertScore and never waits for scan completion.")
 };
 var mcpGetScanStatusInputSchema = {
   scanId: external_exports.string().min(1).describe("Stable CertScore scan ID returned by certscore_scan_site.")
@@ -19627,7 +19819,11 @@ var mcpScanSiteOutputSchema = external_exports.object({
   scoreVersion: external_exports.string().nullable().optional(),
   scoreUpdatedAt: external_exports.string().nullable().optional(),
   riskLevel: external_exports.string().nullable().optional(),
+  gpcResponse: apiV2ScanResourceSchema.shape.gpcResponse.nullable(),
+  postAcceptObservation: apiV2ScanResourceSchema.shape.postAcceptObservation.nullable(),
+  postRefusalObservation: apiV2ScanResourceSchema.shape.postRefusalObservation.nullable(),
   coverage: apiV2ScanResourceSchema.shape.coverage.nullable().optional(),
+  preConsentPreview: apiV2PreConsentRuntimePreviewSchema.optional(),
   error: mcpActionableErrorSchema.nullable(),
   provenance: mcpScanProvenanceSchema,
   interpretationGuidance: mcpInterpretationGuidanceSchema,
@@ -19664,7 +19860,11 @@ var mcpScanStatusOutputSchema = external_exports.object({
   scoreVersion: external_exports.string().nullable().optional(),
   scoreUpdatedAt: external_exports.string().nullable().optional(),
   riskLevel: external_exports.string().nullable().optional(),
+  gpcResponse: apiV2ScanResourceSchema.shape.gpcResponse.nullable(),
+  postAcceptObservation: apiV2ScanResourceSchema.shape.postAcceptObservation.nullable(),
+  postRefusalObservation: apiV2ScanResourceSchema.shape.postRefusalObservation.nullable(),
   coverage: apiV2ScanResourceSchema.shape.coverage.nullable().optional(),
+  preConsentPreview: apiV2PreConsentRuntimePreviewSchema.optional(),
   phase: external_exports.string().optional(),
   phaseStartedAt: external_exports.string().nullable().optional(),
   lastUpdatedAt: external_exports.string().optional(),
@@ -19718,6 +19918,8 @@ var mcpScanBundleOutputSchema = external_exports.object({
   scoreVersion: external_exports.string().nullable(),
   scoreUpdatedAt: external_exports.string().nullable(),
   riskLevel: external_exports.string().nullable(),
+  gpcResponse: apiV2ScanResourceSchema.shape.gpcResponse.nullable().optional(),
+  postAcceptObservation: apiV2ScanResourceSchema.shape.postAcceptObservation.nullable(),
   postRefusalObservation: apiV2ScanResourceSchema.shape.postRefusalObservation.nullable(),
   provenance: mcpScanProvenanceSchema,
   interpretationGuidance: mcpInterpretationGuidanceSchema,
@@ -19830,10 +20032,10 @@ var certScoreMcpToolContracts = [
   {
     name: "certscore_scan_site",
     title: "Scan site",
-    description: "Use CertScore.ai to scan a public website for observable privacy and consent signals, including pre-consent cookies and browser storage, third-party trackers, consent-banner and CMP behavior, TLS/transport security, privacy-policy disclosures, GDPR/ePrivacy transparency findings, and applicable CCPA/CPRA review signals. Starts or reuses a public-web scan with a 25-second total tool-call budget by default; scan creation time is deducted from completion waiting. If status is queued, running, or finalizing, retain scanId and poll certscore_get_scan_status using only that scanId. Stop polling at completed, completed_limited, failed, expired, or rate_limited. For usable completion, call certscore_get_scan_bundle. No-go and limited coverage are observations, never proof of compliance.",
+    description: "Creates a public-website privacy scan or reuses an eligible recent completed scan. Coverage includes pre-consent storage, trackers, consent and CMP signals, privacy-policy disclosures, transport security, and GDPR/ePrivacy or CCPA/CPRA review signals. The response contains a stable scanId, lifecycle status, retry timing, and sometimes a bounded preliminary preConsentPreview; preliminary data contains no final findings or score. Results are automated public-web observations, not legal advice, certification, or a compliance determination. Tool and workflow documentation: https://certscore.ai/developers/mcp.",
     inputSchema: mcpScanSiteInputSchema,
     outputSchema: mcpScanSiteOutputSchema,
-    annotations: scanCreationAnnotations
+    annotations: { title: "Scan site", ...scanCreationAnnotations }
   },
   {
     name: "certscore_get_scan",
@@ -19841,15 +20043,15 @@ var certScoreMcpToolContracts = [
     description: "Retrieve the API v2 public-safe scan resource, including completed-limited no-go disposition, reason-specific guidance, and timing when available.",
     inputSchema: mcpGetScanInputSchema,
     outputSchema: apiV2ScanResourceSchema,
-    annotations: readOnlyOpenWorldAnnotations
+    annotations: { title: "Get CertScore scan", ...readOnlyOpenWorldAnnotations }
   },
   {
     name: "certscore_get_scan_status",
     title: "Get scan status",
-    description: "Poll with only the stable scanId returned by certscore_scan_site. Active responses include phase, heartbeat, estimated progress, stalled state, retry delay, and canonical scan provenance when available. Terminal responses include the CertScore score, risk, coverage, execution region (scanFrom), timestamps, report URL, and an explicit next action. For a reused or retrieved existing scan, use only persisted scanFrom and timestamps; never infer its original region from the current request, the user's location, or a default. Report unavailable provenance as unavailable. Stop polling at any terminal status.",
+    description: "Returns lifecycle status for a stable CertScore scanId. Active responses include phase, heartbeat, estimated progress, retryAfterSeconds, and sometimes a bounded preliminary preConsentPreview. Terminal responses include completion status, CertScore score and risk metadata when available, coverage, persisted execution region and timestamps, report URL, and a next-action field. Preliminary observations are distinct from completed findings.",
     inputSchema: mcpGetScanStatusInputSchema,
     outputSchema: mcpScanStatusOutputSchema,
-    annotations: readOnlyInternalAnnotations
+    annotations: { title: "Get scan status", ...readOnlyInternalAnnotations }
   },
   {
     name: "certscore_get_report",
@@ -19857,7 +20059,7 @@ var certScoreMcpToolContracts = [
     description: "Focused follow-up: retrieve a bounded Pulse report with high-signal TextContent and typed structuredContent, including customer-safe no-go messaging. For broad privacy questions, use certscore_get_scan_bundle first because it combines canonical findings, limitations, and pre-consent rows without redundant calls.",
     inputSchema: mcpGetReportInputSchema,
     outputSchema: mcpReportOutputSchema,
-    annotations: readOnlyOpenWorldAnnotations
+    annotations: { title: "Get CertScore Pulse report", ...readOnlyOpenWorldAnnotations }
   },
   {
     name: "certscore_get_evidence",
@@ -19865,15 +20067,15 @@ var certScoreMcpToolContracts = [
     description: "Focused follow-up: retrieve a bounded public-safe evidence packet with a concise TextContent digest and typed structuredContent. For broad privacy questions, use certscore_get_scan_bundle first. Excludes raw cookie values, raw bodies, sensitive payloads, full DOM, and unredacted query values.",
     inputSchema: mcpGetEvidenceInputSchema,
     outputSchema: mcpEvidenceOutputSchema,
-    annotations: readOnlyOpenWorldAnnotations
+    annotations: { title: "Get CertScore Pulse evidence", ...readOnlyOpenWorldAnnotations }
   },
   {
     name: "certscore_get_scan_bundle",
     title: "Get scan bundle",
-    description: "Call after completed or completed_limited status. Every usable completed bundle returns a self-contained concise TextContent digest plus matching structuredContent, including canonical execution region (scanFrom) and timestamps when available. For a reused or retrieved existing scan, use only persisted scanFrom and timestamps; never infer its original region from the current request, the user's location, or a default, and report unavailable provenance as unavailable. The default summary includes the canonical report overview, up to five compact public-safe projected findings across the scan's observed domains, and bounded row-level pre-consent cookie/tracker evidence; detail=findings increases the default finding allowance, evidence adds bounded evidence digests and references, and full adds all available bounded sections. MCP Light applies a 25000-byte response ceiling so full results remain transport-safe; use returned content URLs when the complete requested tier exceeds it. At the 5000-byte floor, core finding rows take priority over optional inventory and duplicate envelope fields; evidenceUrlTemplate may replace repeated per-finding URLs while preserving their canonical derivation from contentUrls.findings and findingId. Every response declares finding and evidence total/returned/truncated counts, canonicalFindingsComplete, requested and effective byte budgets, the response ceiling, omittedSections, retrieval URLs, and nextRecommendedMaxBytes when the complete tier fits the ceiling. When canonicalFindingsComplete is true, retry only if omitted envelope detail is needed. Enumerate only returned observations and projected findings. Post-refusal observation may intentionally stop as soon as qualifying non-essential activity or a retained consent-signal contradiction is observed. A confirmed observation with termination.kind=evidence_satisfied is positive evidence for the returned observation, not an inconclusive Reject Path result; keep any coverageLimitations scoped to additional behavior or persistence that was not measured. Treat criticality, priority, and confidence as CertScore metadata; regulatory review lenses are non-determinative CertScore review context, not legal severity, legal exposure, or a compliance determination. Missing consent-action evidence does not establish Accept, Reject, or Decline behavior. Do not extrapolate observed embeds, vendors, or requests into unobserved cookies, fingerprinting, tracking, or processing. The CertScore score covers observable scan signals only; do not infer unobserved technologies or legal compliance status, and never interpret no-go, not-observed, or limited coverage as proof of compliance.",
+    description: "Returns the completed or completed-limited CertScore evidence bundle for a stable scanId as concise TextContent and matching structuredContent. Available sections include the canonical report overview, bounded projected findings, pre-consent cookie and tracker evidence, coverage limitations, persisted execution provenance, and retrieval URLs. Detail tiers and byte budgets control the bounded response, with explicit returned, total, truncated, and omitted-section metadata. Accept and Reject Path content is present only for confirmed, evidence-qualified post-action observations; unsupported or inconclusive outcomes remain neutral coverage limitations. Results are automated public-web observations, not legal advice, certification, or a compliance determination.",
     inputSchema: mcpGetScanBundleInputSchema,
     outputSchema: mcpScanBundleOutputSchema,
-    annotations: accountedInternalReadAnnotations
+    annotations: { title: "Get scan bundle", ...accountedInternalReadAnnotations }
   },
   {
     name: "certscore_export_findings",
@@ -19881,7 +20083,7 @@ var certScoreMcpToolContracts = [
     description: "Return structured findings plus completed-limited no-go disposition and guidance for downstream review or ticketing workflows.",
     inputSchema: mcpExportFindingsInputSchema,
     outputSchema: mcpFindingsExportOutputSchema,
-    annotations: readOnlyOpenWorldAnnotations
+    annotations: { title: "Export CertScore findings", ...readOnlyOpenWorldAnnotations }
   },
   {
     name: "certscore_list_findings",
@@ -19889,7 +20091,7 @@ var certScoreMcpToolContracts = [
     description: "Focused follow-up: list bounded API v2 public-safe findings already projected by the canonical pipeline, with matching high-signal TextContent and typed structuredContent. For broad privacy questions, use certscore_get_scan_bundle first.",
     inputSchema: mcpListFindingsInputSchema,
     outputSchema: mcpFindingListOutputSchema,
-    annotations: readOnlyOpenWorldAnnotations
+    annotations: { title: "List CertScore findings", ...readOnlyOpenWorldAnnotations }
   },
   {
     name: "certscore_get_pre_consent_cookies_trackers",
@@ -19897,7 +20099,7 @@ var certScoreMcpToolContracts = [
     description: "Focused follow-up: retrieve bounded row-level public-safe pre-consent cookie/tracker evidence with matching TextContent and typed structuredContent. For a new broad request such as checking a site for pre-consent tracking, use certscore_scan_site then certscore_get_scan_bundle first.",
     inputSchema: mcpGetPreConsentCookiesTrackersInputSchema,
     outputSchema: mcpPreConsentCookiesTrackersOutputSchema,
-    annotations: readOnlyOpenWorldAnnotations
+    annotations: { title: "Get pre-consent cookies and trackers", ...readOnlyOpenWorldAnnotations }
   },
   {
     name: "certscore_explain_finding",
@@ -19905,7 +20107,7 @@ var certScoreMcpToolContracts = [
     description: "Explain one projected finding with public evidence, caveats, reviewer next steps, and reason-specific no-go context when applicable.",
     inputSchema: mcpExplainFindingInputSchema,
     outputSchema: apiV2FindingDetailSchema,
-    annotations: readOnlyOpenWorldAnnotations
+    annotations: { title: "Explain CertScore finding", ...readOnlyOpenWorldAnnotations }
   },
   {
     name: "certscore_get_latest_domain_scan",
@@ -19913,7 +20115,7 @@ var certScoreMcpToolContracts = [
     description: "Retrieve the latest eligible API v2 public-safe scan for a domain.",
     inputSchema: mcpGetLatestDomainScanInputSchema,
     outputSchema: apiV2DomainLatestScanSchema,
-    annotations: readOnlyOpenWorldAnnotations
+    annotations: { title: "Get latest domain scan", ...readOnlyOpenWorldAnnotations }
   },
   {
     name: "certscore_get_latest_domain_pre_consent_cookies_trackers",
@@ -19921,7 +20123,7 @@ var certScoreMcpToolContracts = [
     description: "Focused follow-up: retrieve bounded row-level public-safe pre-consent cookie/tracker evidence from the latest eligible scan for a domain, with matching TextContent and typed structuredContent. For a broad current-site review, use certscore_scan_site then certscore_get_scan_bundle first.",
     inputSchema: mcpGetLatestDomainPreConsentCookiesTrackersInputSchema,
     outputSchema: mcpPreConsentCookiesTrackersOutputSchema,
-    annotations: readOnlyOpenWorldAnnotations
+    annotations: { title: "Get latest domain pre-consent cookies and trackers", ...readOnlyOpenWorldAnnotations }
   }
 ];
 
@@ -19941,6 +20143,8 @@ var preConsentCookiesTrackersExample = {
   summary: {
     rowCount: 2,
     trackerCount: 1,
+    trackerCountScope: "canonical_inventory_rows_including_operational",
+    trackerCategoryCounts: { advertising: 0, analytics: 1, essential: 0, functional: 0, review: 0 },
     cookieCount: 1,
     requestCount: 3
   },
@@ -19995,7 +20199,14 @@ var preConsentCookiesTrackersExample = {
 };
 var emptyPreConsentCookiesTrackersExample = {
   ...preConsentCookiesTrackersExample,
-  summary: { rowCount: 0, trackerCount: 0, cookieCount: 0, requestCount: 0 },
+  summary: {
+    rowCount: 0,
+    trackerCount: 0,
+    trackerCountScope: "canonical_inventory_rows_including_operational",
+    trackerCategoryCounts: { advertising: 0, analytics: 0, essential: 0, functional: 0, review: 0 },
+    cookieCount: 0,
+    requestCount: 0
+  },
   rows: []
 };
 var errorContent = {
@@ -31875,11 +32086,14 @@ var MAX_TOOL_TEXT_CHARS = 8e3;
 var LEGAL_REVIEW_DISCLAIMER = "CertScore results are automated public-web observations for human and agentic review, not legal advice, certification, or a compliance determination.";
 var SCAN_PROVENANCE_GROUNDING = "retrievalMode describes how the current tool response obtained the scan; creationDecision describes whether the original scan request created or reused a scan only when that decision is retained. Never infer an unknown creationDecision from scan_id_lookup. For a reused or retrieved existing scan, use only persisted scanFrom and timestamps. Never infer its original scan region from the current request, the user's location, or a default execution region. If persisted region or timestamps are unavailable, report them as unavailable.";
 var INTERPRETATION_STATEMENT = "The CertScore score covers observable public-web scan signals only. Do not infer technologies that are not listed in the returned evidence or any legal compliance status.";
-var SCAN_BUNDLE_RESPONSE_CONTRACT = `Response contract: Report only observed CertScore evidence and CertScore classifications. criticality, priority, and confidence are CertScore metadata; regulatory review lenses are non-determinative CertScore review context\u2014not legal severity, legal exposure, or a compliance determination. Absence of captured consent-action evidence does not establish what happens after Accept, Reject, or Decline. A confirmed post-refusal observation with termination.kind=evidence_satisfied means the observer intentionally stopped after retaining qualifying evidence; do not treat that termination as uncertainty about the returned observation. Keep any separately returned coverage limitation scoped to what was not measured. Do not extrapolate an observed embed, vendor, or request into unobserved cookies, fingerprinting, tracking, or processing, and do not infer violations or compliance beyond what CertScore observed. ${SCAN_PROVENANCE_GROUNDING}`;
-var SCAN_BUNDLE_INTERPRETATION_STATEMENT = "Report only observed CertScore evidence and persisted CertScore classifications. Without corresponding captured post-action evidence, do not infer what Accept, Reject, Decline, or another consent action would do; say the scan does not establish what happens after that action. When postRefusalObservation is confirmed and termination.kind is evidence_satisfied, state the returned post-refusal observation directly and explain that observation stopped intentionally after qualifying evidence was retained. Do not characterize that termination as uncertainty about the observation; mention unmeasured longer-term persistence only when relevant. Do not speculate that an observed embed, vendor, or request may cause additional cookies, fingerprinting, tracking, or processing unless CertScore observed that behavior. Treat returned priority or severity as a CertScore classification, not regulatory criticality or legal exposure; prefer \u2018observed privacy risk signal\u2019 or \u2018CertScore finding\u2019. Do not infer unobserved technologies, legal compliance, or a legal violation from scores or findings.";
+var SCAN_BUNDLE_RESPONSE_CONTRACT = `Response contract: Report only observed CertScore evidence and CertScore classifications. criticality, priority, and confidence are CertScore metadata; regulatory review lenses are non-determinative CertScore review context\u2014not legal severity, legal exposure, or a compliance determination. Absence of captured consent-action evidence does not establish what happens after Accept, Reject, or Decline. A confirmed post-action observation with termination.kind=evidence_satisfied means the observer intentionally stopped after retaining qualifying evidence; do not treat that termination as uncertainty about the returned observation. Keep any separately returned coverage limitation scoped to what was not measured. Do not extrapolate an observed embed, vendor, or request into unobserved cookies, fingerprinting, tracking, or processing, and do not infer violations or compliance beyond what CertScore observed. ${SCAN_PROVENANCE_GROUNDING}`;
+var SCAN_BUNDLE_INTERPRETATION_STATEMENT = "Report only observed CertScore evidence and persisted CertScore classifications. For gpcResponse, use only GPC response, No observable GPC response, or indeterminate; do not call the result a GPC violation or say GPC was not honored. Keep its jurisdiction-neutral comparison separate from any explicitly returned California scoring policy. Without corresponding captured post-action evidence, do not infer what Accept, Reject, Decline, or another consent action would do; say the scan does not establish what happens after that action. When postAcceptObservation or postRefusalObservation is confirmed and termination.kind is evidence_satisfied, state the returned observation directly and explain that observation stopped intentionally after qualifying evidence was retained. Do not characterize that termination as uncertainty about the observation; mention unmeasured longer-term persistence only when relevant. Treat post-Accept activity as a score-neutral behavior baseline unless a separately projected finding says otherwise. Do not speculate that an observed embed, vendor, or request may cause additional cookies, fingerprinting, tracking, or processing unless CertScore observed that behavior. Treat returned priority or severity as a CertScore classification, not regulatory criticality or legal exposure; prefer \u2018observed privacy risk signal\u2019 or \u2018CertScore finding\u2019. Do not infer unobserved technologies, legal compliance, or a legal violation from scores or findings.";
 var COMPACT_SCAN_BUNDLE_INTERPRETATION_STATEMENT = "Use only returned CertScore observations and classifications. Do not infer unobserved technologies, post-consent behavior, legal compliance, or violations. Treat priority and severity as CertScore metadata.";
 var OBSERVATION_ONLY_DISCLAIMER = `${LEGAL_REVIEW_DISCLAIMER} No-go, not-observed, and limited-coverage results are not proof of compliance.`;
 var COMPACT_OBSERVATION_ONLY_DISCLAIMER = "Automated public-web observation, not legal advice or a compliance determination; missing or limited evidence is not proof of compliance.";
+var MCP_SCAN_CREATION_POLL_DELAY_SECONDS = 15;
+var MCP_QUEUED_POLL_DELAY_SECONDS = 10;
+var MCP_RUNNING_POLL_DELAY_SECONDS = 5;
 function interpretationGuidance(statement = INTERPRETATION_STATEMENT) {
   return {
     scoreLabel: "CertScore score",
@@ -31898,6 +32112,9 @@ function toolResultSummary(payload) {
   const status = typeof record2.status === "string" ? `; status=${record2.status}` : "";
   const scanId = typeof record2.scanId === "string" ? `; scanId=${record2.scanId}` : "";
   const score = typeof record2.score === "number" ? `; CertScore score=${record2.score}` : "";
+  const preview = record2.preConsentPreview && typeof record2.preConsentPreview === "object" && !Array.isArray(record2.preConsentPreview) ? record2.preConsentPreview : null;
+  const previewSummary = preview?.summary && typeof preview.summary === "object" && !Array.isArray(preview.summary) ? preview.summary : null;
+  const preliminary = preview ? `; preliminary pre-consent preview=cookies ${previewSummary?.cookieCount ?? "unknown"}, trackers ${previewSummary?.trackerCount ?? "unknown"}, third-party requests ${previewSummary?.thirdPartyRequestCount ?? "unknown"}; preview is not final\u2014continue status polling` : "";
   const recordLinks = record2.links && typeof record2.links === "object" && !Array.isArray(record2.links) ? record2.links : null;
   const reportUrl = typeof record2.reportUrl === "string" && record2.reportUrl.trim() ? record2.reportUrl.trim() : typeof recordLinks?.report === "string" && recordLinks.report.trim() ? recordLinks.report.trim() : null;
   const report = reportUrl ? `; full report=${reportUrl}` : "";
@@ -31905,7 +32122,7 @@ function toolResultSummary(payload) {
   const retrieval = typeof provenanceRecord?.retrievalMode === "string" ? `; retrieval=${provenanceRecord.retrievalMode}` : "";
   const creation = typeof provenanceRecord?.creationDecision === "string" ? `; creation=${provenanceRecord.creationDecision}` : "";
   const provenance = retrieval || creation ? `${retrieval}${creation}` : typeof provenanceRecord?.mode === "string" ? `; provenance=${provenanceRecord.mode}` : "";
-  return `CertScore ${type}${status}${scanId}${score}${provenance}${report}. Full result is in structuredContent.`;
+  return `CertScore ${type}${status}${scanId}${score}${preliminary}${provenance}${report}. Full result is in structuredContent.`;
 }
 function toToolResult(payload, text) {
   const structuredContent = payload !== null && typeof payload === "object" && !Array.isArray(payload) ? payload : { value: payload };
@@ -31926,12 +32143,14 @@ function toToolError(error2) {
   const retryable = typeof terminalError?.retryable === "boolean" ? terminalError.retryable : status === 429 || typeof status === "number" && status >= 500;
   const retryAfterSeconds = typeof terminalError?.retryAfterSeconds === "number" ? terminalError.retryAfterSeconds : error2 instanceof CertScoreError && "retryAfterSeconds" in error2 && typeof error2.retryAfterSeconds === "number" ? error2.retryAfterSeconds : retryable ? 30 : null;
   const code = error2 instanceof CertScoreError ? error2.code : "internal_error";
+  const reasonCode = terminalError?.reasonCode === "non_public_target" ? "non_public_target" : null;
   const message = error2 instanceof Error ? error2.message : "Unknown CertScore MCP error.";
   const creationRateLimit = terminalError?.creationRateLimit && typeof terminalError.creationRateLimit === "object" && !Array.isArray(terminalError.creationRateLimit) ? terminalError.creationRateLimit : null;
   const recommendedNextAction = typeof terminalError?.recommendedNextAction === "string" ? terminalError.recommendedNextAction : creationRateLimit ? `No scan was created. Wait ${retryAfterSeconds ?? 30} seconds, then retry the same request. If the limit continues after that delay, contact support@certscore.ai.` : retryable ? `Wait ${retryAfterSeconds ?? 30} seconds, then retry the same request. Stop and contact support@certscore.ai if the error repeats.` : "Correct the request using the error details, then retry only if the requested operation is still appropriate.";
   const payload = {
     error: {
       code,
+      reasonCode,
       message,
       retryable,
       retryAfterSeconds,
@@ -32063,27 +32282,36 @@ function scanProvenance(value, fallbackMode) {
     freshnessDecision: typeof value.freshnessDecision === "string" ? value.freshnessDecision : null
   };
 }
-function withMcpAgentGuidance(value, fallbackProvenanceMode = "unknown") {
+function withMcpAgentGuidance(value, fallbackProvenanceMode = "unknown", pollGuidanceContext = "upstream") {
   const status = String(value.status ?? "");
   const active = status === "queued" || status === "running" || status === "finalizing";
   const usable = status === "completed" || status === "completed_limited";
+  const upstreamRetryAfterSeconds = typeof value.retryAfterSeconds === "number" && Number.isFinite(value.retryAfterSeconds) ? Math.max(1, Math.ceil(value.retryAfterSeconds)) : null;
+  const retryAfterSeconds = active && pollGuidanceContext === "scan_creation" ? MCP_SCAN_CREATION_POLL_DELAY_SECONDS : active && pollGuidanceContext === "scan_status" ? status === "queued" ? MCP_QUEUED_POLL_DELAY_SECONDS : MCP_RUNNING_POLL_DELAY_SECONDS : upstreamRetryAfterSeconds;
   const error2 = terminalErrorForResult(value);
   const stableScanId = typeof value.scanId === "string" && value.scanId.trim() ? value.scanId.trim() : typeof value.scan_id === "string" && value.scan_id.trim() ? value.scan_id.trim() : null;
+  const hasPreConsentPreview2 = Boolean(
+    value.preConsentPreview && typeof value.preConsentPreview === "object" && !Array.isArray(value.preConsentPreview)
+  );
   const reportUrl = usable ? typeof value.reportUrl === "string" && value.reportUrl.trim() ? value.reportUrl.trim() : typeof value.links?.report === "string" && value.links.report.trim() ? value.links.report.trim() : stableScanId ? `https://certscore.ai/scan/${encodeURIComponent(stableScanId)}` : null : null;
+  const returnedNextAction = typeof value.recommendedNextAction === "string" && value.recommendedNextAction.trim() ? value.recommendedNextAction.trim() : null;
+  const activePollAction = `${retryAfterSeconds === null ? "Wait for the recommended delay" : `Wait at least ${retryAfterSeconds} seconds`}, then call certscore_get_scan_status once with scanId ${stableScanId ?? value.jobId}.`;
+  const activeNextAction = `${hasPreConsentPreview2 ? "The returned preConsentPreview is a partial preview of passive evidence. Its counts are checkpoint-only partial counts, not the full scan tally; do not present them as final totals or stop the workflow. " : ""}${activePollAction} Continue with certscore_get_scan_status using the unchanged scanId ${stableScanId ?? value.jobId}. Do not poll in parallel or resubmit certscore_scan_site while this scan is active. After completed or completed_limited, call certscore_get_scan_bundle for the completed scan's final returned tally, canonical findings, and limitations.`;
   return {
     ...value,
+    retryAfterSeconds,
     error: error2,
     reportUrl,
     scoreLabel: "CertScore score",
     provenance: scanProvenance(value, fallbackProvenanceMode),
     interpretationGuidance: interpretationGuidance(),
     recommendedNextTool: active ? "certscore_get_scan_status" : usable ? "certscore_get_scan_bundle" : null,
-    recommendedNextAction: error2?.recommendedNextAction ?? value.recommendedNextAction ?? (active ? `Poll certscore_get_scan_status with scanId ${value.scanId ?? value.jobId} after the recommended delay.` : usable ? `Call certscore_get_scan_bundle with scanId ${value.scanId ?? value.jobId} for the canonical findings and limitations.` : "Review the result and retained limitations."),
+    recommendedNextAction: error2?.recommendedNextAction ?? (active ? activeNextAction : returnedNextAction ?? (usable ? `Call certscore_get_scan_bundle with scanId ${stableScanId ?? value.jobId} for the completed scan's final returned tally, canonical findings, and limitations.` : "Review the result and retained limitations.")),
     observationOnlyDisclaimer: OBSERVATION_ONLY_DISCLAIMER
   };
 }
 function withMcpScanProvenanceGuidance(value, fallbackProvenanceMode) {
-  const guided = withMcpAgentGuidance(value, fallbackProvenanceMode);
+  const guided = withMcpAgentGuidance(value, fallbackProvenanceMode, "scan_status");
   return {
     ...guided,
     interpretationGuidance: interpretationGuidance(`${INTERPRETATION_STATEMENT} ${SCAN_PROVENANCE_GROUNDING}`)
@@ -32657,14 +32885,124 @@ function canonicalScanProvenanceText(value) {
 }
 function scanStatusText(value) {
   const reportUrl = reportUrlFor(value);
-  return [
-    `CertScore scan status: status=${value.status ?? "unknown"}.`,
+  const nextAction = typeof value.recommendedNextAction === "string" && value.recommendedNextAction.trim() ? value.recommendedNextAction.trim() : "Review the returned status and retained limitations.";
+  return boundedPreviewResultText([
+    `CertScore scan status: status=${value.status ?? "unknown"}.`
+  ], [...preConsentPreviewTextLines(value), ...terminalLaneResultTextLines(value)], [
+    `Next: ${nextAction}`,
     canonicalScanProvenanceText(value),
     `Full report: ${reportUrl ?? "not available"}.`,
     OBSERVATION_ONLY_DISCLAIMER,
     INTERPRETATION_STATEMENT,
     SCAN_PROVENANCE_GROUNDING
-  ].join("\n");
+  ]);
+}
+function scanSiteText(value, leadingLines = []) {
+  const scanId = extractScanId(value) ?? "unknown";
+  const active = value.status === "queued" || value.status === "running" || value.status === "finalizing";
+  const nextAction = typeof value.recommendedNextAction === "string" && value.recommendedNextAction.trim() ? value.recommendedNextAction.trim() : active ? `Call certscore_get_scan_status sequentially with scanId ${scanId}; do not resubmit certscore_scan_site.` : "Review the returned result and retained limitations.";
+  return boundedPreviewResultText([
+    ...leadingLines,
+    `CertScore scan accepted: scanId=${scanId}; status=${value.status ?? "unknown"}.`
+  ], [...preConsentPreviewTextLines(value), ...terminalLaneResultTextLines(value)], [
+    `Next: ${nextAction}`,
+    `Provenance: retrieval=${value.provenance?.retrievalMode ?? "unknown"}; creation=${value.provenance?.creationDecision ?? "unknown"}.`,
+    canonicalScanProvenanceText(value),
+    OBSERVATION_ONLY_DISCLAIMER,
+    INTERPRETATION_STATEMENT
+  ]);
+}
+function terminalLaneResultTextLines(value) {
+  const lines = [];
+  const gpcResponse = value.gpcResponse && typeof value.gpcResponse === "object" && !Array.isArray(value.gpcResponse) ? value.gpcResponse : null;
+  if (gpcResponse) {
+    lines.push(`GPC response: ${gpcResponse.findingTitle ?? "GPC response"}; status=${gpcResponse.status ?? "indeterminate"}; Sec-GPC: 1 proof retained on ${gpcResponse.comparison?.enabledProof?.requestsWithSecGpc ?? 0} request(s).`);
+  }
+  for (const [field, label] of [["postAcceptObservation", "Accept Path"], ["postRefusalObservation", "Reject Path"]]) {
+    const observation = value[field] && typeof value[field] === "object" && !Array.isArray(value[field]) ? value[field] : null;
+    if (observation && typeof observation.interpretation === "string") {
+      lines.push(`${label}: ${observation.interpretation}`);
+    }
+  }
+  return lines;
+}
+function compactPreviewValue(value, fallback = "unknown", maxChars = 280) {
+  if (value === null || value === void 0) return fallback;
+  const normalized = String(value).replace(/\s+/g, " ").trim();
+  if (!normalized) return fallback;
+  return normalized.length > maxChars ? `${normalized.slice(0, Math.max(1, maxChars - 1))}\u2026` : normalized;
+}
+function previewObservedTiming(value) {
+  return typeof value === "number" && Number.isFinite(value) && value >= 0 ? `${Math.round(value)}ms (t+${(value / 1e3).toFixed(3)}s)` : "unavailable";
+}
+function preConsentPreviewTextLines(value) {
+  const preview = value.preConsentPreview && typeof value.preConsentPreview === "object" && !Array.isArray(value.preConsentPreview) ? value.preConsentPreview : null;
+  if (!preview) return [];
+  const cookies = Array.isArray(preview.cookies) ? preview.cookies : [];
+  const trackers = Array.isArray(preview.trackers) ? preview.trackers : [];
+  const operationalVendors = Array.isArray(preview.operationalVendors) ? preview.operationalVendors : [];
+  const summary = preview.summary && typeof preview.summary === "object" && !Array.isArray(preview.summary) ? preview.summary : {};
+  const coverage = preview.runtimeCoverage && typeof preview.runtimeCoverage === "object" && !Array.isArray(preview.runtimeCoverage) ? preview.runtimeCoverage : {};
+  const capturedCookieCount = summary.cookieCount ?? cookies.length;
+  const returnedCookieCount = summary.returnedCookieCount ?? cookies.length;
+  const capturedTrackingVendorCount = summary.trackingVendorCount ?? summary.trackerCount ?? trackers.length;
+  const returnedTrackingVendorCount = summary.returnedTrackingVendorCount ?? trackers.length;
+  const capturedOperationalVendorCount = summary.operationalVendorCount ?? operationalVendors.length;
+  const returnedOperationalVendorCount = summary.returnedOperationalVendorCount ?? operationalVendors.length;
+  const lines = [
+    `Partial pre-consent runtime preview: generated=${compactPreviewValue(preview.generatedAt, "unavailable", 80)}; lane=${compactPreviewValue(preview.sourceLane, "runtime_evidence", 80)}; coverage=${compactPreviewValue(coverage.status, "unknown", 80)}; cookies captured=${capturedCookieCount}; cookie identities returned=${returnedCookieCount}; tracking vendors captured=${capturedTrackingVendorCount}; tracking vendor identities returned=${returnedTrackingVendorCount}; operational/security/consent vendors captured=${capturedOperationalVendorCount}; operational identities returned=${returnedOperationalVendorCount}; all classified vendor observations=${summary.vendorCount ?? "unknown"}; third-party requests=${summary.thirdPartyRequestCount ?? "unknown"}.`,
+    "PARTIAL PREVIEW: These are checkpoint-only partial counts, not the full scan tally. Do not present them as final totals or stop the workflow. Wait for terminal scan status, then call certscore_get_scan_bundle for the completed scan's final returned tally, canonical findings, and coverage limitations.",
+    "Metric scope: tracking vendors exclude operational, security, and consent-management vendors. The completed inventory's broader trackerCount may include those categories, so do not compare that field directly with trackingVendorCount."
+  ];
+  if (cookies.length > 0) {
+    lines.push("Cookies observed before a consent choice (metadata only; no cookie values):");
+    for (const candidate of cookies) {
+      const cookie = candidate && typeof candidate === "object" && !Array.isArray(candidate) ? candidate : {};
+      lines.push(`- Cookie ${compactPreviewValue(cookie.name, "unnamed", 256)}; domain=${compactPreviewValue(cookie.domain, "unavailable", 253)}; party=${compactPreviewValue(cookie.party, "unknown", 40)}; category/purpose=${compactPreviewValue(cookie.purpose, "unknown", 80)}; essentiality=${compactPreviewValue(cookie.essentiality, "unknown", 40)}; observedAtMs=${previewObservedTiming(cookie.observedAtMs)}.`);
+    }
+  } else {
+    lines.push("Cookies observed before a consent choice: none returned in this preliminary preview.");
+  }
+  if (trackers.length > 0) {
+    lines.push("Tracking vendors/products observed before a consent choice:");
+    for (const candidate of trackers) {
+      const tracker = candidate && typeof candidate === "object" && !Array.isArray(candidate) ? candidate : {};
+      const domains = Array.isArray(tracker.domains) ? tracker.domains.map((domain) => compactPreviewValue(domain, "unknown", 253)).join(", ") : "none returned";
+      lines.push(`- Tracking vendor ${compactPreviewValue(tracker.vendor, "unknown", 160)}; product=${compactPreviewValue(tracker.product, "unavailable", 160)}; category/purpose=${compactPreviewValue(tracker.purpose, "unknown", 80)}; confidence=${compactPreviewValue(tracker.confidence, "unknown", 20)}; domains=${compactPreviewValue(domains, "none returned", 800)}.`);
+    }
+    lines.push("Tracker timing: per-tracker first-seen milliseconds are not part of the preliminary preview contract; do not infer them from cookie timing.");
+  } else {
+    lines.push("Tracking vendors/products observed before a consent choice: none returned in this partial preview.");
+  }
+  if (operationalVendors.length > 0) {
+    lines.push("Operational, security, or consent-management vendors observed (separate from trackingVendorCount):");
+    for (const candidate of operationalVendors) {
+      const vendor = candidate && typeof candidate === "object" && !Array.isArray(candidate) ? candidate : {};
+      const domains = Array.isArray(vendor.domains) ? vendor.domains.map((domain) => compactPreviewValue(domain, "unknown", 253)).join(", ") : "none returned";
+      lines.push(`- Operational vendor ${compactPreviewValue(vendor.vendor, "unknown", 160)}; product=${compactPreviewValue(vendor.product, "unavailable", 160)}; category/purpose=${compactPreviewValue(vendor.purpose, "unknown", 80)}; confidence=${compactPreviewValue(vendor.confidence, "unknown", 20)}; domains=${compactPreviewValue(domains, "none returned", 800)}.`);
+    }
+  }
+  if (String(capturedCookieCount) !== String(returnedCookieCount) || String(capturedTrackingVendorCount) !== String(returnedTrackingVendorCount) || String(capturedOperationalVendorCount) !== String(returnedOperationalVendorCount)) {
+    lines.push(`Preview identity lists are bounded: ${capturedCookieCount} cookies captured/${returnedCookieCount} identities returned; ${capturedTrackingVendorCount} tracking vendors captured/${returnedTrackingVendorCount} identities returned; ${capturedOperationalVendorCount} operational vendors captured/${returnedOperationalVendorCount} identities returned. Use captured counts for checkpoint coverage and returned arrays for names.`);
+  }
+  const disclaimer = typeof preview.observationOnlyDisclaimer === "string" && preview.observationOnlyDisclaimer.trim() ? preview.observationOnlyDisclaimer.trim() : "Preliminary passive observations only; not findings, a score, or a final result.";
+  lines.push(`${compactPreviewValue(disclaimer, "Preliminary passive observations only.", 500)} Continue sequential status polling until terminal status; at completed or completed_limited, retrieve certscore_get_scan_bundle before reporting the full scan results or final returned tally.`);
+  return lines;
+}
+function boundedPreviewResultText(prefix, bodyLines, suffix) {
+  const lines = [...prefix];
+  let rendered = 0;
+  for (const line of bodyLines) {
+    if ([...lines, line, ...suffix].join("\n").length > MAX_TOOL_TEXT_CHARS) break;
+    lines.push(line);
+    rendered += 1;
+  }
+  if (rendered < bodyLines.length) {
+    const omitted = `${bodyLines.length - rendered} additional preliminary preview line${bodyLines.length - rendered === 1 ? " was" : "s were"} omitted from TextContent to preserve the size limit; all bounded rows remain in structuredContent.`;
+    if ([...lines, omitted, ...suffix].join("\n").length <= MAX_TOOL_TEXT_CHARS) lines.push(omitted);
+  }
+  lines.push(...suffix);
+  return lines.join("\n");
 }
 function boundedResultText(header, bodyLines, value) {
   const footer = [OBSERVATION_ONLY_DISCLAIMER, INTERPRETATION_STATEMENT];
@@ -32761,6 +33099,24 @@ function scanBundleText(bundle) {
   if (coverage) {
     append(`Coverage: status=${coverage.status ?? "unknown"}; ${coverage.summary ?? "Review limitations before interpreting absence."}`);
   }
+  const gpcResponse = bundle.gpcResponse && typeof bundle.gpcResponse === "object" && !Array.isArray(bundle.gpcResponse) ? bundle.gpcResponse : null;
+  if (gpcResponse) {
+    const proof = gpcResponse.comparison?.enabledProof;
+    const californiaPolicy = gpcResponse.californiaPolicy;
+    append(`GPC response: ${gpcResponse.findingTitle ?? "GPC response"}; status=${gpcResponse.status ?? "indeterminate"}; Sec-GPC: 1 proof retained on ${proof?.requestsWithSecGpc ?? 0} request(s).`);
+    if (californiaPolicy?.applied === true && californiaPolicy.deductionPoints === 15) {
+      append("California scoring policy: \u221215 points. This score effect is separate from the jurisdiction-neutral GPC comparison.");
+    }
+  }
+  const postAccept = bundle.postAcceptObservation && typeof bundle.postAcceptObservation === "object" && !Array.isArray(bundle.postAcceptObservation) ? bundle.postAcceptObservation : null;
+  if (postAccept && typeof postAccept.interpretation === "string") {
+    const termination = postAccept.termination && typeof postAccept.termination === "object" && !Array.isArray(postAccept.termination) ? postAccept.termination : null;
+    const intentionalEvidenceStop = termination?.kind === "evidence_satisfied" && termination.intentional === true ? " The observation then stopped intentionally because qualifying evidence had been captured." : "";
+    append(`Accept Path: ${postAccept.interpretation}${intentionalEvidenceStop}`);
+    for (const limitation of Array.isArray(postAccept.coverageLimitations) ? postAccept.coverageLimitations.slice(0, 3) : []) {
+      append(`Accept Path coverage limitation: ${limitation}`);
+    }
+  }
   const postRefusal = bundle.postRefusalObservation && typeof bundle.postRefusalObservation === "object" && !Array.isArray(bundle.postRefusalObservation) ? bundle.postRefusalObservation : null;
   if (postRefusal && typeof postRefusal.interpretation === "string") {
     const termination = postRefusal.termination && typeof postRefusal.termination === "object" && !Array.isArray(postRefusal.termination) ? postRefusal.termination : null;
@@ -32928,6 +33284,8 @@ function buildScanBundle(input) {
     scoreVersion: input.scan.scoreVersion ?? null,
     scoreUpdatedAt: input.scan.scoreUpdatedAt ?? null,
     riskLevel: input.scan.riskLevel ?? null,
+    ...input.scan.gpcResponse ? { gpcResponse: input.scan.gpcResponse } : {},
+    postAcceptObservation: input.scan.postAcceptObservation ?? null,
     postRefusalObservation: input.scan.postRefusalObservation ?? null,
     provenance: scanProvenance(input.scan, "existing_scan_retrieved"),
     interpretationGuidance: interpretationGuidance(SCAN_BUNDLE_INTERPRETATION_STATEMENT),
@@ -33161,6 +33519,8 @@ function buildScanBundle(input) {
       scoreVersion: bundle.scoreVersion,
       scoreUpdatedAt: bundle.scoreUpdatedAt,
       riskLevel: bundle.riskLevel,
+      ...bundle.gpcResponse ? { gpcResponse: bundle.gpcResponse } : {},
+      postAcceptObservation: bundle.postAcceptObservation,
       postRefusalObservation: bundle.postRefusalObservation,
       provenance: bundle.provenance,
       interpretationGuidance: bundle.interpretationGuidance,
@@ -33275,23 +33635,11 @@ function explainFinding(report, findingId) {
 }
 
 // src/server.ts
-var DEFAULT_MCP_SCAN_TOOL_BUDGET_MS = 25e3;
-var MAX_MCP_SCAN_TOOL_BUDGET_MS = 45e3;
-var MCP_SCAN_TOOL_RESPONSE_RESERVE_MS = 1e3;
 var LIGHT_MCP_BUNDLE_RESPONSE_CEILING_BYTES = 25e3;
-function resolveMcpScanSiteWaitBudget(input) {
-  const totalBudgetMs = Math.min(
-    input.maxWaitSeconds ? input.maxWaitSeconds * 1e3 : DEFAULT_MCP_SCAN_TOOL_BUDGET_MS,
-    MAX_MCP_SCAN_TOOL_BUDGET_MS
-  );
-  const elapsedMs = Math.max(0, input.nowMs - input.startedAtMs);
-  return {
-    elapsedMs,
-    remainingWaitMs: Math.max(0, totalBudgetMs - elapsedMs - MCP_SCAN_TOOL_RESPONSE_RESERVE_MS),
-    responseReserveMs: MCP_SCAN_TOOL_RESPONSE_RESERVE_MS,
-    totalBudgetMs
-  };
-}
+var MCP_SCAN_SITE_TARGET_RESPONSE_MS = 11e3;
+var MCP_SCAN_SITE_TARGET_RESPONSE_RESERVE_MS = 250;
+var MCP_SCAN_SITE_PREVIEW_POLL_INTERVAL_MS = 750;
+var MCP_SCAN_SITE_MAX_PREVIEW_WAIT_MS = 1e4;
 function exampleDomainDemoSubstitution(requestedUrl, demoUrl) {
   if (!demoUrl) return null;
   try {
@@ -33315,10 +33663,7 @@ function withExampleDomainDemo(value, substitution) {
   return substitution ? { ...value, demoSubstitution: substitution } : value;
 }
 function exampleDomainDemoText(value, substitution) {
-  if (!substitution) return void 0;
-  const status = typeof value.status === "string" ? ` Status=${value.status}.` : "";
-  const scanId = typeof value.scanId === "string" ? ` ScanId=${value.scanId}.` : "";
-  return `${substitution.message}${status}${scanId} Full result and substitution provenance are in structuredContent.`;
+  return scanSiteText(value, substitution ? [`${substitution.message} Substitution provenance is in structuredContent.`] : []);
 }
 async function retryTransientOriginFailure(operation) {
   try {
@@ -33345,6 +33690,15 @@ function scanCreationMetadata(value) {
     upgradeMessage: value.upgradeMessage
   };
 }
+function activeScan(value) {
+  return value.status === "queued" || value.status === "running" || value.status === "finalizing";
+}
+function hasPreConsentPreview(value) {
+  return Boolean(value.preConsentPreview && typeof value.preConsentPreview === "object" && !Array.isArray(value.preConsentPreview));
+}
+function delay(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
 function toolContract(name) {
   const contract = certScoreMcpToolContracts.find((candidate) => candidate.name === name);
   if (!contract) {
@@ -33531,6 +33885,7 @@ function createCertScoreMcpServer(options = {}) {
     toolContract("certscore_scan_site"),
     async (input, extra) => {
       const toolStartedAtMs = Date.now();
+      const creationStartedAtMs = toolStartedAtMs;
       const client2 = clientForRequest(extra);
       const demoSubstitution = exampleDomainDemoSubstitution(input.url, options.exampleDomainDemoUrl);
       const effectiveUrl = demoSubstitution?.effectiveUrl ?? input.url;
@@ -33539,56 +33894,78 @@ function createCertScoreMcpServer(options = {}) {
           freshness: input.freshness ?? "latest",
           scanFrom: input.scanFrom
         });
-        if (input.waitForCompletion === false || created.type === "certscore_scan") {
-          const guided = withExampleDomainDemo(withMcpAgentGuidance(created), demoSubstitution);
-          return toToolResult(guided, exampleDomainDemoText(guided, demoSubstitution));
-        }
-        const waitBudget = resolveMcpScanSiteWaitBudget({
-          maxWaitSeconds: input.maxWaitSeconds,
-          nowMs: Date.now(),
-          startedAtMs: toolStartedAtMs
-        });
-        if (waitBudget.remainingWaitMs === 0) {
-          console.warn(JSON.stringify({
-            event: "mcp.certscore_scan_site.wait_budget_consumed",
-            jobId: created.jobId ?? null,
-            scanId: created.scanId ?? created.scan_id ?? null,
-            status: created.status ?? null,
-            ...waitBudget
-          }));
-          const guided = withExampleDomainDemo(withMcpAgentGuidance(created), demoSubstitution);
-          return toToolResult(guided, exampleDomainDemoText(guided, demoSubstitution));
-        }
-        const waitAbortController = new AbortController();
-        const waitAbortTimer = setTimeout(() => waitAbortController.abort(), waitBudget.remainingWaitMs);
-        try {
-          const internalMcpOperation = { operation: "scan_site_wait", scanId: created.scanId ?? created.scan_id ?? created.jobId };
-          const completed = await client2.scans.wait(created, {
-            maxWaitMs: waitBudget.remainingWaitMs,
-            internalMcpOperation,
-            signal: waitAbortController.signal
-          });
-          const guided = withExampleDomainDemo(withMcpAgentGuidance({
-            ...completed,
-            ...scanCreationMetadata(created)
-          }), demoSubstitution);
-          return toToolResult(guided, exampleDomainDemoText(guided, demoSubstitution));
-        } catch (error2) {
-          const scanId = created.scanId ?? created.scan_id;
-          console.warn(JSON.stringify({
-            event: "mcp.certscore_scan_site.wait_deferred",
-            errorName: error2 instanceof Error ? error2.name : "UnknownError",
-            jobId: created.jobId ?? null,
-            scanId: scanId ?? null,
-            status: created.status ?? null,
-            ...waitBudget
+        console.log(JSON.stringify({
+          event: "mcp.certscore_scan_site.creation_completed",
+          durationMs: Date.now() - creationStartedAtMs,
+          executionMode: created.executionMode ?? null,
+          hasScanId: Boolean(created.scanId ?? created.scan_id),
+          reused: created.reused === true,
+          status: created.status ?? null
+        }));
+        let initialResult = created;
+        const stableScanId = typeof created.scanId === "string" && created.scanId ? created.scanId : typeof created.scan_id === "string" && created.scan_id ? created.scan_id : typeof created.jobId === "string" && created.jobId ? created.jobId : null;
+        const configuredPreviewWaitMs = options.toolProfile === "light" ? Math.min(
+          Math.max(0, options.initialPreConsentPreviewWaitMs ?? 1e4),
+          MCP_SCAN_SITE_MAX_PREVIEW_WAIT_MS
+        ) : 0;
+        const totalRemainingMs = Math.max(
+          0,
+          toolStartedAtMs + MCP_SCAN_SITE_TARGET_RESPONSE_MS - MCP_SCAN_SITE_TARGET_RESPONSE_RESERVE_MS - Date.now()
+        );
+        const previewWaitMs = Math.min(configuredPreviewWaitMs, totalRemainingMs);
+        if (stableScanId && previewWaitMs > 0 && activeScan(initialResult)) {
+          const previewWaitStartedAtMs = Date.now();
+          const previewDeadlineMs = previewWaitStartedAtMs + previewWaitMs;
+          let internalReadCount = 0;
+          try {
+            while (Date.now() < previewDeadlineMs && activeScan(initialResult) && !hasPreConsentPreview(initialResult)) {
+              await delay(Math.min(MCP_SCAN_SITE_PREVIEW_POLL_INTERVAL_MS, previewDeadlineMs - Date.now()));
+              const requestRemainingMs = previewDeadlineMs - Date.now();
+              if (requestRemainingMs <= 0) break;
+              const waitAbortController = new AbortController();
+              const waitAbortTimer = setTimeout(() => waitAbortController.abort(), requestRemainingMs);
+              try {
+                internalReadCount += 1;
+                const status = await client2.scans.status(stableScanId, {
+                  internalMcpOperation: { operation: "scan_site_wait", scanId: stableScanId },
+                  signal: waitAbortController.signal
+                });
+                initialResult = {
+                  ...status,
+                  ...scanCreationMetadata(created)
+                };
+              } finally {
+                clearTimeout(waitAbortTimer);
+              }
+            }
+          } catch (error2) {
+            console.warn(JSON.stringify({
+              event: "mcp.certscore_scan_site.preview_wait_deferred",
+              durationMs: Date.now() - previewWaitStartedAtMs,
+              errorName: error2 instanceof Error ? error2.name : "UnknownError",
+              hasPreview: hasPreConsentPreview(initialResult),
+              internalReadCount,
+              scanId: stableScanId
+            }));
+          }
+          console.log(JSON.stringify({
+            event: "mcp.certscore_scan_site.preview_wait_completed",
+            durationMs: Date.now() - previewWaitStartedAtMs,
+            hasPreview: hasPreConsentPreview(initialResult),
+            internalReadCount,
+            scanId: stableScanId,
+            status: initialResult.status ?? null,
+            totalDurationMs: Date.now() - toolStartedAtMs
           }));
-          const guided = withExampleDomainDemo(withMcpAgentGuidance(created), demoSubstitution);
-          return toToolResult(guided, exampleDomainDemoText(guided, demoSubstitution));
-        } finally {
-          clearTimeout(waitAbortTimer);
         }
+        const guided = withExampleDomainDemo(withMcpAgentGuidance(initialResult, "unknown", "scan_creation"), demoSubstitution);
+        return toToolResult(guided, exampleDomainDemoText(guided, demoSubstitution));
       } catch (error2) {
+        console.warn(JSON.stringify({
+          event: "mcp.certscore_scan_site.creation_failed",
+          durationMs: Date.now() - creationStartedAtMs,
+          errorName: error2 instanceof Error ? error2.name : "UnknownError"
+        }));
         return toToolError(error2);
       }
     }