Probe Report — octomil.com

octomil.com F · 44/100

18 passed 20 warnings 6 failed audit-mnpyx1gw

✓ Voice AI✓ x402 / Crypto✓ MCP

SSL / TLS Valid HTTPS · 158ms

x402 discovery /.well-known/x402.json (non-JSON) · 160ms

Agent discovery /.well-known/agent.json returns 200 but not valid JSON · 159ms

llms.txt structured · API info · 1390 chars · 201ms

security.txt Found · 201ms

CORS headers origin: * (open — OK for public APIs) · 171ms

Security headers 2/5 — missing critical: strict-transport-security, content-security-policy · 171ms

Response time 148ms avg · 148ms

MCP server /mcp returns 200 (not JSON) · 175ms

API endpoints 2 endpoints found

Error handling Returns 200 for unknown paths · 186ms

x402 compliance No x402 payment gates found · 185ms

Rate limiting No rate-limit headers (may still be rate-limited server-side) · 186ms

Documentation /docs found · 201ms

robots.txt AI crawlers 4 AI crawlers configured: GPTBot, ClaudeBot, Google-Extended, Bytespider · 252ms

AI plugin manifest /.well-known/ai-plugin.json not valid JSON · 201ms

OpenAPI spec /openapi.json found but invalid JSON · 203ms

Privacy / GDPR /privacy found (22183 chars) · 249ms

Status / Health /status found · 215ms

EU AI Act disclosure /.well-known/model-card.json found (20596 chars) · 215ms

Travel Rule (FATF) /.well-known/travel-rule.json found (non-JSON, 20596 chars) · 217ms

A2A Protocol (Google) agent.json found but invalid JSON · 218ms

DNSSEC DNSSEC check failed

CAA Records No CAA records — any CA can issue certificates

DMARC / SPF No DMARC or SPF records found

Auth maturity No authentication detected — open API or check failed

API versioning /v1

Human oversight /agent/stop — active (EU AI Act Art. 14) · 250ms

Content-Type No application/json responses (1 paths tested)

OASF Classification /.well-known/oasf.json exists · 264ms

MCP Transport Security /mcp active · CORS · 266ms

Voice AI Disclosure /.well-known/voice-agent.json found but not valid JSON · 268ms

Synthetic Voice Labeling No synthetic voice labeling declaration found (EU AI Act Article 50)

Synthetic Content Labeling No machine-readable synthetic content label (EU AI Act Article 50 requires marking AI-generated audio)

Emotion Recognition Declaration No emotion recognition declaration (EU AI Act requires explicit opt-in/out)

Call Recording Consent No call recording disclosure or consent mechanism found (required in two-party consent states & GDPR)

FCC/TCPA Compliance No FCC/TCPA compliance declaration (required for US voice AI calls)

Operator Identity & KYB No operator identity or KYB status declared

Opt-out & Human Escalation Partial: opt-out found in /.well-known/voice-agent.json · 291ms

Voice Call Policy No voice call policy (calling hours, frequency limits, recording disclosure)

Caller Identity Declaration No caller identity declaration (who is calling, is it AI, callback number)

Wallet trust No wallet address found in x402 or agent.json

ERC-8004 on-chain No EVM wallet found to verify on-chain registration

26 issues to fix

Critical — 6

Synthetic Voice Labeling failed

No synthetic voice labeling declaration found (EU AI Act Article 50)

Call Recording Consent failed

No call recording disclosure or consent mechanism found (required in two-party consent states & GDPR)

FCC/TCPA Compliance failed

No FCC/TCPA compliance declaration (required for US voice AI calls)

Operator Identity & KYB failed

No operator identity or KYB status declared

Voice Call Policy failed

No voice call policy (calling hours, frequency limits, recording disclosure)

Caller Identity Declaration failed

No caller identity declaration (who is calling, is it AI, callback number)

Warning — 20

Agent discovery needs attention

/.well-known/agent.json returns 200 but not valid JSON

Security headers needs attention

2/5 — missing critical: strict-transport-security, content-security-policy

Error handling needs attention

Returns 200 for unknown paths

x402 compliance needs attention

No x402 payment gates found

Rate limiting needs attention

No rate-limit headers (may still be rate-limited server-side)

AI plugin manifest needs attention

/.well-known/ai-plugin.json not valid JSON

OpenAPI spec needs attention

/openapi.json found but invalid JSON

Travel Rule (FATF) needs attention

/.well-known/travel-rule.json found (non-JSON, 20596 chars)

A2A Protocol (Google) needs attention

agent.json found but invalid JSON

DNSSEC needs attention

DNSSEC check failed

CAA Records needs attention

No CAA records — any CA can issue certificates

DMARC / SPF needs attention

No DMARC or SPF records found

Auth maturity needs attention

No authentication detected — open API or check failed

Content-Type needs attention

No application/json responses (1 paths tested)

Voice AI Disclosure needs attention

/.well-known/voice-agent.json found but not valid JSON

Synthetic Content Labeling needs attention

No machine-readable synthetic content label (EU AI Act Article 50 requires marking AI-generated audio)

Emotion Recognition Declaration needs attention

No emotion recognition declaration (EU AI Act requires explicit opt-in/out)

Opt-out & Human Escalation needs attention

Partial: opt-out found in /.well-known/voice-agent.json

Wallet trust needs attention

No wallet address found in x402 or agent.json

ERC-8004 on-chain needs attention

No EVM wallet found to verify on-chain registration

🔧 Fix 6 failing checks automatically

Probe Autofix connects to your GitHub repo and creates a PR with all the fixes. DNS fixes are applied directly via Cloudflare API. No manual coding needed.

⚡ Autofix — Free GitHub PR + DNS fixes included

Share on X Run new audit

🔒 Probe trust badge — unlock at score 60+

Fix your failing checks to earn the Probe verified badge. Display it on your site footer and README to show compliance.

⚡ Autofix — Free Current score: 44/100 → need 60+

2026-04-08 11:31:46 UTC · getprobe.xyz