Fetch and validate /auth.md [fail]! auth.md response did not match Auth.md v1 agent registration guidance. missing OAuth Protected Resource Metadata discovery guidance; missing OAuth authorization-server metadata guidance; missing agent_verified/user_claimed or claim ceremony guidance.INFOFetch and validate /auth.mdINFOFetch Auth.md-related resource path="/auth.md" statusCode=200 contentType="text/markdown; charset=UTF-8" bytes=1408FAILCompare response Content-Type with expected Auth.md media type actual=true expected=trueFAILCompare Auth.md/OAuth metadata validation result actual=false expected=trueFAILCompare Auth.md content length actual=1309 expected=">= 80 characters"WARNAuth.md validation warning warning="missing agent_verified/user_claimed or claim ceremony guidance"FAILAuth.md validation issue issue="auth.md response did not match Auth.md v1 agent registration guidance. missing OAuth Protected Resource Metadata discovery guidance; missing OAuth authorization-server metadata guidance; missing agent_verified/user_claimed or claim ceremony guidance."FAILauth.md response did not match Auth.md v1 agent registration guidance. missing OAuth Protected Resource Metadata discovery guidance; missing OAuth authorization-server metadata guidance; missing agent_verified/user_claimed or claim ceremony guidance.Validate protected resource metadata [fail]! OAuth Protected Resource Metadata could not be fetched.INFOValidate protected resource metadataINFOFetch Auth.md-related resource path="/.well-known/oauth-protected-resource" statusCode=404 contentType="text/html; charset=utf-8" bytes=32108FAILCompare response Content-Type with expected Auth.md media type actual=false expected=trueFAILCompare Auth.md/OAuth metadata validation result actual=false expected=trueFAILAuth.md validation issue issue="OAuth Protected Resource Metadata could not be fetched."FAILOAuth Protected Resource Metadata could not be fetched.Validate Auth.md authorization metadata [fail]! OAuth authorization-server metadata could not be fetched.INFOValidate Auth.md authorization metadataINFOFetch Auth.md-related resource path="/.well-known/oauth-authorization-server" statusCode=404 contentType="text/html; charset=utf-8" bytes=32108FAILCompare response Content-Type with expected Auth.md media type actual=false expected=trueFAILCompare Auth.md/OAuth metadata validation result actual=false expected=trueFAILAuth.md validation issue issue="OAuth authorization-server metadata could not be fetched."FAILOAuth authorization-server metadata could not be fetched.

Check API catalog HEAD Link header [warning]! HEAD /.well-known/api-catalog did not expose a Link header with rel="api-catalog".INFOCheck API catalog HEAD Link headerINFOSend HEAD request to API catalog path attempted=true statusCode=200 contentType="application/linkset+json; charset=utf-8"WARNCompare HEAD Link rel=api-catalog count actual=0 expected="> 0"WARNHEAD /.well-known/api-catalog did not expose a Link header with rel="api-catalog". status="warning"Validate API catalog media type [warning]! The API catalog uses application/linkset+json but does not include the recommended RFC 9727 profile parameter.INFOValidate API catalog media typeWARNCompare API catalog media type actual="application/linkset+json; charset=utf-8" expected="application/linkset+json"WARNCompare RFC 9727 profile parameter actual=false expected=trueWARNThe API catalog uses application/linkset+json but does not include the recommended RFC 9727 profile parameter. status="warning"Validate API catalog targets [fail]! API catalog target https://runframe.io/openapi.json (service-desc) advertised application/vnd.oai.openapi+json;version=3.1 but returned application/json; charset=utf-8.INFOValidate API catalog targetsINFOFetch same-origin API catalog targets and record same-site/external skipsFAILAPI catalog target failed validation rel="service-desc" href="https://runframe.io/openapi.json" statusCode=200 contentType="application/json; charset=utf-8" advertisedType="application/vnd.oai.openapi+json;version=3.1" typeMatches=falsePASSAPI catalog target is reachable rel="service-doc" href="https://runframe.io/docs/api-reference" statusCode=200 contentType="text/html; charset=utf-8" advertisedType="text/html"PASSAPI catalog target is reachable rel="status" href="https://runframe.io/api/health" statusCode=200 contentType="application/json" advertisedType="application/json"FAILCompare API catalog target failure count actual=1 expected=0FAILAPI catalog target https://runframe.io/openapi.json (service-desc) advertised application/vnd.oai.openapi+json;version=3.1 but returned application/json; charset=utf-8.

Evaluate script execution [fail]! script-src allows dangerous script schemes: blob:.INFOEvaluate script executionINFOInspect effective script directive effectiveDirective="script-src" sources=["'self'","'unsafe-inline'","https://clerk.accounts.dev","https://clerk.runframe.io","https://checkout.dodopayments.com","https://*.dodopayments.com","https://challenges.cloudflare.com","https://www.googletagmanager.com","https://static.cloudflareinsights.com","https://us-assets.i.posthog.com","https://client.crisp.chat","blob:"]FAILCompare script execution posture actual={"hasNonce":false,"hasHash":false,"hasStrictDynamic":false,"hasUnsafeInline":true,"hasUnsafeEval":false,"hasWildcardHost":false,"hasBroadScheme":false,"dangerousSchemes":["blob:"]} expected="constrained script sources without unsafe execution allowances" issue="script-src allows dangerous script schemes: blob:."FAILscript-src allows dangerous script schemes: blob:.Review CSP reporting [warning]! CSP does not define a reporting endpoint.INFOReview CSP reportingINFOInspect CSP reporting directives reportOnlyHeaderPresent=true reportOnlyDirectives=["default-src","script-src","style-src","img-src","font-src","connect-src","frame-src","media-src","worker-src","object-src","base-uri","form-action","frame-ancestors","report-uri"]WARNCompare violation reporting configuration actual="no reporting endpoint" expected="report-to or report-uri present" issue="CSP does not define a reporting endpoint."WARNCSP does not define a reporting endpoint.