webmcp-audit refused: bundled shim v1, server scores v3 (npm latest still v1)

[aaronjmars]

Summary

ax webmcp-audit is unusable on the current published CLI: the bundled capture shim is version 1, but ora's scoring server now requires version 3, so every audit is refused with exit 3 before any scoring happens. The remediation the CLI itself prints (npm i -g ax@latest / npx ax@latest) does not help, because the latest published npm version still ships shim v1.

Repro

$ ax --version
0.7.5
$ npm view ax version
0.7.5

$ ax webmcp-audit https://example.com
This ax build captures with a shim ora no longer scores, so the audit was refused.
Upgrade with `npm i -g ax@latest` (or `npx ax@latest webmcp-audit ...`) and run it again.

ora said: This capture was taken by shim version 1, and this server scores version 3. Upgrade the CLI and capture again.
# exit code 3

Same result on any URL, and identical when run via npx ax@latest webmcp-audit ....

Expected

ax webmcp-audit produces a score (or a documented not-agent-ready result), the same as ax audit does on the same binary.

Actual

• Exit 3 (API error), no score, no pillars, for every target.
• ax audit on the same binary works fine, so it is specific to the webmcp capture shim.
• The printed upgrade advice is a dead end while npm latest is still shim v1.

Impact

webmcp-audit cannot be run at all right now, including in CI gates keyed to it. Verified against three separate production sites plus example.com.

Environment

• ax 0.7.5 (npm latest as of this report)
• macOS (darwin 25.6.0), node via fnm
• Chrome present locally; failure is server-side capture-version refusal, not a browser issue

Suggestion

Publish a CLI release whose capture shim emits version 3 (or whatever the server currently scores), and consider having the server return a clearer "no client version scores this" message when even the latest published CLI is behind, so the printed upgrade advice is not misleading.