Technical documentation often relies on citations to specifications that evolve long after publication. A recent audit by four AI agents demonstrates why static compliance checks fail to detect when referenced standards have shifted beneath the surface.
The audit uncovered fresh discrepancies in live guides
Researchers deployed four independent AI agents, each running Claude Fable 5, to re-examine four families of technical specifications hosted on turva.dev. The agents parsed claims in the commerce stack, MCP discovery documents, standards discovery files, and authentication protocols against their original sources. Their findings revealed one high-severity issue, one medium-severity issue, and six minor inconsistencies.
The most critical finding involved the MCP guide, which referenced SEP-2127 in present tense while the proposal itself had progressed. By July 2026, the document moved to MCP’s extensions track as an experimental extension, with updated drafts recommending card serving relative to server endpoints via /.well-known/mcp/catalog.json. The original statement remained technically accurate when published but became outdated as the specification matured.
The medium-severity issue surfaced in the response-header guide, which cited an expired IETF draft for RateLimit headers that lapsed in March 2026 without replacement. Minor inconsistencies included dated terminology predating A2A 1.0, references to the Open Knowledge Format, nuances around Cache-Control, and two instances where a quoted blog post perpetuated stale language from the guide.
Machine-readable profiles revealed deeper inconsistencies
Beyond textual guides, two machine-readable profiles served by turva.dev had diverged from their own specifications—an issue undetectable by conventional scanners. The UCP profile incorrectly used service keys within a namespace reserved for the governing body and listed transport types not defined in its enum. Meanwhile, the MPP manifest declared a version field not recognized by the protocol.
Conventional validation tools confirmed both profiles parsed without errors, yet neither verified whether the vocabulary inside matched the live specification. These profiles now align with the primary text and have been programmatically validated. Surprisingly, automated scans continued to return perfect scores (100/100 and Level 5) even after the fixes, highlighting how compliance metrics measure structural conformity rather than semantic accuracy.
The remedy: anchoring claims to dates of validity
To prevent future drift, turva.dev now timestamps claims tied to evolving specifications. For example, a guide referencing SEP-2127 explicitly notes its status "as of July 2026," ensuring clarity when future revisions occur. High-velocity domains like agent commerce and MCP discovery will undergo re-audits on a scheduled basis, as this audit confirmed drift can materialize within weeks.
This approach reflects a broader shift in technical documentation: static compliance reports miss the speed at which specifications evolve. Organizations relying on cited standards must implement continuous validation loops or risk propagating outdated guidance. For teams seeking audits that validate agent-facing claims against live specifications, turva.dev offers consultations via info@turva.dev.
AI summary
Standartlar sürekli değişirken rehberlerin doğruluğunu korumak neden zor? Dört AI ajanının turva.dev rehberlerini yeniden incelemesiyle ortaya çıkan gerçekler ve kalıcı çözümler.
