{"ok":true,"kind":"crawlcheck-capability-registry-entry","v":1,"domain":"xata.io","page":"https://crawlcheck.io/registry/capabilities/xata.io","row":{"domain":"xata.io","host":"xata.io","report_id":"n6huqqub1w","scanned_at":"2026-10-05T15:17:39.233Z","manifest":"699c7fc6d55209999c8c561b4373ae58ac99fc90846564e8d780e22c89e497e6","declared":7,"protocols":["a2a","agent_skill"],"by_policy":{"unknown":3,"metadata":4},"verified":0,"mismatches":0,"self_scan":false},"policy_classes":[{"id":"public_read_only","safety":"read_only_public","label":"Public read-only","automatic":true,"invoke":"May be called without credentials. CrawlCheck calls it only to check the declaration: GET with no input, on the scanned origin."},{"id":"authenticated_read_only","safety":"read_only_authenticated","label":"Authenticated read-only","automatic":false,"invoke":"Never called by CrawlCheck. An agent needs the user's own credentials and consent."},{"id":"reversible_write","safety":"reversible_write","label":"Reversible write","automatic":false,"invoke":"Never invoked automatically. Needs the owner's written authorisation and a test account."},{"id":"irreversible_write","safety":"irreversible_write","label":"Irreversible write","automatic":false,"invoke":"Never invoked automatically. Deletes or changes something that cannot be undone."},{"id":"financial","safety":"financial","label":"Financial","automatic":false,"invoke":"Never invoked automatically. Moves money or creates a charge."},{"id":"external_communication","safety":"external_communication","label":"External communication","automatic":false,"invoke":"Never invoked automatically. Sends a message, email or notification to someone."},{"id":"identity","safety":"identity_or_account","label":"Identity and accounts","automatic":false,"invoke":"Never invoked automatically. Creates, signs in to or changes an account or credential."},{"id":"unknown","safety":"unknown","label":"Unknown","automatic":false,"invoke":"Never invoked. Its effect cannot be read from the declaration, so it is treated as the riskiest case."},{"id":"metadata","safety":"metadata_only","label":"Metadata","automatic":false,"invoke":"Nothing to invoke: a listing, a server card or a skill file, not an operation."}],"items":[{"capability_id":"cap1:e3f35f8a67006b1da310","protocol":"a2a","operation":"managing-postgresql","method":null,"endpoint":"https://xata.io/docs/","declared":{"by":"https://xata.io/.well-known/agent-card.json","declaration_sha256":"80ffb975d06eb0de86cd42b735ad8ea527bbd0708d20d3fa6c6650c6709f71c8","authentication":"none","params_required":null,"media":null,"safety_class":"unknown","safety_basis":"its effect is not stated in the declaration"},"policy":{"id":"unknown","label":"Unknown","automatic":false,"invoke":"Never invoked. Its effect cannot be read from the declaration, so it is treated as the riskiest case."},"observed":{"state":"not_attempted","verified":false,"at":null,"status":null,"content_type":null,"sha256":null,"mismatches":[],"not_attempted_because":"classed unknown: only read-only public actions are ever called"}},{"capability_id":"cap1:d3d535f8430d48817786","protocol":"a2a","operation":"using-xata-api","method":null,"endpoint":"https://xata.io/docs/","declared":{"by":"https://xata.io/.well-known/agent-card.json","declaration_sha256":"80ffb975d06eb0de86cd42b735ad8ea527bbd0708d20d3fa6c6650c6709f71c8","authentication":"none","params_required":null,"media":null,"safety_class":"unknown","safety_basis":"its effect is not stated in the declaration"},"policy":{"id":"unknown","label":"Unknown","automatic":false,"invoke":"Never invoked. Its effect cannot be read from the declaration, so it is treated as the riskiest case."},"observed":{"state":"not_attempted","verified":false,"at":null,"status":null,"content_type":null,"sha256":null,"mismatches":[],"not_attempted_because":"classed unknown: only read-only public actions are ever called"}},{"capability_id":"cap1:499b64be5205d9bdab79","protocol":"a2a","operation":"using-xata-cli","method":null,"endpoint":"https://xata.io/docs/","declared":{"by":"https://xata.io/.well-known/agent-card.json","declaration_sha256":"80ffb975d06eb0de86cd42b735ad8ea527bbd0708d20d3fa6c6650c6709f71c8","authentication":"none","params_required":null,"media":null,"safety_class":"unknown","safety_basis":"its effect is not stated in the declaration"},"policy":{"id":"unknown","label":"Unknown","automatic":false,"invoke":"Never invoked. Its effect cannot be read from the declaration, so it is treated as the riskiest case."},"observed":{"state":"not_attempted","verified":false,"at":null,"status":null,"content_type":null,"sha256":null,"mismatches":[],"not_attempted_because":"classed unknown: only read-only public actions are ever called"}},{"capability_id":"cap1:cc24a7ad00356143fe22","protocol":"agent_skill","operation":"branching-postgresql-for-agents","method":null,"endpoint":"https://xata.io/.well-known/agent-skills/branching-postgresql-for-agents/skill.md","declared":{"by":"https://xata.io/.well-known/agent-skills/index.json","declaration_sha256":"d026664be2cf5ab7817df7b64e72ebfb093f5961a9ab96702a46c142bac6f1b9","authentication":"none","params_required":null,"media":null,"safety_class":"metadata_only","safety_basis":"an instruction file an agent reads; not an operation"},"policy":{"id":"metadata","label":"Metadata","automatic":false,"invoke":"Nothing to invoke: a listing, a server card or a skill file, not an operation."},"observed":{"state":"not_attempted","verified":false,"at":null,"status":null,"content_type":null,"sha256":null,"mismatches":[],"not_attempted_because":"metadata: describes a surface, is not itself an action"}},{"capability_id":"cap1:b05881beded59a48df14","protocol":"agent_skill","operation":"managing-postgresql","method":null,"endpoint":"https://xata.io/.well-known/agent-skills/managing-postgresql/skill.md","declared":{"by":"https://xata.io/.well-known/agent-skills/index.json","declaration_sha256":"d026664be2cf5ab7817df7b64e72ebfb093f5961a9ab96702a46c142bac6f1b9","authentication":"none","params_required":null,"media":null,"safety_class":"metadata_only","safety_basis":"an instruction file an agent reads; not an operation"},"policy":{"id":"metadata","label":"Metadata","automatic":false,"invoke":"Nothing to invoke: a listing, a server card or a skill file, not an operation."},"observed":{"state":"not_attempted","verified":false,"at":null,"status":null,"content_type":null,"sha256":null,"mismatches":[],"not_attempted_because":"metadata: describes a surface, is not itself an action"}},{"capability_id":"cap1:99016a4a06626a4a2192","protocol":"agent_skill","operation":"using-xata-api","method":null,"endpoint":"https://xata.io/.well-known/agent-skills/using-xata-api/skill.md","declared":{"by":"https://xata.io/.well-known/agent-skills/index.json","declaration_sha256":"d026664be2cf5ab7817df7b64e72ebfb093f5961a9ab96702a46c142bac6f1b9","authentication":"none","params_required":null,"media":null,"safety_class":"metadata_only","safety_basis":"an instruction file an agent reads; not an operation"},"policy":{"id":"metadata","label":"Metadata","automatic":false,"invoke":"Nothing to invoke: a listing, a server card or a skill file, not an operation."},"observed":{"state":"not_attempted","verified":false,"at":null,"status":null,"content_type":null,"sha256":null,"mismatches":[],"not_attempted_because":"metadata: describes a surface, is not itself an action"}},{"capability_id":"cap1:25956f9a6bdc7a2c81e3","protocol":"agent_skill","operation":"using-xata-cli","method":null,"endpoint":"https://xata.io/.well-known/agent-skills/using-xata-cli/skill.md","declared":{"by":"https://xata.io/.well-known/agent-skills/index.json","declaration_sha256":"d026664be2cf5ab7817df7b64e72ebfb093f5961a9ab96702a46c142bac6f1b9","authentication":"none","params_required":null,"media":null,"safety_class":"metadata_only","safety_basis":"an instruction file an agent reads; not an operation"},"policy":{"id":"metadata","label":"Metadata","automatic":false,"invoke":"Nothing to invoke: a listing, a server card or a skill file, not an operation."},"observed":{"state":"not_attempted","verified":false,"at":null,"status":null,"content_type":null,"sha256":null,"mismatches":[],"not_attempted_because":"metadata: describes a surface, is not itself an action"}}],"mismatches":[],"certificate":{"certificate_id":"ccap1:fefff85d159ffa4b4d215d50338e7659d7ca9bff14805a0652a423ba65ec7eab","certificate":{"kind":"crawlcheck-capability-certificate","v":1,"subject":"xata.io","domain":"xata.io","record":"n6huqqub1w","report":"https://crawlcheck.io/r/n6huqqub1w","manifest_sha256":"699c7fc6d55209999c8c561b4373ae58ac99fc90846564e8d780e22c89e497e6","measured_at":"2026-10-05T15:17:39.233Z","verification_checked_at":"2026-10-05T15:17:46.144Z","verification_policy":"public GETs with no required input and one read-only MCP tool with no required input, on the scanned origin only; redirects recorded, not followed","invocation_rule":"capabilities are read from declarations only; nothing is invoked. Later verification may call read_only_public operations alone; every other class needs the site owner's authorisation and a test account, and unknown is never called","counts":{"declared":7,"verified":0,"mismatches":0},"items":[{"id":"cap1:e3f35f8a67006b1da310","protocol":"a2a","operation":"managing-postgresql","method":null,"endpoint":"https://xata.io/docs/","declared_by_sha256":"80ffb975d06eb0de86cd42b735ad8ea527bbd0708d20d3fa6c6650c6709f71c8","safety_class":"unknown","policy":"unknown","observed":"not_attempted","status":null,"observed_sha256":null},{"id":"cap1:d3d535f8430d48817786","protocol":"a2a","operation":"using-xata-api","method":null,"endpoint":"https://xata.io/docs/","declared_by_sha256":"80ffb975d06eb0de86cd42b735ad8ea527bbd0708d20d3fa6c6650c6709f71c8","safety_class":"unknown","policy":"unknown","observed":"not_attempted","status":null,"observed_sha256":null},{"id":"cap1:499b64be5205d9bdab79","protocol":"a2a","operation":"using-xata-cli","method":null,"endpoint":"https://xata.io/docs/","declared_by_sha256":"80ffb975d06eb0de86cd42b735ad8ea527bbd0708d20d3fa6c6650c6709f71c8","safety_class":"unknown","policy":"unknown","observed":"not_attempted","status":null,"observed_sha256":null},{"id":"cap1:cc24a7ad00356143fe22","protocol":"agent_skill","operation":"branching-postgresql-for-agents","method":null,"endpoint":"https://xata.io/.well-known/agent-skills/branching-postgresql-for-agents/skill.md","declared_by_sha256":"d026664be2cf5ab7817df7b64e72ebfb093f5961a9ab96702a46c142bac6f1b9","safety_class":"metadata_only","policy":"metadata","observed":"not_attempted","status":null,"observed_sha256":null},{"id":"cap1:b05881beded59a48df14","protocol":"agent_skill","operation":"managing-postgresql","method":null,"endpoint":"https://xata.io/.well-known/agent-skills/managing-postgresql/skill.md","declared_by_sha256":"d026664be2cf5ab7817df7b64e72ebfb093f5961a9ab96702a46c142bac6f1b9","safety_class":"metadata_only","policy":"metadata","observed":"not_attempted","status":null,"observed_sha256":null},{"id":"cap1:99016a4a06626a4a2192","protocol":"agent_skill","operation":"using-xata-api","method":null,"endpoint":"https://xata.io/.well-known/agent-skills/using-xata-api/skill.md","declared_by_sha256":"d026664be2cf5ab7817df7b64e72ebfb093f5961a9ab96702a46c142bac6f1b9","safety_class":"metadata_only","policy":"metadata","observed":"not_attempted","status":null,"observed_sha256":null},{"id":"cap1:25956f9a6bdc7a2c81e3","protocol":"agent_skill","operation":"using-xata-cli","method":null,"endpoint":"https://xata.io/.well-known/agent-skills/using-xata-cli/skill.md","declared_by_sha256":"d026664be2cf5ab7817df7b64e72ebfb093f5961a9ab96702a46c142bac6f1b9","safety_class":"metadata_only","policy":"metadata","observed":"not_attempted","status":null,"observed_sha256":null}],"mismatches":[]},"signature":{"alg":"Ed25519","kid":"hcIAczGf-8EFBnkunmZlvFWnD2nHHeHeC9cM4BTiBVo","certificate_sha256":"fefff85d159ffa4b4d215d50338e7659d7ca9bff14805a0652a423ba65ec7eab","message":"the UTF-8 bytes of \"crawlcheck-capability-certificate-v1\\n\" followed by certificate_sha256 (hex), where certificate_sha256 = SHA-256 of the certificate as canonical JSON (keys sorted, no whitespace)","sig":"l7Dw2Ny831ECJNxptXELeYhTj9jON9Rddwmn350Ey2Uh5JzLSdXwqGknrg0qICVppOQlAdJwUXLbqSaZyYAhDg"},"issuer":{"name":"CrawlCheck observer","key":{"jwk":{"kty":"OKP","crv":"Ed25519","x":"Ny5tAiGdpyVWTm64G1_0g_sTo4ocLL7kqjZ6cK7G5KM"},"directory":"https://crawlcheck.io/.well-known/http-message-signatures-directory"}}},"verify":"https://crawlcheck.io/api/registry/capabilities/verify?domain=xata.io"}