How scoring works
Ruleset 2026-10-21. The score is the share of applicable points earned, rounded to the nearest whole number. Checks that cannot apply (for example declarative-form quality on a page that only registers tools imperatively) are excluded rather than counted as failures.
Grades
A+ 95–100 · A 85–94 · B 70–84 · C 55–69 · D 40–54 · F below 40.
Checks
| ID | Check | Points |
|---|---|---|
| A1 | Tools exposed to agents | 15 |
| A2 | Imperative registration conforms to the spec | 10 |
| A3 | Declarative tool forms | 15 |
| B1 | Tool names | 4 |
| B2 | Tool descriptions | 4 |
| B3 | Input schemas | 6 |
| B4 | Annotations match behaviour | 3 |
| B5 | Prompt-injection & sensitive-data hygiene | 3 |
| C1 | HTTPS (secure context) | 8 |
| C2 | Content Security Policy | 4 |
| C3 | No mixed content | 3 |
| C4 | Permissions-Policy 'tools' | 3 |
| C5 | Strict-Transport-Security | 2 |
| D1 | Schema.org structured data | 5 |
| D2 | llms.txt | 4 |
| D3 | Meta description | 3 |
| D4 | Open Graph tags | 4 |
| D5 | robots.txt lets AI agents in | 4 |
| I1 | How the page was observed | — |
| I2 | Registration timing | — |
| I3 | /.well-known/webmcp manifest | — |
What each category means
A. WebMCP tools (40)
A1 at least one tool is visible to an agent after the page has rendered (imperative document.modelContext.registerTool() or a declarative <form toolname>); tools only on the legacy navigator.modelContext earn half. A2 every imperative registration is accepted under the draft's rules: name of 1–128 characters from A–Z a–z 0–9 _ - ., non-empty description, unique name, current document surface. A3 each declarative form has a valid toolname, a tooldescription of at least 20 characters, and named, constrained, described fields.
B. Tool contract quality (20)
B1 verb_object names of 30 characters or fewer (Chrome's guidance budget). B2 descriptions of 20–500 characters that do more than repeat the name. B3 an object inputSchema whose properties all have a type and a description, with a valid required list. B4 annotations consistent with the verb: readOnlyHint on reads, consequentialHint on payments, sends and deletions, untrustedContentHint on user-generated output. B5 no prompt-injection indicators (directives aimed at the agent, invisible characters, look-alike scripts, encoded blobs) and no credential or payment parameters.
C. Security & compatibility (20)
C1 HTTPS — document.modelContext only exists in secure contexts. C2 an enforced Content-Security-Policy without 'unsafe-inline' or 'unsafe-eval' for scripts. C3 no http:// subresources. C4 the tools Permissions-Policy feature: explicit tools=(self) earns full points, absence earns most (the default allowlist is 'self'), tools=() earns none because it disables WebMCP. C5 HSTS with a max-age of at least 180 days.
D. AI discoverability (20)
D1 Schema.org JSON-LD (microdata earns 4/5). D2 /llms.txt starting with an H1. D3 a meta description of 50–160 characters. D4 og:title, og:description, og:type, og:url, og:image. D5 robots.txt does not block search and user-initiated AI agents (blocking training crawlers costs very little: that is a legitimate choice).
Observations
How the page was observed (native WebMCP, recording stand-in, or static HTML only), registration timing (tools registered after the load event), and the /.well-known/webmcp manifest — a community convention that is not part of the W3C draft and therefore earns no points.