Correios

The page registers no tools via the WebMCP browser API (navigator.modelContext).

Fix: Expose your actions to AI agents with the WebMCP browser API: register tools via navigator.modelContext.registerTool. Optionally also publish a /.well-known/webmcp.json tool catalog as a discovery signpost.

Crawled 12 of 12 discovered pages beyond the homepage.

Could not identify a known website platform (custom stack or unrecognised).

Homepage ignored Accept: text/markdown and returned HTML.

Fix: Serve a markdown version of high-value pages when the client asks for text/markdown. AI summarisers, chatbots and IDE agents prefer markdown — fewer tokens, no DOM noise.

Detected 1 heading level skip (e.g. h1 → h3).

Fix: Tighten the heading order so each level only steps down by one. Skipped levels confuse both screen-readers and AI structural extractors.

116 of 119 images have alt attributes (97%).

Fix: Add alt text to the remaining images. Empty alt="" is fine for purely-decorative graphics.

Only 0/119 images have width+height — large CLS risk.

Fix: Set width and height on every <img> so the browser reserves space before the image loads. A layout that shifts while loading makes an AI agent mis-click the element it targeted.

Only 0 internal links on the homepage.

Fix: Add at least 5-10 internal links pointing to your top product, pricing, docs, blog and about pages so an AI agent can navigate to them from the homepage.

Missing landmark elements: main.

Homepage server response contains 1308 words of visible text — content is reachable without executing JavaScript.

Detected 4 cookie-banner elements but none look agent-hostile (small, dismissible, or offer a reject option).

Homepage contains ~1078 elements.

Language declared as "pt-br".

Exactly one <h1> on the homepage.

All 12 reachable key pages have both a <title> and <h1>.

All 12 pages return ≥80 words of visible text without JavaScript.

The page registers no tools via the navigator.modelContext browser API, so an AI agent has no structured way to operate it.

Fix: Expose your site’s actions to AI agents with the WebMCP browser API: call navigator.modelContext.registerTool({ name, description, inputSchema, execute }) from your page so an agent can invoke them. Implement it directly, or with a library like the @mcp-b polyfill (https://mcp-b.ai). Spec: https://github.com/webmachinelearning/webmcp.

9 of 9 visible interactive form fields have labels.

No tool catalog was found at /.well-known/webmcp.json (or /.well-known/webmcp). The catalog is a community convention, not part of the WebMCP standard, so this does not affect WebMCP presence.

Fix: Consider also publishing a tool catalog at /.well-known/webmcp.json: a JSON document with a "spec" of "webmcp/0.1" and a "tools" array, where each tool declares a name and a clear description. It is a community convention (optional, not part of the WebMCP standard) that lets crawlers and agents discover your tools without executing JavaScript.

Found 3 http:// references in the homepage HTML — browsers will block these resources.

Fix: Update every http:// resource URL to https:// (or use protocol-relative `//`). Common offenders: image CDNs and legacy embed snippets.

/.well-known/oauth-authorization-server returned the site's HTML app shell — treating as not published.

Fix: Publish /.well-known/oauth-authorization-server so AI agents discovering your OAuth setup can negotiate flows automatically. Required if your site offers an authenticated API.

/.well-known/oauth-protected-resource returned the site's HTML app shell — treating as not published.

Fix: Publish /.well-known/oauth-protected-resource so AI agents discovering your OAuth setup can negotiate flows automatically. Required if your site offers an authenticated API.

No Web Bot Auth signature headers — sites can't verify agent identity.

Fix: Web Bot Auth (IETF HTTP Message Signatures over Signature / Signature-Input) lets you cryptographically verify which agent is hitting you. Several CDNs offer turn-key support; otherwise skip until vendor support matures.

No Content-Security-Policy header on the homepage.

Fix: Add a Content-Security-Policy. Even a strict default-src directive cuts XSS blast radius dramatically. Start in report-only mode to find violations.

No Referrer-Policy header on the homepage.

Fix: Add `Referrer-Policy: strict-origin-when-cross-origin` so outbound links don't leak full URLs (including query strings) to third parties.

max-age=31536000, includeSubDomains=true, preload=false.

Homepage scheme is https:.

http://correios.com.br → https://www.correios.com.br/ (2 hops).

No stack-trace markers in the first 5KB.

Valid for 66 more days (Sep 25 23:59:59 2026 GMT, issuer: Thawte TLS RSA CA G1).

Server / X-Powered-By headers don't leak product version.

X-Content-Type-Options: nosniff.

X-Frame-Options: SAMEORIGIN, SAMEORIGIN.