Reference

The current Passport schema version is 0.5.0. Major sections cover subject and observation identity, protocol surfaces, artifacts, endpoints, self-reported identity, access assertions, bounded inventory groups, capabilities, consistency findings and the semantic fingerprint. 0.5.0 adds an experimental webmcp surface for declarative form tools found in the origin root HTML. Baselines recorded by earlier CLI versions must be regenerated.

Evidence taxonomy

Directly observed

Bounded network or protocol evidence, such as an HTTP response, retrieved document, negotiated MCP version, or listed inventory.

Publisher declared

A semantic statement supplied by publisher metadata. Retrieving the document is observed; the claim inside remains declared.

InterfaceDelta derived

A pure deterministic conclusion such as canonical identity, fingerprint, consistency finding, or compatibility classification.

Not observed / not fetched

A bounded unknown with its reason retained, including unreachable, forbidden, auth-required, payment-required, policy-not-fetched, unsupported, or incomplete evidence.

The taxonomy is provenance, not a trust score. A Passport does not prove ownership, safety, security, legal compliance, active tool correctness, or universal compatibility.

Recorded history

Target history starts at the beginning of your current ownership period, whether held manually or by a watched lockfile. Active and paused subscriptions retain access; ended subscriptions do not. Resubscribing after ownership ends starts a new window. History also includes the single latest observation at or before that start as your baseline, without its comparison or any earlier observation ID. Comparisons after the start withhold references outside the window. Counts and pagination include the baseline. The target creation time is clamped to your window start. Older observations fetched by their own IDs have the same public view as share links: no comparison or monitor state. Operators retain all history. Public share links and the atlas are unchanged.

Exact observation pages and the share API read already-recorded state and trigger no scan, observation write, or monitor mutation. Passport 0.2.0, 0.3.0, 0.4.0, and 0.5.0 records remain faithful to their retained representations. Stored comparisons retain their historical compatibility rule version and are not recomputed on read.

{
  "schemaVersion": "0.5.0",
  "subject": {
    "origin": "https://sample-agent.invalid",
    "hostname": "sample-agent.invalid",
    "scheme": "https",
    "effectivePort": 443,
    "inputUrl": "https://sample-agent.invalid"

{
  "schemaVersion": "0.5.0",
  "subject": {
    "origin": "https://sample-agent.invalid",
    "hostname": "sample-agent.invalid",
    "scheme": "https",
    "effectivePort": 443,
    "inputUrl": "https://sample-agent.invalid"
  },
  "protocols": [
    {
      "protocol": "a2a",
      "status": "valid"
    },
    {
      "protocol": "ard",
      "status": "valid"
    },
    {
      "protocol": "mcp",
      "status": "valid",
      "revision": "2026-07-28"
    },
    {
      "protocol": "mcp-server-card",
      "status": "not_detected"
    },
    {
      "protocol": "openapi",
      "status": "valid",
      "revision": "3.1.2"
    },
    {
      "protocol": "webmcp",
      "status": "observed"
    }
  ],
  "capabilities": [
    {
      "kind": "mcp.tool",
      "protocolKey": "create_order",
      "inventory": {
        "complete": true
      }
    },
    {
      "kind": "openapi.operation",
      "protocolKey": "POST /orders",
      "inventory": {
        "complete": false,
        "truncatedReason": "OPENAPI_SCHEMA_KEYWORD_UNSUPPORTED:pattern"
      }
    },
    {
      "kind": "mcp.tool",
      "protocolKey": "get_order",
      "inventory": {
        "complete": true
      }
    },
    {
      "kind": "mcp.resource",
      "protocolKey": "sample://catalog",
      "inventory": {
        "complete": true
      }
    },
    {
      "kind": "a2a.skill",
      "protocolKey": "research_brief",
      "inventory": {
        "complete": true
      }
    },
    {
      "kind": "mcp.tool",
      "protocolKey": "search_catalog",
      "inventory": {
        "complete": true
      }
    },
    {
      "kind": "webmcp.tool",
      "protocolKey": "request_quote",
      "inventory": {
        "complete": true
      }
    },
    {
      "kind": "mcp.prompt",
      "protocolKey": "brief_template",
      "inventory": {
        "complete": true
      }
    }
  ],
  "fingerprints": {
    "passport": {
      "algorithm": "sha256",
      "canonicalization": "RFC8785",
      "projectionVersion": "passport-semantic-v4",
      "value": "e5c791a920aa6a7fb2556997d700816f58589b78345c1fde667c79b339df4542",
      "complete": false
    }
  }
}

InterfaceDelta observes public ARD discovery documents, A2A Agent Cards, bounded MCP metadata inventories, declared OpenAPI documents, and experimental declarative WebMCP form tools. Protocol-specific evidence is retained while deterministic normalization makes the result comparable as one Passport.

MCP discovery and explicit endpoints

InterfaceDelta does not crawl arbitrary website paths or guess every possible machine interface. Published discovery can lead from a service root to eligible endpoints. A submitted URL whose path is deterministically recognized as MCP, or whose Type is set to MCP endpoint, authorizes an MCP metadata probe only at that exact URL. An ordinary arbitrary URL is never blindly posted to as MCP.

OpenAPI observation

OpenAPI is a machine-readable description of a conventional web API. InterfaceDelta observes JSON or safe YAML OpenAPI 3.1 documents when a valid ARD declaration identifies the artifact or when the user supplies a known document directly. It does not guess Swagger paths, crawl API documentation pages, or call operations described by the document.

The same direct-input model applies to an A2A Agent Card or ARD manifest. Auto recognizes only reviewed path conventions; the explicit Type selector is the restrained escape hatch for a nonstandard endpoint.

Same-origin declarations may use the hardened HTTPS boundary. Cross-origin declarations are recorded but not fetched. Local references are bounded; remote references, servers, callbacks, webhooks, OAuth, OpenID, links, examples and externalDocs are never contacted. Unsupported semantics remain indeterminate.

WebMCP declarative tools (experimental)

WebMCP is a proposed web standard, currently in browser origin trials, that lets a page offer tools to browser agents. InterfaceDelta reads only its declarative form markup — toolname, tooldescription, toolautosubmit and toolparamdescription — from the origin root page it already retrieves for ARD links and, when you inspect a URL with a path, from that one same-origin page, without its query or fragment. It never runs page scripts, submits forms or follows form actions, so tools registered by script are not visible, and seeing none is not proof that a site has none. Root-page tools enter the Passport and monitoring; submitted-page tools are a one-time inspection result unless you monitor that page.

MCP Apps and payment declarations

An MCP tool that declares an MCP Apps UI resource is recorded as declared; the UI resource is never fetched or rendered, and because InterfaceDelta does not advertise UI support, a missing declaration proves nothing. An MCP endpoint that answers HTTP 402 is reported as payment_required. A per-operation OpenAPI x-payment-info declaration is recorded as publisher-declared, summarized in the Passport by payment method, intent, currency and pricing mode. In every case nothing is offered, paid or verified. InterfaceDelta does not extract prices into the Passport; a 402 challenge header is kept exactly as the endpoint sent it.

OpenAPI to MCP checks require an exact valid publisher identifier and unambiguous schema slots. Names, descriptions, fuzzy matching, embeddings and LLM judgment are not evidence.

Primary protocol references: Agentic Resource Discovery (ARD), Agent2Agent (A2A), Model Context Protocol (MCP), and OpenAPI. These upstream specifications evolve; these docs describe the exact versions and bounded behavior InterfaceDelta currently implements.

Breaking, non-breaking, needs review (indeterminate) and informational are deterministic compatibility classes, not severity or security ratings.

Hosted comparisons use compatibility-rules-v9; local CLI and Action comparisons use compatibility-rules-v8. Historical v1 records keep their original meaning. New comparisons emit breaking, non_breaking, informational and indeterminate changes. A changed fingerprint signals a semantic difference; it is not itself a breaking conclusion.

Each version preserves the one before it. v4 added MCP payment-required access changes, v5 WebMCP tools, and v6 OpenAPI operations that newly declare payment, which count as breaking only when both observations are complete and the operation also declares a 402 response. v7 adds per-page WebMCP rules for monitors that watch a specific page. v8 stops treating a surface as removed when the ARD catalog, or a Server Card that answered before, could not be read this time. v9 adds hosted per-source recovery: after an unread source becomes readable, its protocol, endpoints and endpoint capability inventories compare with their latest conclusive states within the shared 30-observation window.

MCP tool schema analysis is directional: inputs prove every previous request remains accepted; outputs prove every current producer value remains valid for a previous consumer. The bounded Draft 2020-12 fragment covers boolean schemas, type sets, const and enum, numeric and string bounds, conservative objects, homogeneous arrays, and bounded local references. Remote references are never fetched. Unsupported dialects, keywords such as pattern or oneOf, and reached limits produce explicit indeterminate findings. Developer API and list_target_changes reads include bounded field paths, before/after facts, reason codes, and rule version.

{
  "state": "changed",
  "ruleVersion": "compatibility-rules-v8",
  "counts": {
    "breaking": 2,
    "nonBreaking": 1,
    "informational": 0,
    "indeterminate": 1

{
  "state": "changed",
  "ruleVersion": "compatibility-rules-v8",
  "counts": {
    "breaking": 2,
    "nonBreaking": 1,
    "informational": 0,
    "indeterminate": 1
  },
  "highestClassification": "breaking",
  "changes": [
    {
      "code": "CAPABILITY_REMOVED",
      "classification": "breaking",
      "entityKind": "capability",
      "entityId": "capability:e7c59cb6728b12f610ed630e",
      "reasonCode": "PREVIOUSLY_PRESENT_CURRENTLY_ABSENT_COMPLETE_INVENTORIES"
    },
    {
      "code": "MCP_TOOL_INPUT_SCHEMA_CHANGED",
      "classification": "breaking",
      "entityKind": "capability",
      "entityId": "get_order",
      "reasonCode": "REQUIRED_PROPERTY_ADDED"
    },
    {
      "code": "INVENTORY_COMPARISON_INDETERMINATE",
      "classification": "indeterminate",
      "entityKind": "inventory",
      "entityId": "artifact:ad0bcdeee448ac869c66297a|openapi.operation",
      "reasonCode": "INVENTORY_INCOMPLETE_ON_ONE_OR_BOTH_SIDES"
    },
    {
      "code": "CAPABILITY_ADDED",
      "classification": "non_breaking",
      "entityKind": "capability",
      "entityId": "capability:a55ac47a48c9a53129a27418",
      "reasonCode": "CURRENTLY_PRESENT_PREVIOUSLY_ABSENT_COMPLETE_INVENTORIES"
    }
  ]
}

{
  "schemaVersion": "0.2.0",
  "subject": {
    "origin": "https://interfacedelta-demo-observed.vercel.app"
  },
  "observation": {
    "inspectedAt": "2026-08-26T20:38:42.159Z",
    "discoveryReportType": "agent-passport.discovery-report"

{
  "schemaVersion": "0.2.0",
  "subject": {
    "origin": "https://interfacedelta-demo-observed.vercel.app"
  },
  "observation": {
    "inspectedAt": "2026-08-26T20:38:42.159Z",
    "discoveryReportType": "agent-passport.discovery-report"
  },
  "protocols": [
    {
      "protocol": "a2a",
      "status": "not_found"
    },
    {
      "protocol": "ard",
      "status": "valid",
      "revision": "5fa2f5aef790b478319f6a3b43adf4661b0ed0e0"
    },
    {
      "protocol": "mcp",
      "status": "valid",
      "revision": "2026-07-28"
    },
    {
      "protocol": "mcp-server-card",
      "status": "valid",
      "revision": "526201bbc80231daa40ffcdecfc9da4e54e5dc93"
    }
  ],
  "capabilities": [
    {
      "kind": "mcp.prompt",
      "name": "comparison_template",
      "protocolKey": "comparison_template"
    },
    {
      "kind": "mcp.resource",
      "name": "Demonstration catalog",
      "protocolKey": "demo://catalog"
    },
    {
      "kind": "mcp.tool",
      "name": "search_catalog",
      "protocolKey": "search_catalog"
    },
    {
      "kind": "mcp.tool",
      "name": "compare_catalogs",
      "protocolKey": "compare_catalogs"
    }
  ],
  "consistency": {
    "checks": 5,
    "matches": 5,
    "mismatches": 0,
    "indeterminate": 0,
    "notApplicable": 0
  },
  "fingerprint": {
    "algorithm": "sha256",
    "canonicalization": "RFC8785",
    "projectionVersion": "passport-semantic-v1",
    "value": "499b2050aad01e1c8cb3d685381da22bc185e232603bd1815f5f88c152c00829",
    "complete": true
  }
}

Incomplete inventory can suppress removal inference. InterfaceDelta reports an indeterminate comparison instead of manufacturing certainty from missing evidence.

Protocol result states and top-level API errors remain distinct; consumers should not flatten them into one generic failure.

Exact observation JSON

400

INVALID_OBSERVATION_ID

404

OBSERVATION_NOT_FOUND

503

PERSISTENCE_UNAVAILABLE

These bounded examples show current product boundaries. Placeholder record identifiers are synthetic and do not represent live observations or credentials.

curl -X POST https://interfacedelta.com/api/v1/inspect \
  -H "Authorization: Bearer $INTERFACEDELTA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://example.org"}'

curl https://interfacedelta.com/api/v1/passports/00000000-0000-4000-8000-000000000000

curl "https://interfacedelta.com/api/v1/targets/sha256:0000000000000000000000000000000000000000000000000000000000000000/history?limit=20" \
  -H "Authorization: Bearer $INTERFACEDELTA_API_TOKEN"
curl "https://interfacedelta.com/api/v1/targets/sha256:0000000000000000000000000000000000000000000000000000000000000000/changes?limit=20" \
  -H "Authorization: Bearer $INTERFACEDELTA_API_TOKEN"

codex mcp add interfacedelta --url https://interfacedelta.com/mcp

codex mcp add interfacedelta_inspector \
  --url https://interfacedelta.com/mcp/inspect \
  --oauth-client-registration cimd \
  --oauth-resource https://interfacedelta.com/mcp/inspect
codex mcp login interfacedelta_inspector --oauth-client-registration cimd

{
  "schemaVersion": "0.2.0",
  "subject": {
    "origin": "https://interfacedelta-demo-observed.vercel.app"
  },
  "observedAt": "2026-08-26T20:38:42.159Z",
  "fingerprint": {
    "algorithm": "sha256",
    "canonicalization": "RFC8785",
    "projectionVersion": "passport-semantic-v1",
    "value": "499b2050aad01e1c8cb3d685381da22bc185e232603bd1815f5f88c152c00829",
    "complete": true
  }
}

GET /api/v1/passports/:observationId returns interfacedelta-share-v1 for an exact recorded observation. It is read-only, triggers no scan, requires a known observation UUID, and excludes account identity, session data, notification destinations, delivery records and raw remote bodies.

{
  "formatVersion": "interfacedelta-share-v1",
  "observation": {
    "id": "00000000-0000-4000-8000-000000000001",
    "observedAt": "2026-08-26T12:00:00.000Z",
    "recordedAt": "2026-08-26T12:00:01.000Z"
  },
  "target": {

{
  "formatVersion": "interfacedelta-share-v1",
  "observation": {
    "id": "00000000-0000-4000-8000-000000000001",
    "observedAt": "2026-08-26T12:00:00.000Z",
    "recordedAt": "2026-08-26T12:00:01.000Z"
  },
  "target": {
    "targetKey": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
    "origin": "https://sample-agent.invalid",
    "explicitMcpEndpoint": null
  },
  "passport": {
    "schemaVersion": "0.5.0",
    "fingerprints": {
      "passport": {
        "algorithm": "sha256",
        "canonicalization": "RFC8785",
        "projectionVersion": "passport-semantic-v4",
        "value": "e5c791a920aa6a7fb2556997d700816f58589b78345c1fde667c79b339df4542",
        "complete": false
      }
    }
  },
  "comparisonWithheld": true,
  "comparison": null
}

Its error codes are listed under Result and error states.

Targets are public HTTPS only. Observation uses DNS/IP classification, DNS-pinned HTTPS, bounded redirects, bounded request and response sizes, and bounded pagination. No inspected-service credentials or arbitrary request headers are accepted.

This is a bounded observation model, not a security certification or a general-purpose MCP client.