{
 "tool": "agent-ready-mcp",
 "version": "0.1.0",
 "bench_date": "2026-10-25",
 "bench_version": "0.1.0",
 "environment": "local",
 "qualifier": "local",
 "verdict": "CERTIFIED(local)",
 "checks": [
  {
   "id": "A1",
   "name": "determinism: same fixture -> same score/grade/checks",
   "verdict": "pass",
   "evidence": "store fixture audited twice via stdio: identical score 88 grade B and 8 check statuses (audited_in_s excluded)"
  },
  {
   "id": "A2",
   "name": "score + grade recomputed from checks, not trusted",
   "verdict": "pass",
   "evidence": "store score 88 grade B and bare score 28 grade F both recomputed exactly from list_checks weights (pass=full, warn=half, fail=0)"
  },
  {
   "id": "A3",
   "name": "complete store outscores bare fixture",
   "verdict": "pass",
   "evidence": "store fixture 88 > bare fixture 28 (same direction as own smoke: commerce outscores control)"
  },
  {
   "id": "A4",
   "name": "evidence is observation-only (lure text never cited)",
   "verdict": "pass",
   "evidence": "evidence cites observed JSON-LD product 'Bench Widget', fixture MCP serverInfo 'bench-store-mcp', and HTTP 200s; lure text ($999/sold out) appears nowhere in the audit"
  },
  {
   "id": "A5",
   "name": "no credentialed surface: request log is public-only",
   "verdict": "pass",
   "evidence": "fixture request log across both audits: 20 requests, zero Authorization/Cookie headers, zero login/checkout/cart/account paths, POST only to MCP initialize candidates"
  },
  {
   "id": "A6",
   "name": "parallel probes: concurrent audits match sequential",
   "verdict": "pass",
   "evidence": "concurrent audits (separate stdio clients, interleaved) return exactly the sequential results for both fixtures"
  },
  {
   "id": "A7",
   "name": "list_checks catalog: 8 checks, weights sum 100",
   "verdict": "pass",
   "evidence": "list_checks returns exactly the 8 documented checks in order, total_weight 100"
  },
  {
   "id": "U1",
   "name": "auth enforced",
   "verdict": "na",
   "evidence": "local stdio transport: no credential layer exists to test; product takes no credentials by design (public-surface audit only)"
  },
  {
   "id": "U2",
   "name": "schema valid",
   "verdict": "pass",
   "evidence": "tools/list returns exactly audit_storefront + list_checks, each with inputSchema type object + properties + required"
  },
  {
   "id": "U3",
   "name": "no unscoped network surface",
   "verdict": "pass",
   "evidence": "single network call site: urllib urlopen inside fetch() only; no requests/socket/http.client elsewhere; fixture log (A5) proves requests stay on the supplied origin's public paths"
  },
  {
   "id": "U4",
   "name": "no secret leak",
   "verdict": "pass",
   "evidence": "no secret patterns in 5 tool outputs"
  },
  {
   "id": "U5",
   "name": "sane errors",
   "verdict": "pass",
   "evidence": "empty url -> error; unreachable host -> error (ToolError, server survives); unknown tool -> error; list_checks still answers; unknown method -> -32601"
  },
  {
   "id": "U6",
   "name": "process health",
   "verdict": "pass",
   "evidence": "initialize answered in 145 ms; ping ok"
  },
  {
   "id": "U8",
   "name": "bench isolation",
   "verdict": "pass",
   "evidence": "workspace product state byte-identical before/after bench"
  }
 ],
 "notes": [
  "Bench audits run ONLY against bench-owned localhost fixtures; live-storefront grades from the product's own smoke (gymshark / woocommerce / thewhitereport, results/*.json, 2026-10-24) are reported, not re-graded \u2014 live pages drift.",
  "Public-surface audit only by design: authenticated checkout is out of scope and is NOT tested, not implied."
 ],
 "history": "append-only; prior runs retained in results/"
}