About our OAuth probe

If you found a client named mardisom-webscore-probe registered on your OAuth authorization server, this page explains exactly what it is, why it exists, and how to make us stop. We sell honest measurement, so we hold our own auditing to the same standard we ask of everyone else.

What WebScore does

WebScore audits how ready a website is for AI agents. Part of that is verifying that a declared OAuth authorization server actually authenticates — many sites publish OAuth metadata whose token endpoint hands out tokens to anyone, which is decorative security, not real access control. Detecting that is one of the things we exist to do.

Exactly what we do to your server

First, we only read. We send one client_credentials request with invented credentials. A correct server rejects it. If your server instead issues a token to made-up credentials, we stop right there and report your OAuth as decorative — we register nothing.
Only if your server behaves correctly (i.e. it rejected the invented credentials) do we consider a real test. We then register a single, clearly labelled probe client via your dynamic registration endpoint (RFC 7591) and request one token, to confirm your server can actually issue one. The client name is alwaysmardisom-webscore-probe (https://webscore.mardisom.com/about-probe).
We do this at most once every 7 days per domain, even if the site is scanned more often.

What we never do

We never call any protected tool or endpoint on your site. We only confirm that a token can be obtained — we never use it to do anything.
We never register anything on a server that failed the read-only test above.
We never hide who we are: the probe client is named and links back to this page.

Opt out

If you do not want us to register a probe client on your authorization server, emailinfo@mardisom.com with your domain. We will add it to our exclusion list. After that, when your site is scanned we will still report whether your OAuth rejects invalid credentials (that test writes nothing), but we will mark the token-issuance check as skipped and register nothing — we will not invent a verdict about a capability we chose not to test.

You can also make the probe unnecessary on your side: a probe client we register is a standard dynamically-registered client and you may revoke it at any time.