{
  "automatic_evidence_credit": false,
  "captures": [],
  "change_log": [
    {
      "after_hash": "c9ca09c880ef7948ca4471072d971b35b3f030ab4f5111f096a889dc5cc891c7",
      "before_hash": "3f517bf6852eb441d8aaa117ea0820456c2f59a9ed673eda5cc455810d00977f",
      "diff": {
        "changes": [
          {
            "compatibility_class": "NON_BREAKING",
            "fact": "tool added",
            "kind": "TOOL_ADDED",
            "path": "tools[scan_local_code]",
            "security_relevant_field": false
          },
          {
            "compatibility_class": "BREAKING",
            "fact": "input additional properties restricted",
            "kind": "INPUT_ADDITIONAL_PROPERTIES_RESTRICTED",
            "path": "tools[check_ai_visibility].inputSchema.additionalProperties",
            "security_relevant_field": false
          },
          {
            "compatibility_class": "BREAKING",
            "fact": "input additional properties restricted",
            "kind": "INPUT_ADDITIONAL_PROPERTIES_RESTRICTED",
            "path": "tools[check_email_security].inputSchema.additionalProperties",
            "security_relevant_field": false
          },
          {
            "compatibility_class": "BREAKING",
            "fact": "input additional properties restricted",
            "kind": "INPUT_ADDITIONAL_PROPERTIES_RESTRICTED",
            "path": "tools[check_exposed_files].inputSchema.additionalProperties",
            "security_relevant_field": false
          },
          {
            "compatibility_class": "BREAKING",
            "fact": "input additional properties restricted",
            "kind": "INPUT_ADDITIONAL_PROPERTIES_RESTRICTED",
            "path": "tools[check_security_headers].inputSchema.additionalProperties",
            "security_relevant_field": false
          },
          {
            "compatibility_class": "BREAKING",
            "fact": "input additional properties restricted",
            "kind": "INPUT_ADDITIONAL_PROPERTIES_RESTRICTED",
            "path": "tools[check_seo].inputSchema.additionalProperties",
            "security_relevant_field": false
          },
          {
            "compatibility_class": "BREAKING",
            "fact": "input additional properties restricted",
            "kind": "INPUT_ADDITIONAL_PROPERTIES_RESTRICTED",
            "path": "tools[check_ssl].inputSchema.additionalProperties",
            "security_relevant_field": false
          },
          {
            "compatibility_class": "INFO",
            "fact": "tool description changed",
            "kind": "TOOL_DESCRIPTION_CHANGED",
            "path": "tools[scan_website].description",
            "security_relevant_field": false
          },
          {
            "compatibility_class": "BREAKING",
            "fact": "input additional properties restricted",
            "kind": "INPUT_ADDITIONAL_PROPERTIES_RESTRICTED",
            "path": "tools[scan_website].inputSchema.additionalProperties",
            "security_relevant_field": false
          }
        ],
        "classified": true,
        "counts_by_class": {
          "BREAKING": 7,
          "INFO": 1,
          "NON_BREAKING": 1
        },
        "taxonomy_version": "1.0.0",
        "total": 9,
        "truncated": false
      },
      "entry_sha256": "28fa7eb5a43a4898e4a1ca1547a44cbd3da5e2f622637f181e1c219c46311d88",
      "evidence_class": "MANIFEST_CHANGE",
      "labels": [
        "MANIFEST_CHANGED",
        "TOOL_LIST_OR_TOOL_TEXT_CHANGED"
      ],
      "observed_at_utc": "2026-10-19T01:04:35Z",
      "previous_entry_sha256": "5dafc95ad0328cacc2bba9b7bff654e4eaa80f9bbc2b87e7ba9e8f3fd48cab22",
      "receipt_id": "7fd08ec3-0314-5ae5-a202-2b3d8bf314ba",
      "receipt_url": "https://www.gaipagents.com/v1/free/receipts/7fd08ec3-0314-5ae5-a202-2b3d8bf314ba",
      "sequence": 36861,
      "target_id": "obs_92c72415120804597e82f127",
      "target_kind": "MCP_REMOTE",
      "target_locator": "https://api.simplyscan.io/mcp"
    }
  ],
  "check_outcomes": {
    "ask": {
      "changed_since": "https://www.gaipagents.com/v1/free/observatory/changed-since?url=<endpoint>",
      "changes_and_reachability": "https://www.gaipagents.com/v1/free/changes/subscribe?url=<endpoint>",
      "conformance": "https://www.gaipagents.com/v1/free/conformance/check?url=<endpoint>"
    },
    "published": false,
    "why": "Outcomes of GAIP's own checks (whether the endpoint answered, HTTP status, response time, conformance findings) are given only to a caller who asks about the URL, never on a public page, list or feed. The same applies to every target."
  },
  "conformance": {
    "findings": "GIVEN_TO_CALLER_ONLY",
    "meaning": "The rule catalogue this manifest was read against at the observed time. The finding codes go only to a caller who checks the URL (check_outcomes.ask.conformance).",
    "observed_at_utc": "2026-10-19T01:04:35Z",
    "protocol": "MCP",
    "rule_catalogue_route": "/v1/free/knowledge/conformance-rules",
    "rule_catalogue_version": "1.0.0"
  },
  "corrections": {
    "contact": "https://www.gaipagents.com/contact",
    "exclusion": "https://www.gaipagents.com/v1/free/observatory/corrections/exclusion",
    "opt_out": "POST kind OPT_OUT to the route; the target is withdrawn from public view at once (a pause). The site's owner makes it permanent at https://www.gaipagents.com/v1/free/observatory/corrections/exclusion.",
    "queued_for_review": 0,
    "route": "https://www.gaipagents.com/v1/free/observatory/corrections"
  },
  "declared_derivations": {
    "data_appetite": {
      "categories": {
        "file_upload": {
          "fields": 1,
          "tools": 1
        },
        "free_text_large": {
          "fields": 1,
          "tools": 1
        }
      },
      "fields_read": 10,
      "observed_at_utc": "2026-10-19T01:04:35Z",
      "tools_read": 8
    },
    "dependency_domains": [],
    "last_observed_at_utc": "2026-10-19T01:04:35Z",
    "meaning": "Derived by GAIP from what this agent declared, at the stated time: the categories of data its tools' input fields ask for (counts, by keyword rules gaip.data-appetite-rules.v1), the outside domains its declarations point to, and the operator as the agent itself publishes it. Facts about declarations, not an assessment of the agent or its operator.",
    "operator": {
      "as_published": "io.simplyscan",
      "source_kind": "registry_namespace_domain"
    },
    "rules_version": "gaip.data-appetite-rules.v1",
    "schema_version": "gaip.declared-derivations.v1"
  },
  "latest": {
    "baseline_at_utc": "2026-10-05T00:28:18Z",
    "manifest_sha256": "c9ca09c880ef7948ca4471072d971b35b3f030ab4f5111f096a889dc5cc891c7",
    "observed_at_utc": "2026-10-19T01:04:35Z"
  },
  "metadata_signals": {
    "meaning": "Pattern rules are published only as aggregate rates across all observed targets (see the summary), never per party. GAIP issues no overall verdict and does not rank parties.",
    "overall_verdict": null,
    "per_target_results": null,
    "published": "AGGREGATE_ONLY_IN_SUMMARY",
    "rules": [
      {
        "rationale": "Zero-width, bidirectional-control and Unicode tag characters are not visible to a human reader but are read by language models. GAIP reports whether any occur; many have ordinary uses.",
        "rule_id": "OBS-SIG-001",
        "title": "Invisible or bidirectional-control Unicode characters in names or descriptions"
      },
      {
        "rationale": "Tool and skill descriptions are read by models. GAIP reports whether a description contains phrases shaped like instructions to a model (the patterns in GAIP's public conformance rule catalogue, plus the phrases listed in the Observatory method). Such phrases can be benign.",
        "rule_id": "OBS-SIG-002",
        "title": "Instruction-like text in descriptions"
      },
      {
        "rationale": "When a description refers to a tool name that only a different observed server publishes, a model using both servers may connect the two. GAIP reports whether such a reference occurs; shared names are common and often coincidental.",
        "rule_id": "OBS-SIG-003",
        "title": "Description names a tool published by a different observed server"
      },
      {
        "rationale": "Declared OAuth scopes whose names contain wildcard or whole-account wording (*, all, admin, root, full) request wide access by name. GAIP reports whether such a scope name is declared; it does not know what the scope grants.",
        "rule_id": "OBS-SIG-004",
        "title": "Declared authorization scopes with broad-access wording"
      }
    ],
    "third_party_scanners": [
      {
        "name": "Snyk agent-scan (formerly Invariant Labs mcp-scan)",
        "status": "NOT_RUN",
        "url": "https://github.com/snyk/agent-scan"
      },
      {
        "name": "Cisco AI Defense MCP Scanner",
        "status": "NOT_RUN",
        "url": "https://github.com/cisco-ai-defense/mcp-scanner"
      }
    ]
  },
  "method": "https://www.gaipagents.com/observatory",
  "notice": "Facts observed by GAIP at the stated time (UTC); they may be out of date. This is not an assessment of safety, quality, security, legality or trustworthiness of any party, and not a recommendation. To request a correction, add a right of reply or opt out, POST to https://www.gaipagents.com/v1/free/observatory/corrections or use https://www.gaipagents.com/contact.",
  "price_gbp": 0,
  "schema_version": "gaip.observatory.v1.target",
  "silent_changes_last_30_days": {
    "days": 30,
    "entries_read_at_most": 200,
    "kinds": [
      "behaviour_labels_changed",
      "input_or_output_format_changed",
      "tool_descriptions_reworded",
      "tools_added"
    ],
    "line": "In the last 30 days its declared tools or interface changed with no declared version change in 1 week: 2026-W43 (2026-10-19); kinds: behaviour labels changed, input or output schema changed, tool descriptions re-worded, tools added.",
    "meaning": "Weeks (ISO) in which GAIP recorded a change to the agent's declared tools or interface (tools added or removed, descriptions re-worded, input or output schema, behaviour labels, sign-in, terms or prices, endpoint host) and no declared version (registry or card version, serverInfo.version) moved that week. A week whose version movement is not recorded is not counted. Dated facts from the public change log; not an assessment of the agent.",
    "weeks": [
      {
        "dates": [
          "2026-10-19"
        ],
        "kinds": [
          "behaviour_labels_changed",
          "input_or_output_format_changed",
          "tool_descriptions_reworded",
          "tools_added"
        ],
        "week": "2026-W43"
      }
    ],
    "weeks_with_silent_changes": 1
  },
  "snapshot": {
    "capabilities": [
      "tools"
    ],
    "description": "Security, SEO and AI-visibility scanner for web apps \u00b7 free scans and focused checks via MCP.",
    "name": "io.simplyscan/simplyscan",
    "parts": [
      "registry_server_json",
      "mcp_initialize_tools_list"
    ],
    "protocol": "MCP",
    "protocolVersion": "2025-11-25",
    "public_copy": "Text excerpts of at most 300 characters; input schemas and security schemes as SHA-256 and size only.",
    "remotes": [
      {
        "type": "streamable-http",
        "url": "https://api.simplyscan.io/mcp"
      }
    ],
    "scopes": [],
    "serverInfo": {
      "name": "simplyscan",
      "version": "1.0.0"
    },
    "title": "SimplyScan",
    "tools": [
      {
        "annotations": {
          "openWorldHint": true,
          "readOnlyHint": true
        },
        "description": "AEO check: whether AI answer engines (ChatGPT/GPTBot, Claude, Perplexity, Google-Extended, etc.) can crawl and cite the site, plus llms.txt and structured-data signals.",
        "inputSchema": {
          "bytes": 216,
          "published": "HASH_ONLY",
          "sha256": "8b47a3c89a7de380f2f3a39b4054012bb817db434e9647b88382ce7bef81372f"
        },
        "name": "check_ai_visibility",
        "title": "Check AI visibility (AEO)"
      },
      {
        "annotations": {
          "openWorldHint": true,
          "readOnlyHint": true
        },
        "description": "Check a domain's email authentication: SPF, DKIM (common selectors), and DMARC policy. Flags spoofable domains.",
        "inputSchema": {
          "bytes": 222,
          "published": "HASH_ONLY",
          "sha256": "63e2439116bb9c0b67d28d8284ba945ef055bcb31bc46fe9da69326a5be98c61"
        },
        "name": "check_email_security",
        "title": "Check email security (SPF/DKIM/DMARC)"
      },
      {
        "annotations": {
          "openWorldHint": true,
          "readOnlyHint": true
        },
        "description": "Probe a site for accidentally exposed high-risk files (.env, .git/config, backups, etc.). Reports HTTP status only, never file contents.",
        "inputSchema": {
          "bytes": 216,
          "published": "HASH_ONLY",
          "sha256": "8b47a3c89a7de380f2f3a39b4054012bb817db434e9647b88382ce7bef81372f"
        },
        "name": "check_exposed_files",
        "title": "Check for exposed files"
      },
      {
        "annotations": {
          "openWorldHint": true,
          "readOnlyHint": true
        },
        "description": "Grade a URL's HTTP security headers (CSP, HSTS, X-Frame-Options, Referrer-Policy, Permissions-Policy, COOP, COEP) A-F.",
        "inputSchema": {
          "bytes": 216,
          "published": "HASH_ONLY",
          "sha256": "8b47a3c89a7de380f2f3a39b4054012bb817db434e9647b88382ce7bef81372f"
        },
        "name": "check_security_headers",
        "title": "Check security headers"
      },
      {
        "annotations": {
          "openWorldHint": true,
          "readOnlyHint": true
        },
        "description": "On-page SEO audit of a URL: title, meta description, H1, canonical, indexability, Open Graph, structured data, image alt coverage, sitemap. Returns an A-F grade.",
        "inputSchema": {
          "bytes": 216,
          "published": "HASH_ONLY",
          "sha256": "8b47a3c89a7de380f2f3a39b4054012bb817db434e9647b88382ce7bef81372f"
        },
        "name": "check_seo",
        "title": "Check on-page SEO"
      },
      {
        "annotations": {
          "openWorldHint": true,
          "readOnlyHint": true
        },
        "description": "Inspect a domain's SSL/TLS certificate: issuer, expiry, protocol, and flags for expiring/self-signed/mismatched certs.",
        "inputSchema": {
          "bytes": 222,
          "published": "HASH_ONLY",
          "sha256": "63e2439116bb9c0b67d28d8284ba945ef055bcb31bc46fe9da69326a5be98c61"
        },
        "name": "check_ssl",
        "title": "Check SSL/TLS certificate"
      },
      {
        "annotations": {
          "openWorldHint": false,
          "readOnlyHint": false
        },
        "description": "Send selected editor file contents to the SimplyScan Security Engine's deterministic repository rules. Requires a Pro API key. Source leaves the editor, is processed in memory, and is not retained; masked findings are saved in the private scan record. No AI provider receives these files. Code rules ",
        "inputSchema": {
          "bytes": 350,
          "published": "HASH_ONLY",
          "sha256": "5c6114057aae9eaead8fe36183048256eb77e05f584b54b81adcdb2d19631305"
        },
        "name": "scan_local_code",
        "title": "Scan local code"
      },
      {
        "annotations": {
          "openWorldHint": true,
          "readOnlyHint": false
        },
        "description": "Run a SimplyScan Security Engine security & speed scan (Pro with an entitled API key; otherwise free) of a deployed web app URL. Returns a 0-100 score and findings (exposed secrets, missing Supabase RLS, frontend leaks, speed issues). Best for apps built with Lovable, Bolt, v0, Cursor, Replit, etc.",
        "inputSchema": {
          "bytes": 216,
          "published": "HASH_ONLY",
          "sha256": "8b47a3c89a7de380f2f3a39b4054012bb817db434e9647b88382ce7bef81372f"
        },
        "name": "scan_website",
        "title": "Scan website"
      }
    ],
    "version": "1.0.0"
  },
  "status_history": [
    {
      "manifest_partial": null,
      "manifest_parts": [
        "registry_server_json",
        "mcp_initialize_tools_list"
      ],
      "manifest_sha256": "c9ca09c880ef7948ca4471072d971b35b3f030ab4f5111f096a889dc5cc891c7",
      "observed_at_utc": "2026-10-19T01:04:35Z",
      "protocol_version": "2025-11-25"
    },
    {
      "manifest_partial": false,
      "manifest_parts": [
        "registry_server_json",
        "mcp_initialize_tools_list"
      ],
      "manifest_sha256": "3f517bf6852eb441d8aaa117ea0820456c2f59a9ed673eda5cc455810d00977f",
      "observed_at_utc": "2026-10-11T13:55:58Z",
      "protocol_version": "2025-11-25"
    },
    {
      "manifest_partial": null,
      "manifest_parts": [
        "registry_server_json",
        "mcp_initialize_tools_list"
      ],
      "manifest_sha256": "3f517bf6852eb441d8aaa117ea0820456c2f59a9ed673eda5cc455810d00977f",
      "observed_at_utc": "2026-10-05T00:28:18Z",
      "protocol_version": "2025-11-25"
    }
  ],
  "target": {
    "corrections_route": "https://www.gaipagents.com/v1/free/observatory/corrections",
    "first_seen_at_utc": "2026-10-04T05:10:48Z",
    "kind": "MCP_REMOTE",
    "last_observed_at_utc": "2026-10-19T01:04:35Z",
    "locator": "https://api.simplyscan.io/mcp",
    "name": "io.simplyscan/simplyscan",
    "source": "official-mcp-registry",
    "target_id": "obs_92c72415120804597e82f127"
  }
}