Fetch and validate /auth.md [fail]! auth.md response did not match Auth.md v1 agent registration guidance. content too short (42/80 chars minimum); missing registration instructions; missing OAuth Protected Resource Metadata discovery guidance; missing OAuth authorization-server metadata guidance; missing Auth.md credential type guidance; missing agent_verified/user_claimed or claim ceremony guidance; missing credential usage, expiry, error, or revocation guidance.INFOFetch and validate /auth.mdINFOFetch Auth.md-related resource path="/auth.md" statusCode=200 contentType="text/markdown; charset=UTF-8" bytes=46FAILCompare response Content-Type with expected Auth.md media type actual=true expected=trueFAILCompare Auth.md/OAuth metadata validation result actual=false expected=trueFAILCompare Auth.md content length actual=42 expected=">= 80 characters"WARNAuth.md validation warning warning="missing agent_verified/user_claimed or claim ceremony guidance"WARNAuth.md validation warning warning="missing credential usage, expiry, error, or revocation guidance"FAILAuth.md validation issue issue="auth.md response did not match Auth.md v1 agent registration guidance. content too short (42/80 chars minimum); missing registration instructions; missing OAuth Protected Resource Metadata discovery guidance; missing OAuth authorization-server metadata guidance; missing Auth.md credential type guidance; missing agent_verified/user_claimed or claim ceremony guidance; missing credential usage, expiry, error, or revocation guidance."FAILauth.md response did not match Auth.md v1 agent registration guidance. content too short (42/80 chars minimum); missing registration instructions; missing OAuth Protected Resource Metadata discovery guidance; missing OAuth authorization-server metadata guidance; missing Auth.md credential type guidance; missing agent_verified/user_claimed or claim ceremony guidance; missing credential usage, expiry, error, or revocation guidance.Validate protected resource metadata [fail]! OAuth Protected Resource Metadata could not be fetched.INFOValidate protected resource metadataINFOFetch Auth.md-related resource path="/.well-known/oauth-protected-resource" statusCode=404 contentType="text/html; charset=UTF-8" bytes=308007FAILCompare response Content-Type with expected Auth.md media type actual=false expected=trueFAILCompare Auth.md/OAuth metadata validation result actual=false expected=trueFAILAuth.md validation issue issue="OAuth Protected Resource Metadata could not be fetched."FAILOAuth Protected Resource Metadata could not be fetched.Validate Auth.md authorization metadata [fail]! OAuth authorization-server metadata could not be fetched.INFOValidate Auth.md authorization metadataINFOFetch Auth.md-related resource path="/.well-known/oauth-authorization-server" statusCode=404 contentType="text/html; charset=UTF-8" bytes=308011FAILCompare response Content-Type with expected Auth.md media type actual=false expected=trueFAILCompare Auth.md/OAuth metadata validation result actual=false expected=trueFAILAuth.md validation issue issue="OAuth authorization-server metadata could not be fetched."FAILOAuth authorization-server metadata could not be fetched.

Evaluate fetch baseline [fail]! default-src is present but not meaningfully restrictive.INFOEvaluate fetch baselineINFOEvaluate resource loading fallback defaultSrc=["'self'","https:","data:","blob:"] explicitFetchDirectives=["img-src","script-src","style-src"]FAILCompare fetch baseline actual=["'self'","https:","data:","blob:"] expected="restricted default-src or broad explicit fetch coverage" issue="default-src is present but not meaningfully restrictive."FAILdefault-src is present but not meaningfully restrictive.Evaluate script execution [fail]! script-src leaves script execution broadly unrestricted.INFOEvaluate script executionINFOInspect effective script directive effectiveDirective="script-src" sources=["'self'","https:","'unsafe-inline'","'unsafe-eval'"]FAILCompare script execution posture actual={"hasNonce":false,"hasHash":false,"hasStrictDynamic":false,"hasUnsafeInline":true,"hasUnsafeEval":true,"hasWildcardHost":false,"hasBroadScheme":true,"dangerousSchemes":[]} expected="constrained script sources without unsafe execution allowances" issue="script-src leaves script execution broadly unrestricted."FAILscript-src leaves script execution broadly unrestricted.Review hardening directives [warning]! CSP is missing recommended hardening directives: object-src, base-uri, form-action.INFOReview hardening directivesINFOInspect CSP hardening directives objectSrcFallback=["'self'","https:","data:","blob:"] frameAncestors=["'self'"] formCount=3WARNCompare recommended hardening coverage actual=["object-src","base-uri","form-action"] expected="no missing object-src/base-uri/form-action requirements" issue="CSP is missing recommended hardening directives: object-src, base-uri, form-action."WARNCSP is missing recommended hardening directives: object-src, base-uri, form-action.Review CSP reporting [warning]! CSP does not define a reporting endpoint.INFOReview CSP reportingINFOInspect CSP reporting directives reportOnlyHeaderPresent=false reportOnlyDirectives=[]WARNCompare violation reporting configuration actual="no reporting endpoint" expected="report-to or report-uri present" issue="CSP does not define a reporting endpoint."WARNCSP does not define a reporting endpoint.