ax-audit 3.6.0 → 4.1.0

package/dist/checks/utils.js

@@ -1,8 +1,9 @@
+import { CHECK_CATEGORIES } from '../constants.js';
 import { guideUrl } from '../guide-urls.js';
 export function clampScore(score) {
     return Math.max(0, Math.min(100, score));
 }
-export function buildResult(meta, score, findings, start) {
+export function buildResult(meta, score, findings, start, options = {}) {
     return {
         id: meta.id,
         name: meta.name,
@@ -10,8 +11,39 @@ export function buildResult(meta, score, findings, start) {
         score: clampScore(score),
         findings,
         duration: Math.round(performance.now() - start),
+        // Falls back to the central map so every result carries its category,
+        // including in JSON output where no reporter is there to resolve it.
+        ...((meta.category ?? CHECK_CATEGORIES[meta.id]) ? { category: meta.category ?? CHECK_CATEGORIES[meta.id] } : {}),
+        ...(options.applicable === false ? { applicable: false } : {}),
     };
 }
+/**
+ * Result for a check whose subject the site does not have: no API to describe,
+ * no commerce surface, no MCP server. Reported as N/A and excluded from the
+ * score rather than counted as a failure.
+ */
+export function notApplicable(meta, findings, start) {
+    return buildResult(meta, 0, findings, start, { applicable: false });
+}
+/**
+ * Whether a response body is a web page rather than the machine-readable
+ * document that was asked for.
+ *
+ * Single-page applications answer every unmatched path with their index shell,
+ * status 200. Probing `/.well-known/agent-card.json` or `/mcp/server-card` on
+ * such a site returns HTML, and a check that trusts the status code reports a
+ * *malformed* document where the honest answer is that the document is absent.
+ * That mistake is worse than a miss: it sends an operator hunting for a bug in
+ * a file they never wrote.
+ *
+ * Detection is deliberately narrow — a doctype or an `<html>` tag near the top
+ * of the body. Anything else is handed to the real parser, which reports its own
+ * problems precisely.
+ */
+export function isHtmlDocument(body) {
+    const head = body.slice(0, 1024).trimStart();
+    return /^<!doctype\s+html/i.test(head) || /^<html[\s>]/i.test(head) || /<html[\s>]/i.test(head.slice(0, 512));
+}
 /**
  * Validate the `Content-Type` of a fetched resource against a list of acceptable MIME types.
  *

package/dist/checks/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../src/checks/utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAG5C,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAe,EAAE,KAAa,EAAE,QAAmB,EAAE,KAAa;IAC5F,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC;QACxB,QAAQ;QACR,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;KAChD,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAAkB,EAClB,QAAkB,EAClB,OAAmE;IAEnE,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC7D,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,OAAO;YACL,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG,OAAO,CAAC,aAAa,6BAA6B;YAC9D,IAAI,EAAE,SAAS,OAAO,CAAC,aAAa,iBAAiB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YAC3E,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC;SACxD,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,OAAO;QACL,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,GAAG,OAAO,CAAC,aAAa,qBAAqB,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG;QACzE,MAAM,EAAE,oBAAoB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACjD,IAAI,EAAE,kCAAkC,OAAO,CAAC,aAAa,OAAO,QAAQ,CAAC,CAAC,CAAC,mCAAmC;QAClH,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC;KACxD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../src/checks/utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAG5C,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,IAAe,EACf,KAAa,EACb,QAAmB,EACnB,KAAa,EACb,UAAoC,EAAE;IAEtC,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC;QACxB,QAAQ;QACR,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;QAC/C,sEAAsE;QACtE,qEAAqE;QACrE,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjH,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,IAAe,EAAE,QAAmB,EAAE,KAAa;IAC/E,OAAO,WAAW,CAAC,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;IAC7C,OAAO,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;AAChH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAAkB,EAClB,QAAkB,EAClB,OAAmE;IAEnE,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC7D,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,OAAO;YACL,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG,OAAO,CAAC,aAAa,6BAA6B;YAC9D,IAAI,EAAE,SAAS,OAAO,CAAC,aAAa,iBAAiB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YAC3E,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC;SACxD,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,OAAO;QACL,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,GAAG,OAAO,CAAC,aAAa,qBAAqB,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG;QACzE,MAAM,EAAE,oBAAoB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACjD,IAAI,EAAE,kCAAkC,OAAO,CAAC,aAAa,OAAO,QAAQ,CAAC,CAAC,CAAC,mCAAmC;QAClH,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC;KACxD,CAAC;AACJ,CAAC"}

package/dist/checks/waf.d.ts

@@ -0,0 +1,75 @@
+/**
+ * Classify what actually happened to a request, beyond `res.ok`.
+ *
+ * An audit that probes a site with a crawler user agent gets back a status code
+ * and has to answer one question honestly: *does this site block AI crawlers?*
+ * A bare 403 does not answer it. The same 403 can mean:
+ *
+ * - a deliberate AI-crawler block in the WAF (a real finding);
+ * - a JavaScript challenge that any fetch-only client fails, real crawler
+ *   included (a different, usually accidental, finding);
+ * - anti-spoofing: the edge verifies crawlers by IP range or by Web Bot Auth
+ *   signature, so it rejects *this* probe precisely because the probe is
+ *   unsigned and comes from the wrong network, while admitting the genuine
+ *   crawler (not a finding at all — the site is behaving correctly).
+ *
+ * Reporting all three as "blocks AI crawlers" would be wrong often enough to
+ * make the check untrustworthy. So every classification carries the evidence
+ * that produced it and an `inconclusive` flag for the cases an unauthenticated
+ * probe genuinely cannot settle.
+ *
+ * Header signatures verified 2026-09-04:
+ * - Cloudflare challenge: `cf-mitigated: challenge`, always `text/html`.
+ *   https://developers.cloudflare.com/cloudflare-challenges/challenge-types/challenge-pages/detect-response/
+ * - AWS WAF challenge: HTTP **202** with `x-amzn-waf-action: challenge`.
+ *   https://docs.aws.amazon.com/waf/latest/developerguide/waf-captcha-and-challenge-actions.html
+ * - Vercel challenge: `x-vercel-mitigated: challenge` plus `x-vercel-challenge-token`.
+ * - Cloudflare pay-per-crawl: 402 with `crawler-price`.
+ *   https://developers.cloudflare.com/ai-crawl-control/features/pay-per-crawl/
+ * - AWS WAF / x402 monetization: 402 with `payment-signature` or an x402 body.
+ * - Web Bot Auth required: 403 with `Accept-Signature`.
+ *   https://datatracker.ietf.org/doc/html/draft-ietf-webbotauth-httpsig-protocol
+ * - RSL Open Licensing Protocol: 401/402 with `WWW-Authenticate: License`.
+ */
+import type { FetchResponse } from '../types.js';
+export type ResponseKind = 'ok'
+/** An interstitial that requires running JavaScript. Fetch-only clients never get past it. */
+ | 'challenge'
+/** 402 with a crawler price attached: content is monetised, not blocked. */
+ | 'paywall'
+/** 403 asking the client to re-request with an HTTP Message Signature. */
+ | 'needs-signature'
+/** 401/402 pointing at a machine-readable licence (RSL Open Licensing Protocol). */
+ | 'license-required' | 'rate-limited'
+/** A plain refusal with no negotiation offered. */
+ | 'blocked' | 'not-found' | 'server-error' | 'network-error';
+export interface ResponseClass {
+    kind: ResponseKind;
+    /** Edge or WAF vendor implicated, when the response identifies one. */
+    vendor?: string;
+    /** One sentence describing the outcome, written for a report. */
+    label: string;
+    /** Header names, values or body markers that produced this classification. */
+    evidence: string[];
+    /**
+     * True when this response cannot settle whether the site blocks AI crawlers.
+     * A challenge and a signature demand both reject an unsigned probe from a
+     * non-vendor IP while potentially admitting the genuine crawler.
+     */
+    inconclusive: boolean;
+    /** Price string from a pay-per-crawl response, e.g. `USD 0.01`. */
+    price?: string;
+}
+/** Identify the CDN or edge from response headers, for context in findings. */
+export declare function detectEdgeVendor(headers: Record<string, string>): string | undefined;
+/**
+ * Classify a fetch result. Pure and total: any response produces a
+ * classification, and unknown shapes fall back to status-based buckets.
+ */
+export declare function classifyResponse(res: FetchResponse): ResponseClass;
+/**
+ * Standard caveat for classifications an unauthenticated probe cannot settle.
+ * Appended to hints so a report never overstates what it observed.
+ */
+export declare const INCONCLUSIVE_CAVEAT: string;
+//# sourceMappingURL=waf.d.ts.map

package/dist/checks/waf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waf.d.ts","sourceRoot":"","sources":["../../src/checks/waf.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD,MAAM,MAAM,YAAY,GACpB,IAAI;AACN,8FAA8F;GAC5F,WAAW;AACb,4EAA4E;GAC1E,SAAS;AACX,0EAA0E;GACxE,iBAAiB;AACnB,oFAAoF;GAClF,kBAAkB,GAClB,cAAc;AAChB,mDAAmD;GACjD,SAAS,GACT,WAAW,GACX,cAAc,GACd,eAAe,CAAC;AAEpB,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,YAAY,CAAC;IACnB,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,KAAK,EAAE,MAAM,CAAC;IACd,8EAA8E;IAC9E,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB;;;;OAIG;IACH,YAAY,EAAE,OAAO,CAAC;IACtB,mEAAmE;IACnE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAmBD,+EAA+E;AAC/E,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,GAAG,SAAS,CAQpF;AAMD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,aAAa,GAAG,aAAa,CA6KlE;AAED;;;GAGG;AACH,eAAO,MAAM,mBAAmB,QAGM,CAAC"}

package/dist/checks/waf.js

@@ -0,0 +1,203 @@
+/** Body markers for challenge interstitials that do not set a header. */
+const CHALLENGE_BODY_MARKERS = [
+    { marker: /\/cdn-cgi\/challenge-platform\//i, vendor: 'Cloudflare' },
+    { marker: /<title>\s*Just a moment/i, vendor: 'Cloudflare' },
+    { marker: /Vercel Security Checkpoint/i, vendor: 'Vercel' },
+    { marker: /challenges\.cloudflare\.com\/turnstile/i, vendor: 'Cloudflare Turnstile' },
+    { marker: /www\.google\.com\/recaptcha\//i, vendor: 'reCAPTCHA' },
+    { marker: /\bhcaptcha\.com\/(1\/api\.js|captcha)/i, vendor: 'hCaptcha' },
+    { marker: /_Incapsula_Resource|Incapsula incident ID/i, vendor: 'Imperva' },
+    { marker: /Checking your browser before accessing/i, vendor: 'Cloudflare' },
+    { marker: /Please enable (JS|JavaScript) and disable any ad ?blocker/i, vendor: 'Cloudflare' },
+    { marker: /Request unsuccessful\. Incapsula/i, vendor: 'Imperva' },
+    { marker: /Pardon Our Interruption/i, vendor: 'Imperva' },
+    { marker: /PerimeterX|px-captcha/i, vendor: 'HUMAN (PerimeterX)' },
+    { marker: /Access Denied.*Reference #[0-9a-f.]+/is, vendor: 'Akamai' },
+];
+/** Identify the CDN or edge from response headers, for context in findings. */
+export function detectEdgeVendor(headers) {
+    if (headers['cf-ray'] !== undefined || /cloudflare/i.test(headers['server'] ?? ''))
+        return 'Cloudflare';
+    if (headers['x-vercel-id'] !== undefined || /vercel/i.test(headers['server'] ?? ''))
+        return 'Vercel';
+    if (headers['x-amzn-waf-action'] !== undefined || headers['x-amz-cf-id'] !== undefined)
+        return 'AWS';
+    if (headers['x-served-by']?.includes('cache-') || /varnish/i.test(headers['via'] ?? ''))
+        return 'Fastly';
+    if (headers['x-akamai-transformed'] !== undefined || /akamai/i.test(headers['server'] ?? ''))
+        return 'Akamai';
+    if (/netlify/i.test(headers['server'] ?? ''))
+        return 'Netlify';
+    return undefined;
+}
+function withVendor(base, vendor) {
+    return vendor === undefined ? base : `${base} (${vendor})`;
+}
+/**
+ * Classify a fetch result. Pure and total: any response produces a
+ * classification, and unknown shapes fall back to status-based buckets.
+ */
+export function classifyResponse(res) {
+    const h = res.headers ?? {};
+    const edge = detectEdgeVendor(h);
+    const body = res.body ?? '';
+    if (res.status === 0) {
+        return {
+            kind: 'network-error',
+            label: res.error ? `Network error: ${res.error}` : 'Network error',
+            evidence: res.error ? [res.error] : [],
+            inconclusive: true,
+        };
+    }
+    /* ── Challenges: an interstitial, not a policy decision ───────────────── */
+    if ((h['cf-mitigated'] ?? '').toLowerCase() === 'challenge') {
+        return {
+            kind: 'challenge',
+            vendor: 'Cloudflare',
+            label: 'Cloudflare served a challenge page',
+            evidence: ['cf-mitigated: challenge'],
+            inconclusive: true,
+        };
+    }
+    if ((h['x-vercel-mitigated'] ?? '').toLowerCase() === 'challenge' || h['x-vercel-challenge-token'] !== undefined) {
+        return {
+            kind: 'challenge',
+            vendor: 'Vercel',
+            label: 'Vercel served a security checkpoint',
+            evidence: [
+                h['x-vercel-mitigated'] !== undefined ? `x-vercel-mitigated: ${h['x-vercel-mitigated']}` : '',
+                h['x-vercel-challenge-token'] !== undefined ? 'x-vercel-challenge-token present' : '',
+            ].filter(Boolean),
+            inconclusive: true,
+        };
+    }
+    if ((h['x-amzn-waf-action'] ?? '').toLowerCase() === 'challenge') {
+        return {
+            kind: 'challenge',
+            vendor: 'AWS WAF',
+            label: `AWS WAF served a challenge (HTTP ${res.status})`,
+            evidence: [`x-amzn-waf-action: challenge`, `status ${res.status}`],
+            inconclusive: true,
+        };
+    }
+    /* ── Payment and licensing: an offer, not a refusal ───────────────────── */
+    if (res.status === 402) {
+        const price = h['crawler-price'];
+        if (price !== undefined) {
+            return {
+                kind: 'paywall',
+                vendor: 'Cloudflare pay-per-crawl',
+                label: `Content is priced for crawlers at ${price}`,
+                evidence: [`crawler-price: ${price}`],
+                inconclusive: false,
+                price,
+            };
+        }
+        if (h['payment-signature'] !== undefined || /"(payTo|maxTimeoutSeconds|x402Version)"/.test(body)) {
+            return {
+                kind: 'paywall',
+                vendor: withVendor('x402', edge),
+                label: 'Content is monetised through an x402 payment challenge',
+                evidence: [h['payment-signature'] !== undefined ? 'payment-signature header' : 'x402 fields in body'],
+                inconclusive: false,
+            };
+        }
+        if (/^License\b/i.test(h['www-authenticate'] ?? '')) {
+            return {
+                kind: 'license-required',
+                vendor: 'RSL Open Licensing Protocol',
+                label: 'A licence is required before this content may be used',
+                evidence: [`www-authenticate: ${h['www-authenticate']}`],
+                inconclusive: false,
+            };
+        }
+        return {
+            kind: 'blocked',
+            vendor: edge,
+            label: withVendor('Refused with 402 but no payment mechanism advertised', edge),
+            evidence: ['status 402 with no crawler-price, x402 fields, or licence challenge'],
+            inconclusive: false,
+        };
+    }
+    if (res.status === 401 && /^License\b/i.test(h['www-authenticate'] ?? '')) {
+        return {
+            kind: 'license-required',
+            vendor: 'RSL Open Licensing Protocol',
+            label: 'A licence is required before this content may be used',
+            evidence: [`www-authenticate: ${h['www-authenticate']}`],
+            inconclusive: false,
+        };
+    }
+    /* ── Signature demands: the site wants a verifiable agent ─────────────── */
+    if ((res.status === 401 || res.status === 403) && h['accept-signature'] !== undefined) {
+        return {
+            kind: 'needs-signature',
+            vendor: withVendor('Web Bot Auth', edge),
+            label: 'The origin requires a signed request (Web Bot Auth)',
+            evidence: [`accept-signature: ${h['accept-signature']}`],
+            inconclusive: true,
+        };
+    }
+    if (res.status === 429) {
+        return {
+            kind: 'rate-limited',
+            vendor: edge,
+            label: h['retry-after'] !== undefined ? `Rate limited, retry after ${h['retry-after']}` : 'Rate limited',
+            evidence: h['retry-after'] !== undefined ? [`retry-after: ${h['retry-after']}`] : ['status 429'],
+            inconclusive: true,
+        };
+    }
+    /* ── Body-marker challenges, on any status ────────────────────────────── */
+    const bodyChallenge = CHALLENGE_BODY_MARKERS.find((m) => m.marker.test(body));
+    if (bodyChallenge !== undefined) {
+        return {
+            kind: 'challenge',
+            vendor: bodyChallenge.vendor,
+            label: `${bodyChallenge.vendor} interstitial served instead of the page`,
+            evidence: [`body matched ${bodyChallenge.vendor} challenge markup`, `status ${res.status}`],
+            inconclusive: true,
+        };
+    }
+    if (res.status === 401 || res.status === 403) {
+        return {
+            kind: 'blocked',
+            vendor: edge,
+            label: withVendor(`Refused with HTTP ${res.status}`, edge),
+            evidence: [`status ${res.status}`],
+            // An edge that verifies bots by IP range or signature rejects an unsigned
+            // probe on principle, so a bare 403 from a known bot-managing CDN cannot
+            // prove a policy block.
+            inconclusive: edge !== undefined,
+        };
+    }
+    if (res.status === 404 || res.status === 410) {
+        return { kind: 'not-found', vendor: edge, label: `HTTP ${res.status}`, evidence: [], inconclusive: false };
+    }
+    if (res.status >= 500) {
+        return {
+            kind: 'server-error',
+            vendor: edge,
+            label: `Server error (HTTP ${res.status})`,
+            evidence: [`status ${res.status}`],
+            inconclusive: true,
+        };
+    }
+    if (res.ok) {
+        return { kind: 'ok', vendor: edge, label: `HTTP ${res.status}`, evidence: [], inconclusive: false };
+    }
+    return {
+        kind: 'blocked',
+        vendor: edge,
+        label: `Unexpected HTTP ${res.status}`,
+        evidence: [`status ${res.status}`],
+        inconclusive: true,
+    };
+}
+/**
+ * Standard caveat for classifications an unauthenticated probe cannot settle.
+ * Appended to hints so a report never overstates what it observed.
+ */
+export const INCONCLUSIVE_CAVEAT = 'ax-audit sends this user agent from its own network without a Web Bot Auth signature, so an edge that verifies ' +
+    'crawlers by IP range or signature will reject the probe while admitting the real crawler. Confirm against your ' +
+    'WAF logs before changing any rule.';
+//# sourceMappingURL=waf.js.map

package/dist/checks/waf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"waf.js","sourceRoot":"","sources":["../../src/checks/waf.ts"],"names":[],"mappings":"AAsEA,yEAAyE;AACzE,MAAM,sBAAsB,GAAyC;IACnE,EAAE,MAAM,EAAE,kCAAkC,EAAE,MAAM,EAAE,YAAY,EAAE;IACpE,EAAE,MAAM,EAAE,0BAA0B,EAAE,MAAM,EAAE,YAAY,EAAE;IAC5D,EAAE,MAAM,EAAE,6BAA6B,EAAE,MAAM,EAAE,QAAQ,EAAE;IAC3D,EAAE,MAAM,EAAE,yCAAyC,EAAE,MAAM,EAAE,sBAAsB,EAAE;IACrF,EAAE,MAAM,EAAE,gCAAgC,EAAE,MAAM,EAAE,WAAW,EAAE;IACjE,EAAE,MAAM,EAAE,wCAAwC,EAAE,MAAM,EAAE,UAAU,EAAE;IACxE,EAAE,MAAM,EAAE,4CAA4C,EAAE,MAAM,EAAE,SAAS,EAAE;IAC3E,EAAE,MAAM,EAAE,yCAAyC,EAAE,MAAM,EAAE,YAAY,EAAE;IAC3E,EAAE,MAAM,EAAE,4DAA4D,EAAE,MAAM,EAAE,YAAY,EAAE;IAC9F,EAAE,MAAM,EAAE,mCAAmC,EAAE,MAAM,EAAE,SAAS,EAAE;IAClE,EAAE,MAAM,EAAE,0BAA0B,EAAE,MAAM,EAAE,SAAS,EAAE;IACzD,EAAE,MAAM,EAAE,wBAAwB,EAAE,MAAM,EAAE,oBAAoB,EAAE;IAClE,EAAE,MAAM,EAAE,wCAAwC,EAAE,MAAM,EAAE,QAAQ,EAAE;CACvE,CAAC;AAEF,+EAA+E;AAC/E,MAAM,UAAU,gBAAgB,CAAC,OAA+B;IAC9D,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,SAAS,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAAE,OAAO,YAAY,CAAC;IACxG,IAAI,OAAO,CAAC,aAAa,CAAC,KAAK,SAAS,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAAE,OAAO,QAAQ,CAAC;IACrG,IAAI,OAAO,CAAC,mBAAmB,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,aAAa,CAAC,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACrG,IAAI,OAAO,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAAE,OAAO,QAAQ,CAAC;IACzG,IAAI,OAAO,CAAC,sBAAsB,CAAC,KAAK,SAAS,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC9G,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,MAA0B;IAC1D,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,MAAM,GAAG,CAAC;AAC7D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAkB;IACjD,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;IAE5B,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO;YACL,IAAI,EAAE,eAAe;YACrB,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,kBAAkB,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,eAAe;YAClE,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE;YACtC,YAAY,EAAE,IAAI;SACnB,CAAC;IACJ,CAAC;IAED,6EAA6E;IAE7E,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,WAAW,EAAE,CAAC;QAC5D,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,YAAY;YACpB,KAAK,EAAE,oCAAoC;YAC3C,QAAQ,EAAE,CAAC,yBAAyB,CAAC;YACrC,YAAY,EAAE,IAAI;SACnB,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,WAAW,IAAI,CAAC,CAAC,0BAA0B,CAAC,KAAK,SAAS,EAAE,CAAC;QACjH,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,qCAAqC;YAC5C,QAAQ,EAAE;gBACR,CAAC,CAAC,oBAAoB,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;gBAC7F,CAAC,CAAC,0BAA0B,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,kCAAkC,CAAC,CAAC,CAAC,EAAE;aACtF,CAAC,MAAM,CAAC,OAAO,CAAC;YACjB,YAAY,EAAE,IAAI;SACnB,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,WAAW,EAAE,CAAC;QACjE,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,SAAS;YACjB,KAAK,EAAE,oCAAoC,GAAG,CAAC,MAAM,GAAG;YACxD,QAAQ,EAAE,CAAC,8BAA8B,EAAE,UAAU,GAAG,CAAC,MAAM,EAAE,CAAC;YAClE,YAAY,EAAE,IAAI;SACnB,CAAC;IACJ,CAAC;IAED,6EAA6E;IAE7E,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,CAAC,CAAC,eAAe,CAAC,CAAC;QACjC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO;gBACL,IAAI,EAAE,SAAS;gBACf,MAAM,EAAE,0BAA0B;gBAClC,KAAK,EAAE,qCAAqC,KAAK,EAAE;gBACnD,QAAQ,EAAE,CAAC,kBAAkB,KAAK,EAAE,CAAC;gBACrC,YAAY,EAAE,KAAK;gBACnB,KAAK;aACN,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,CAAC,mBAAmB,CAAC,KAAK,SAAS,IAAI,yCAAyC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACjG,OAAO;gBACL,IAAI,EAAE,SAAS;gBACf,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC;gBAChC,KAAK,EAAE,wDAAwD;gBAC/D,QAAQ,EAAE,CAAC,CAAC,CAAC,mBAAmB,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,qBAAqB,CAAC;gBACrG,YAAY,EAAE,KAAK;aACpB,CAAC;QACJ,CAAC;QACD,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACpD,OAAO;gBACL,IAAI,EAAE,kBAAkB;gBACxB,MAAM,EAAE,6BAA6B;gBACrC,KAAK,EAAE,uDAAuD;gBAC9D,QAAQ,EAAE,CAAC,qBAAqB,CAAC,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBACxD,YAAY,EAAE,KAAK;aACpB,CAAC;QACJ,CAAC;QACD,OAAO;YACL,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,IAAI;YACZ,KAAK,EAAE,UAAU,CAAC,sDAAsD,EAAE,IAAI,CAAC;YAC/E,QAAQ,EAAE,CAAC,qEAAqE,CAAC;YACjF,YAAY,EAAE,KAAK;SACpB,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QAC1E,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,MAAM,EAAE,6BAA6B;YACrC,KAAK,EAAE,uDAAuD;YAC9D,QAAQ,EAAE,CAAC,qBAAqB,CAAC,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACxD,YAAY,EAAE,KAAK;SACpB,CAAC;IACJ,CAAC;IAED,6EAA6E;IAE7E,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,kBAAkB,CAAC,KAAK,SAAS,EAAE,CAAC;QACtF,OAAO;YACL,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC;YACxC,KAAK,EAAE,qDAAqD;YAC5D,QAAQ,EAAE,CAAC,qBAAqB,CAAC,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACxD,YAAY,EAAE,IAAI;SACnB,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,OAAO;YACL,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,IAAI;YACZ,KAAK,EAAE,CAAC,CAAC,aAAa,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc;YACxG,QAAQ,EAAE,CAAC,CAAC,aAAa,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;YAChG,YAAY,EAAE,IAAI;SACnB,CAAC;IACJ,CAAC;IAED,6EAA6E;IAE7E,MAAM,aAAa,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9E,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,aAAa,CAAC,MAAM;YAC5B,KAAK,EAAE,GAAG,aAAa,CAAC,MAAM,0CAA0C;YACxE,QAAQ,EAAE,CAAC,gBAAgB,aAAa,CAAC,MAAM,mBAAmB,EAAE,UAAU,GAAG,CAAC,MAAM,EAAE,CAAC;YAC3F,YAAY,EAAE,IAAI;SACnB,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC7C,OAAO;YACL,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,IAAI;YACZ,KAAK,EAAE,UAAU,CAAC,qBAAqB,GAAG,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC;YAC1D,QAAQ,EAAE,CAAC,UAAU,GAAG,CAAC,MAAM,EAAE,CAAC;YAClC,0EAA0E;YAC1E,yEAAyE;YACzE,wBAAwB;YACxB,YAAY,EAAE,IAAI,KAAK,SAAS;SACjC,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC7C,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,GAAG,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;IAC7G,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QACtB,OAAO;YACL,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,IAAI;YACZ,KAAK,EAAE,sBAAsB,GAAG,CAAC,MAAM,GAAG;YAC1C,QAAQ,EAAE,CAAC,UAAU,GAAG,CAAC,MAAM,EAAE,CAAC;YAClC,YAAY,EAAE,IAAI;SACnB,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;QACX,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,GAAG,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;IACtG,CAAC;IAED,OAAO;QACL,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE,mBAAmB,GAAG,CAAC,MAAM,EAAE;QACtC,QAAQ,EAAE,CAAC,UAAU,GAAG,CAAC,MAAM,EAAE,CAAC;QAClC,YAAY,EAAE,IAAI;KACnB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAC9B,iHAAiH;IACjH,iHAAiH;IACjH,oCAAoC,CAAC"}

package/dist/checks/webmcp.d.ts

@@ -0,0 +1,55 @@
+import type { CheckContext, CheckResult, CheckMeta } from '../types.js';
+/**
+ * "webmcp" — can a browser agent invoke this page's forms as tools?
+ *
+ * Today an agent that wants to use a form has to look at pixels, guess which
+ * field is which, type into them, and hope. WebMCP lets a page declare a form as
+ * a callable tool with named parameters, so the agent calls it instead of
+ * driving it. The declarative form is two attributes:
+ *
+ * ```html
+ * <form toolname="searchDocs" tooldescription="Search the documentation">
+ *   <input name="q" toolparamdescription="The search query">
+ * </form>
+ * ```
+ *
+ * Status, verified 2026-09-04: a W3C Web Machine Learning Community Group draft
+ * with a Chrome origin trial running from Chrome 149. Not a standard, not
+ * shipped by default, not implemented in Firefox or Safari. Adoption is
+ * effectively zero.
+ *
+ * So this check never asks for WebMCP and never scores a site down for lacking
+ * it. It reports N/A on a page with no forms and no WebMCP code at all. What it
+ * does do, on pages that have adopted it, is catch the mistakes a static
+ * analysis can catch with certainty: a `toolname` with no `tooldescription`,
+ * which is the exact condition Lighthouse's `webmcp-schema-validity` audit
+ * fails, parameters with no description, and use of the `navigator.modelContext`
+ * namespace that Chrome deprecated in favour of `document.modelContext`.
+ */
+export declare const meta: CheckMeta;
+export interface FormAnalysis {
+    total: number;
+    annotated: number;
+    /** Forms declaring a name but no description — invalid, and Lighthouse fails them. */
+    missingDescription: string[];
+    /** Forms declaring a description but no name: nothing for an agent to call. */
+    missingName: number;
+    /** Tool names that are not usable identifiers. */
+    invalidNames: string[];
+    /** Annotated forms whose named controls lack `toolparamdescription`. */
+    undescribedParams: {
+        tool: string;
+        missing: number;
+        total: number;
+    }[];
+    autoSubmit: string[];
+}
+/** Analyse declarative WebMCP annotations across every form on the page. */
+export declare function analyseForms(html: string): FormAnalysis;
+/** Detect imperative WebMCP registration in inline scripts. */
+export declare function detectImperative(html: string): {
+    registers: boolean;
+    deprecatedNamespace: boolean;
+};
+export default function check(ctx: CheckContext): Promise<CheckResult>;
+//# sourceMappingURL=webmcp.d.ts.map

package/dist/checks/webmcp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webmcp.d.ts","sourceRoot":"","sources":["../../src/checks/webmcp.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,SAAS,EAAW,MAAM,aAAa,CAAC;AAIjF;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,IAAI,EAAE,SAKlB,CAAC;AAWF,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,sFAAsF;IACtF,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,+EAA+E;IAC/E,WAAW,EAAE,MAAM,CAAC;IACpB,kDAAkD;IAClD,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,wEAAwE;IACxE,iBAAiB,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACtE,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAWD,4EAA4E;AAC5E,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,CAiDvD;AAED,+DAA+D;AAC/D,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,SAAS,EAAE,OAAO,CAAC;IAAC,mBAAmB,EAAE,OAAO,CAAA;CAAE,CAMnG;AAED,wBAA8B,KAAK,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAmH3E"}

package/dist/checks/webmcp.js

@@ -0,0 +1,209 @@
+import { guideUrl } from '../guide-urls.js';
+import { buildResult, notApplicable } from './utils.js';
+import { getAttribute } from './html-utils.js';
+/**
+ * "webmcp" — can a browser agent invoke this page's forms as tools?
+ *
+ * Today an agent that wants to use a form has to look at pixels, guess which
+ * field is which, type into them, and hope. WebMCP lets a page declare a form as
+ * a callable tool with named parameters, so the agent calls it instead of
+ * driving it. The declarative form is two attributes:
+ *
+ * ```html
+ * <form toolname="searchDocs" tooldescription="Search the documentation">
+ *   <input name="q" toolparamdescription="The search query">
+ * </form>
+ * ```
+ *
+ * Status, verified 2026-09-04: a W3C Web Machine Learning Community Group draft
+ * with a Chrome origin trial running from Chrome 149. Not a standard, not
+ * shipped by default, not implemented in Firefox or Safari. Adoption is
+ * effectively zero.
+ *
+ * So this check never asks for WebMCP and never scores a site down for lacking
+ * it. It reports N/A on a page with no forms and no WebMCP code at all. What it
+ * does do, on pages that have adopted it, is catch the mistakes a static
+ * analysis can catch with certainty: a `toolname` with no `tooldescription`,
+ * which is the exact condition Lighthouse's `webmcp-schema-validity` audit
+ * fails, parameters with no description, and use of the `navigator.modelContext`
+ * namespace that Chrome deprecated in favour of `document.modelContext`.
+ */
+export const meta = {
+    id: 'webmcp',
+    name: 'WebMCP',
+    description: 'Checks declarative WebMCP tool annotations on forms',
+    category: 'protocols',
+};
+/** Tool names are identifiers an agent calls, so they follow identifier rules. */
+const TOOL_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]{0,127}$/;
+/** Form controls that carry a value an agent would need described. */
+const CONTROL_RE = /<(input|select|textarea)\b([^>]*)>/gi;
+/** Input types that carry no user-supplied value worth describing. */
+const VALUELESS_TYPES = new Set(['hidden', 'submit', 'button', 'reset', 'image']);
+/** Split the document into `<form>` blocks, keeping each element's attributes and inner HTML. */
+function forms(html) {
+    const out = [];
+    for (const m of html.matchAll(/<form\b([^>]*)>([\s\S]*?)<\/form>/gi)) {
+        out.push({ attrs: m[1], inner: m[2] });
+    }
+    return out;
+}
+/** Analyse declarative WebMCP annotations across every form on the page. */
+export function analyseForms(html) {
+    const analysis = {
+        total: 0,
+        annotated: 0,
+        missingDescription: [],
+        missingName: 0,
+        invalidNames: [],
+        undescribedParams: [],
+        autoSubmit: [],
+    };
+    for (const form of forms(html)) {
+        analysis.total++;
+        const toolName = getAttribute(form.attrs, 'toolname');
+        const toolDescription = getAttribute(form.attrs, 'tooldescription');
+        if (toolName === null && toolDescription === null)
+            continue;
+        const label = toolName ?? '(unnamed)';
+        analysis.annotated++;
+        if (toolName === null || toolName.trim() === '') {
+            analysis.missingName++;
+        }
+        if (toolDescription === null || toolDescription.trim() === '') {
+            analysis.missingDescription.push(label);
+        }
+        if (toolName !== null && !TOOL_NAME_RE.test(toolName)) {
+            analysis.invalidNames.push(toolName);
+        }
+        if (/\btoolautosubmit\b/i.test(form.attrs)) {
+            analysis.autoSubmit.push(label);
+        }
+        let total = 0;
+        let missing = 0;
+        for (const control of form.inner.matchAll(CONTROL_RE)) {
+            const attrs = control[2];
+            const type = (getAttribute(attrs, 'type') ?? '').toLowerCase();
+            if (VALUELESS_TYPES.has(type))
+                continue;
+            if (getAttribute(attrs, 'name') === null)
+                continue;
+            total++;
+            if (getAttribute(attrs, 'toolparamdescription') === null)
+                missing++;
+        }
+        if (total > 0 && missing > 0) {
+            analysis.undescribedParams.push({ tool: label, missing, total });
+        }
+    }
+    return analysis;
+}
+/** Detect imperative WebMCP registration in inline scripts. */
+export function detectImperative(html) {
+    const scripts = [...html.matchAll(/<script\b[^>]*>([\s\S]*?)<\/script>/gi)].map((m) => m[1]).join('\n');
+    return {
+        registers: /\bmodelContext\s*\.\s*(registerTool|provideContext)\s*\(/.test(scripts),
+        deprecatedNamespace: /\bnavigator\s*\.\s*modelContext\b/.test(scripts),
+    };
+}
+export default async function check(ctx) {
+    const start = performance.now();
+    const findings = [];
+    let score = 100;
+    const html = ctx.html ?? '';
+    const analysis = analyseForms(html);
+    const imperative = detectImperative(html);
+    if (analysis.total === 0 && !imperative.registers && !imperative.deprecatedNamespace) {
+        findings.push({
+            status: 'pass',
+            message: 'No forms and no WebMCP code — nothing here for an agent to invoke as a tool',
+        });
+        return notApplicable(meta, findings, start);
+    }
+    if (imperative.registers) {
+        findings.push({
+            status: 'pass',
+            message: 'Imperative WebMCP registration detected in page scripts',
+            detail: 'A static audit cannot enumerate the registered tools or validate their schemas; that needs a browser.',
+        });
+    }
+    if (imperative.deprecatedNamespace) {
+        findings.push({
+            status: 'warn',
+            message: 'Page uses the deprecated navigator.modelContext namespace',
+            hint: 'Chrome moved the API to document.modelContext. Feature-detect both while the origin trial runs: const ctx = document.modelContext ?? navigator.modelContext.',
+            learnMoreUrl: guideUrl(meta.id, 'deprecated-namespace'),
+        });
+        score -= 10;
+    }
+    if (analysis.annotated === 0) {
+        findings.push({
+            status: 'warn',
+            message: `${analysis.total} form(s) on the page, none declared as agent tools`,
+            detail: 'WebMCP is a W3C Community Group draft in a Chrome origin trial. It is not a standard and adoption is minimal, ' +
+                'so this is a forward-looking note, not a defect.',
+            hint: 'A declared form is called by an agent rather than driven pixel by pixel. Add toolname and tooldescription to ' +
+                'the forms worth automating — search, filter, subscribe — and toolparamdescription to each field.',
+            learnMoreUrl: guideUrl(meta.id, 'no-annotations'),
+        });
+        return buildResult(meta, score, findings, start);
+    }
+    findings.push({
+        status: 'pass',
+        message: `${analysis.annotated}/${analysis.total} form(s) declared as agent tools`,
+    });
+    if (analysis.missingDescription.length > 0) {
+        findings.push({
+            status: 'fail',
+            message: `${analysis.missingDescription.length} tool form(s) declare a name but no description`,
+            detail: analysis.missingDescription.join(', '),
+            hint: 'The description is what an agent reads to decide whether to call the tool; a named tool without one is ' +
+                'unusable. Both attributes are required together.',
+            learnMoreUrl: guideUrl(meta.id, 'missing-description'),
+        });
+        score -= 30;
+    }
+    if (analysis.missingName > 0) {
+        findings.push({
+            status: 'fail',
+            message: `${analysis.missingName} form(s) declare a tool description but no tool name`,
+            hint: 'Without a toolname there is nothing for an agent to call. Both attributes are required together.',
+            learnMoreUrl: guideUrl(meta.id, 'missing-name'),
+        });
+        score -= 30;
+    }
+    if (analysis.invalidNames.length > 0) {
+        findings.push({
+            status: 'warn',
+            message: 'Tool name is not a usable identifier',
+            detail: analysis.invalidNames.join(', '),
+            hint: 'A tool name is called like a function. Use letters, digits and underscores, starting with a letter: searchDocs, subscribe_newsletter.',
+            learnMoreUrl: guideUrl(meta.id, 'invalid-name'),
+        });
+        score -= 10;
+    }
+    if (analysis.undescribedParams.length > 0) {
+        const totalMissing = analysis.undescribedParams.reduce((acc, p) => acc + p.missing, 0);
+        findings.push({
+            status: 'warn',
+            message: `${totalMissing} tool parameter(s) have no description`,
+            detail: analysis.undescribedParams.map((p) => `${p.tool}: ${p.missing}/${p.total} fields undescribed`).join('\n'),
+            hint: 'Add toolparamdescription to each named field. Without it an agent has to infer a field’s meaning from its ' +
+                'name, which is how a search box gets an email address in it.',
+            learnMoreUrl: guideUrl(meta.id, 'undescribed-params'),
+        });
+        score -= 15;
+    }
+    else {
+        findings.push({ status: 'pass', message: 'Every tool parameter carries a description' });
+    }
+    if (analysis.autoSubmit.length > 0) {
+        findings.push({
+            status: 'pass',
+            message: `${analysis.autoSubmit.length} tool form(s) declare toolautosubmit`,
+            detail: 'The agent submits without a further confirmation step. Appropriate for read-only actions such as search, not for anything that charges, sends or deletes.',
+        });
+    }
+    return buildResult(meta, score, findings, start);
+}
+//# sourceMappingURL=webmcp.js.map

package/dist/checks/webmcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webmcp.js","sourceRoot":"","sources":["../../src/checks/webmcp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,MAAM,IAAI,GAAc;IAC7B,EAAE,EAAE,QAAQ;IACZ,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,qDAAqD;IAClE,QAAQ,EAAE,WAAW;CACtB,CAAC;AAEF,kFAAkF;AAClF,MAAM,YAAY,GAAG,gCAAgC,CAAC;AAEtD,sEAAsE;AACtE,MAAM,UAAU,GAAG,sCAAsC,CAAC;AAE1D,sEAAsE;AACtE,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAgBlF,iGAAiG;AACjG,SAAS,KAAK,CAAC,IAAY;IACzB,MAAM,GAAG,GAAuC,EAAE,CAAC;IACnD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,qCAAqC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,QAAQ,GAAiB;QAC7B,KAAK,EAAE,CAAC;QACR,SAAS,EAAE,CAAC;QACZ,kBAAkB,EAAE,EAAE;QACtB,WAAW,EAAE,CAAC;QACd,YAAY,EAAE,EAAE;QAChB,iBAAiB,EAAE,EAAE;QACrB,UAAU,EAAE,EAAE;KACf,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,QAAQ,CAAC,KAAK,EAAE,CAAC;QACjB,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QACtD,MAAM,eAAe,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;QACpE,IAAI,QAAQ,KAAK,IAAI,IAAI,eAAe,KAAK,IAAI;YAAE,SAAS;QAE5D,MAAM,KAAK,GAAG,QAAQ,IAAI,WAAW,CAAC;QACtC,QAAQ,CAAC,SAAS,EAAE,CAAC;QAErB,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAChD,QAAQ,CAAC,WAAW,EAAE,CAAC;QACzB,CAAC;QACD,IAAI,eAAe,KAAK,IAAI,IAAI,eAAe,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC9D,QAAQ,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtD,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC;QACD,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3C,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;QAED,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACtD,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YACzB,MAAM,IAAI,GAAG,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YAC/D,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,SAAS;YACxC,IAAI,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI;gBAAE,SAAS;YACnD,KAAK,EAAE,CAAC;YACR,IAAI,YAAY,CAAC,KAAK,EAAE,sBAAsB,CAAC,KAAK,IAAI;gBAAE,OAAO,EAAE,CAAC;QACtE,CAAC;QACD,IAAI,KAAK,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;YAC7B,QAAQ,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,uCAAuC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxG,OAAO;QACL,SAAS,EAAE,0DAA0D,CAAC,IAAI,CAAC,OAAO,CAAC;QACnF,mBAAmB,EAAE,mCAAmC,CAAC,IAAI,CAAC,OAAO,CAAC;KACvE,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,KAAK,CAAC,GAAiB;IACnD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,KAAK,GAAG,GAAG,CAAC;IAEhB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAE1C,IAAI,QAAQ,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,IAAI,CAAC,UAAU,CAAC,mBAAmB,EAAE,CAAC;QACrF,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,6EAA6E;SACvF,CAAC,CAAC;QACH,OAAO,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC9C,CAAC;IAED,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;QACzB,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,yDAAyD;YAClE,MAAM,EAAE,uGAAuG;SAChH,CAAC,CAAC;IACL,CAAC;IAED,IAAI,UAAU,CAAC,mBAAmB,EAAE,CAAC;QACnC,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,2DAA2D;YACpE,IAAI,EAAE,8JAA8J;YACpK,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,sBAAsB,CAAC;SACxD,CAAC,CAAC;QACH,KAAK,IAAI,EAAE,CAAC;IACd,CAAC;IAED,IAAI,QAAQ,CAAC,SAAS,KAAK,CAAC,EAAE,CAAC;QAC7B,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG,QAAQ,CAAC,KAAK,oDAAoD;YAC9E,MAAM,EACJ,gHAAgH;gBAChH,kDAAkD;YACpD,IAAI,EACF,+GAA+G;gBAC/G,kGAAkG;YACpG,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,gBAAgB,CAAC;SAClD,CAAC,CAAC;QACH,OAAO,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IACnD,CAAC;IAED,QAAQ,CAAC,IAAI,CAAC;QACZ,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,GAAG,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,KAAK,kCAAkC;KACnF,CAAC,CAAC;IAEH,IAAI,QAAQ,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3C,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG,QAAQ,CAAC,kBAAkB,CAAC,MAAM,iDAAiD;YAC/F,MAAM,EAAE,QAAQ,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;YAC9C,IAAI,EACF,yGAAyG;gBACzG,kDAAkD;YACpD,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,qBAAqB,CAAC;SACvD,CAAC,CAAC;QACH,KAAK,IAAI,EAAE,CAAC;IACd,CAAC;IAED,IAAI,QAAQ,CAAC,WAAW,GAAG,CAAC,EAAE,CAAC;QAC7B,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG,QAAQ,CAAC,WAAW,sDAAsD;YACtF,IAAI,EAAE,kGAAkG;YACxG,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,cAAc,CAAC;SAChD,CAAC,CAAC;QACH,KAAK,IAAI,EAAE,CAAC;IACd,CAAC;IAED,IAAI,QAAQ,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrC,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,sCAAsC;YAC/C,MAAM,EAAE,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;YACxC,IAAI,EAAE,uIAAuI;YAC7I,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,cAAc,CAAC;SAChD,CAAC,CAAC;QACH,KAAK,IAAI,EAAE,CAAC;IACd,CAAC;IAED,IAAI,QAAQ,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,YAAY,GAAG,QAAQ,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACvF,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG,YAAY,wCAAwC;YAChE,MAAM,EAAE,QAAQ,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,KAAK,qBAAqB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YACjH,IAAI,EACF,4GAA4G;gBAC5G,8DAA8D;YAChE,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,oBAAoB,CAAC;SACtD,CAAC,CAAC;QACH,KAAK,IAAI,EAAE,CAAC;IACd,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,4CAA4C,EAAE,CAAC,CAAC;IAC3F,CAAC;IAED,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG,QAAQ,CAAC,UAAU,CAAC,MAAM,sCAAsC;YAC5E,MAAM,EACJ,2JAA2J;SAC9J,CAAC,CAAC;IACL,CAAC;IAED,OAAO,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;AACnD,CAAC"}