WordLift AI Audit

The machine reads the website. The human knows the business. ChatGPT compiles both into a governed service map.

WordLift AI Audit turns a public website into an evidence-backed service map for AI agents. It reads representative pages, classifies the business, extracts domain entities and vocabulary, compiles the actions an agent should be able to perform, and verifies which machine interfaces actually work.

But the machine output is deliberately a draft. Pages cannot prove every operating role, important entity, business term, or responsibility boundary. ChatGPT therefore interviews the human and compiles that judgment into a new immutable, human-refined service map.

The problem

Websites were designed as pages for people. Agents need explicit knowledge about the things a business offers, the functions they may call, the boundaries around those functions, and evidence that the interfaces really work.

Most AI-readiness scanners stop at crawlability, metadata, or declarations. They cannot answer:

Which action applies to which entity?
Can people perform it today?
Can an agent perform it?
Who owns the action: the organization, a partner, or nobody?
What evidence proves the conclusion?
What governed contract would close the gap?

What WordLift AI Audit does

Analyzes up to four representative pages rather than only the homepage.
Preserves the complete bounded WordLift foundation audit behind progressive disclosure.
Classifies the site as commerce, publishing, travel, finance, SaaS, or a conservative fallback.
Builds the Context Engine:
- domain graph — organizations, products, services, places, articles, offers, and provenance;
- lexical graph — categories, names, terminology, meanings, and aliases;
- action layer — expected actions, entity bindings, interfaces, boundaries, evidence, and contracts.
Separates human-facing support from agent-facing declarations and successful invocation.
Produces a machine-generated service-map draft with three priority gaps.
Lets ChatGPT inspect that draft and interview the human about the business role, primary entities, terminology, and every expected action boundary.
Compiles the human decisions into an immutable child report without altering the original evidence or allowing a human assertion to mark an action agent-ready.

Why WebMCP is essential

WebMCP is not an accessory to the interface; it is the collaboration protocol.

The application exposes six generic tools:

audit-website starts an audit of any safe public URL.
get-audit-report follows a long-running audit through progress to completion.
inspect-service-map gives ChatGPT the full machine review brief.
explain-capability retrieves deeper evidence and the governed contract for one action.
explain-foundation-audit returns the complete safe WordLift foundation audit.
refine-service-map submits typed human judgments and returns the immutable refined report.

The tool descriptions encode the intended protocol:

audit → inspect → interview → explain where unclear → refine

This creates a form of human–agent collaboration that was difficult before WebMCP. The machine contributes observation and inference. The human contributes business meaning and responsibility. ChatGPT mediates the conversation and turns both into structured symbolic commitments.

Honest readiness

A declaration earns zero readiness points. Structured data, OpenAPI, MCP, WebMCP, and other declarations remain unverified until the relevant interface is invoked successfully. Human decisions can change applicability, vocabulary, entity priority, and governance boundaries, but never evidence-based readiness.

The report therefore keeps two scores separate:

WordLift foundation readiness;
verified agent action readiness.

Example

A tourism website may contain booking forms, accommodation pages, and hotel links. The machine can infer that availability matters, but it cannot safely conclude that the destination organization owns hotel inventory.

The human can tell ChatGPT that the organization owns discovery and recommendations while availability is a partner handoff. The refined report then promotes the correct organization and destination entities, clarifies the terminology, changes the action boundary, updates the entity–action bindings and contract, records the rationale as human-provided provenance, and preserves the original machine draft for comparison.

Implementation

The application is a React 19, TypeScript, Vite, Express, and Node 22 service deployed on Google Cloud Run with immutable Firestore report revisions. It uses Zod contracts, a deterministic versioned action compiler, JSON-LD, Schema.org, Google Natural Language classification, and the WordLift AI Audit provider.

Tools register on the top-level report document through the WebMCP imperative API on document.modelContext, with a compatibility alias for Chrome's current preview surface. Report-scoped tools register as soon as the route loads, before the report has finished rendering.

Security controls include SSRF protection, DNS and redirect validation, response limits, sanitized evidence, rate limiting, bounded storage, server-only credentials, and truthful partial or failed states.

New work created during the challenge

The private WordLift AI Audit existed before August 25. The following public implementation was created during The WebMCP Challenge:

a new open-source deployable application;
the versioned six-archetype action compiler;
multi-page context extraction and provenance;
domain, lexical, interface, and entity–action schemas;
verification-only readiness and safe invocation probes;
six generic WebMCP tools;
the inspect/interview/refine collaboration protocol;
typed human assertions and immutable refined reports;
the Context Engine and capability-map interface;
deterministic fixtures, security boundaries, and the complete test suite.

The challenge contribution is not a wrapper around the previous product. It is the new public context compiler and human-guided WebMCP experience.

Testing

The current release passed strict TypeScript checks, 323 unit/integration/component tests, the production build, and 12 Playwright browser scenarios. The browser suite includes the full Cyborg journey: audit, inspect, refine, open the immutable child, verify embodied human judgment, and confirm the original machine draft remains unchanged.

No account is required.

Live application: https://beta.audit.wordlift.io