Release notes, 14 October 2026

Summary

We re-read the specification behind every technology we check, and six checks turned out stricter than their source, flagging sites that had done nothing wrong. They are fixed in the scanner and in the command-line tool from version 0.3.5. Scan again to see the corrected results.

We also check three more technologies, 29 in all, each measured against every published file we could find before it shipped. We ran the new rules over our own site before release. It came back with no faults.

New checks

• RSL: the License line in robots.txt and the licence it points to. We check that the address is complete, that the licence is there, and that each part of the site it names has a licence.
• Personal Agent Protocol: the poppy.json file that lets a customer's own agent sign in to a business, and the sign-in server it names. All 27 files published so far pass.
• Agentic Resource Discovery: the file that lists a site's agents, tools and APIs, which Google's Lighthouse now audits. We check each entry has the name, type and identifier the specification requires.

Fixed

• A2A agent cards: a gRPC interface written as a host and port is accepted, as A2A's own correction specifies.
• A2A agent cards: a card built to version 0.3 is no longer failed for an empty list, such as a skill with no tags. That rule arrived in A2A 1.0, and the 0.3 schema sets no minimum.
• Canonical links: one carrying hreflang, lang, media or type no longer counts as a conflict. Google does not use them for canonicalization.
• Markdown versions: a Link: <> header, which means the page itself, is no longer read as empty. Only an empty link in the page's HTML is flagged, as the HTML standard requires.
• TDMRep: a policy link that is not a full web address is now a recommendation, not a breach. The specification asks only for a URL.
• Any file: a rate limit or a bot wall is now "not checked", not "not published". A sitemap robots.txt points to is never reported missing because we were turned away.
• Content Signals: a signal above the first User-agent group is now medium-severity advice. Cloudflare only shows it inside a group, but never says it is ignored elsewhere.

Changed in the standards

• MCP server cards are final (6 October). Our advice now names the format's own field for how to connect.
• WebMCP's declarative form left the W3C draft (8 October). Chrome's documentation is now its only source. No results change.
• Web Bot Auth: the draft's editors now allow a key's alg in its JSON Web Key spelling, such as EdDSA (9 October). We accept it. A name that fits the key in neither spelling is still flagged, now as low severity.

Not shipped

We tested three possible new checks against real sites and held them back. Two would find nothing yet, and one rule is too new to judge fairly. Every check, its source and the date we last read it are in our documentation.