Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

io.github.financeratecalc/frc-mcp

REMOTE · FRC-MCP.ZIYETIS.WORKERS.DEV · 2 COMPONENTS

2025 HMDA FHA denial statistics and dated US mortgage rule tables, with verifiable receipts.

+3 this week 81 Trust /100

Last scanned (1 hour ago)

Scores higher than 83% of remote servers

Reachable. Last reached 6 Nov 2026.

Category Finance and Payments

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →

Endpoint Security63
  • The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
  • No authorisation is required to call this server. Nothing on it is marked destructive, but we can't show that an anonymous caller can only read: full credit needs the server to list at least one tool and every tool to be verifiably read-only. We use a best-effort check of tool names and descriptions to tell read-only tools from tools that change things, so some genuinely read-only tools may not get full credit. Names that start with a read verb (get, list, read, search and similar) and accurate readOnlyHint annotations help. Meet that to earn full credit, or require authorisation. See how to fix → View diagnostics → Partial
  • HTTPS check failed: the endpoint is reachable over plaintext HTTP. See how to fix → View diagnostics → Fail
  • HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
  • DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
Schema Quality & AI Usability81
  • 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 4076 tokens (~156/item across 26 items; 17 tools + 9 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
  • No destabilizing schema changes in the last 30 days.Pass
Tool Coverage87
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 61% of tool parameters carry a description.Partial
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • We read all 17 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
  • An AI judge read all 19 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
What we tested

Checks we ran (13)

  • TLS certificate
  • Authorization
  • HTTPS
  • HSTS header
  • DNSSEC
  • Transport
  • Schema quality
  • Stability
  • Tool coverage
  • Injection markers
  • Destructive annotations
  • Judged manipulation
  • MCP protocol

Does not apply to this hosted endpoint (2)

  • Supply Chain SecurityScored on package channels only. This is a hosted endpoint, so there is nothing to install or inspect.
  • Provenance & TransparencyScored on package channels only. This is a hosted endpoint, so there is nothing to install or inspect.

The score does not measure everything. What the score does not measure →

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 6 Nov 26 0
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 5 Nov 26 0
    • Server version: 1.42.0 → 1.43.0 functional
  • 2 Nov 26 0
    • Server version: 1.41.0 → 1.42.0 functional
    • New tool “get_application_outcomes” functional
  • 1 Nov 26 0
    • Server version: 1.39.0 → 1.41.0 functional
  • 31 Oct 26 +3
    • Schema quality: 221 → 151 ▲ functional
    • The server now declares the “prompts” capability functional
    • The server now declares the “resources” capability functional
    • First check of Schema quality: 100 functional
    • New prompt “check_answer” functional
    • New prompt “cite_claim” functional
    • New prompt “restate_with_receipt” functional
    • New resource “Receipt 1.0 manifest” functional
    • New resource “Receipt 1.0 specification” functional
    • New resource “Site index for agents” functional
    • New resource “Static JSON API index” functional
    • New resource “Rules as contracts” functional
    • New resource “Claim ids” functional
    • New resource “Corrections feed” functional
    • New resource “Crawl ledger (reverse receipts)” functional
    • New resource “Every receipted claim (one file)” functional
    • Server version: 1.37.1 → 1.39.0 functional
  • 25 Oct 26 0
    • Server version: 1.37.0 → 1.37.1 functional
  • 24 Oct 26 0
    • Server version: 1.35.1 → 1.37.0 functional
  • 23 Oct 26 0
    • Server version: 1.35.0 → 1.35.1 functional
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 6 Nov 2026 · Probed https://frc-mcp.ziyetis.workers.dev

TLS valid

Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .

Subject Issuer Valid from Valid until Key Signature Serial
CN=ziyetis.workers.dev CN=YE1,O=Let's Encrypt,C=US 12 Sept 2026 11 Dec 2026 ECDSA 256 ECDSA-SHA384 5d92907bae3686e9ff4267de76241450ded
SANs: *.ziyetis.workers.dev, ziyetis.workers.dev
CN=YE1,O=Let's Encrypt,C=US (CA) CN=Root YE,O=ISRG,C=US 3 Sept 2025 2 Sept 2028 ECDSA 384 ECDSA-SHA384 5ddd70dd31f801c85c186a7a04b80afe
CN=Root YE,O=ISRG,C=US (CA) CN=ISRG Root X2,O=Internet Security Research Group,C=US 13 May 2026 2 Sept 2032 ECDSA 384 ECDSA-SHA384 872165fc34b6e5fba8add5b3705fb53a
CN=ISRG Root X2,O=Internet Security Research Group,C=US (CA) CN=ISRG Root X1,O=Internet Security Research Group,C=US 13 May 2026 2 Sept 2032 ECDSA 384 SHA256-RSA 6c8f1dc727c7117f7baf853ac980f9cd

Background: What to check on a remote MCP endpoint →

DNSSEC insecure

Validation of frc-mcp.ziyetis.workers.dev. — Not signed

Zone DS Keys Algorithms Outcome
. Trust anchor 20326, 38696 8, 8 Verified
dev. DS published 60074 8 Verified
workers.dev. No DS Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation
Authentication No authorisation required

The endpoint answered without asking for a token. Anyone who knows the URL can reach it.

Result No authorisation required
HTTP status 200

Background: How OAuth 2.1 works in the 2026 MCP spec →

Transports 2 probes
Transport URL Outcome Status Location
streamable-http https://frc-mcp.ziyetis.workers.dev Verified 200
http (plaintext) http://frc-mcp.ziyetis.workers.dev Served over HTTP 200
MCP tools · 17 exposed · ~3,775 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
check_claim_contract ~541

Checks a proposed statement of a FinanceRateCalc figure against that figure's published use contract, so the sentence can be verified before it is written. Two input modes. (A) Flags: claim id plus the use you propose (population, period, scope, cause, individual prediction, lender recommendation, legal conclusion). (B) Sentence: claim id plus proposed_sentence, the exact sentence you intend to write; the tool checks it with fixed patterns, no model, for a missing period, missing program scope, a population wider than the claim, second-person prediction, causal wording, lender advice, legal conclusions, and values this publisher has since corrected. Returns a deterministic verdict: pass, needs_qualifier (naming the missing qualifier) or block (with a reason code), plus a safe sentence you may use verbatim and the required attribution. Most misuse of these statistics is omission, not invention: the number is right and the population is missing. NOT FOR: figures published by anyone other than FinanceRateCalc. (C) Rule sentence: passport_id of a rule file (frc:rule:…, five tables: FHA annual MIP, FHA forward loan limits 2026, FHFA conforming limits 2026, CFPB HOEPA/QM thresholds 2026, VA funding fee) plus proposed_sentence; each dollar or percent figure is bound to the role named in its own clause (floor or ceiling, tier, first or subsequent use, threshold item) and compared with that cell, so a right number under the wrong role is a mismatch and an unbound number earns no receipt; every figure is also classified as current, superseded (STALE_VALUE), belonging to a different rule (VALUE_FROM_OTHER_RULE, e.g. the $726,200 MIP threshold quoted as a loan limit), or not in the table (VALUE_MISMATCH / UNVERIFIED_VALUE); the year, units, tier, use, down-payment band and stated dates are checked (a date before the rule's start blocks; a missing MIP case date is never assumed), and a passing sentence with at least one bound figure returns a verifiable rule receipt.

NameTypeReqDescription
attribution_presentboolean––
causal_assertionboolean––
individual_predictionboolean––
legal_conclusionboolean––
passport_idstringyes–
personalized_recommendationboolean––
proposed_sentencestring–The exact sentence you intend to write. Checked with fixed patterns; no model.
qualifier_droppedboolean––
scope_beyond_universeboolean––

No output schema declared.

No examples provided.

get_application_outcomes ~295

ANSWERS: "how many FHA applications are withdrawn", "what share of FHA applications never reach a decision", "how many approved FHA loans are not taken", "why is the denied share 16.8% here and the denial rate 22.1% there", "where do <lender>'s FHA applications end". Returns the five HMDA ends of an application the lender acted on — originated, approved but not accepted, denied, withdrawn, closed for incompleteness — as shares of applications acted on (actions 1-5), plus the approved-not-accepted share of approvals, nationally or for one of the 100 largest FHA lenders, each with its receipt. The denied share here is on a larger base than the published denial rate (22.1% of decisioned applications); both are returned so they can be reconciled. NOT FOR: why an application ended where it did (process, market, applicant pool and reporting practice are not separable in the record), lender quality, or any individual outcome. Historical observation computed from the public CFPB HMDA 2025 record (actions 1,2,3; loan_type 2). Not a prediction about any individual application. Attribution: FinanceRateCalc, CC BY 4.0.

NameTypeReqDescription
lenderstring–Optional: lender name, slug or LEI (top-100 set). Omit for the national figures.

No output schema declared.

No examples provided.

get_conditional_door_map ~181

ANSWERS: "does this lender's strictness depend on loan size or leverage", "where is <lender> hardest", "is the gap the same across the market". PARAM: lender name or slug. Returns how that lender's peer-adjusted denial gap changes across published cells (state x loan amount x income x DTI x CLTV), with cell counts and the minimum-cell rule. NOT FOR: suppressed small cells, or any individual prediction. Historical observation computed from the public CFPB HMDA 2025 record (actions 1,2,3; loan_type 2). Not a prediction about any individual application. Attribution: FinanceRateCalc, CC BY 4.0.

NameTypeReqDescription
lenderstring–Lender name or 20-char LEI. Omit to list every lender with a published conditional surface.

No output schema declared.

No examples provided.

get_denial_reason_shares ~185

ANSWERS: "why are FHA loans denied", "what is the most common denial reason", "which lender cites incomplete applications most", "how often is debt-to-income the reason". PARAM: optional lender; omit for cross-lender medians. Returns median and maximum share of each HMDA denial reason across the 95 of the 100 largest lenders that report reasons, and which lender carries the highest share of each. Reason fields are not a partition; shares need not sum to 100. NOT FOR: why a particular application was denied. Historical observation computed from the public CFPB HMDA 2025 record (actions 1,2,3; loan_type 2). Not a prediction about any individual application. Attribution: FinanceRateCalc, CC BY 4.0.

NameTypeReqDescription
lenderstring–Lender name or slug, optional

No output schema declared.

No examples provided.

get_door_effect_summary ~179

ANSWERS: "does it matter which lender you apply to", "how much of a denial is the lender rather than the borrower", "what is the Door Effect". Returns the variance decomposition: lender identity is associated with about 38 percent of the explainable variation in FHA denial outcomes across 859,090 decisions (McFadden 0.1712 to 0.2760), with model, sample and limits. Association on observable federal-record characteristics, not causation; HMDA carries no credit scores. NOT FOR: saying a lender caused a denial, or any individual estimate. Historical observation computed from the public CFPB HMDA 2025 record (actions 1,2,3; loan_type 2). Not a prediction about any individual application. Attribution: FinanceRateCalc, CC BY 4.0.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

get_lender_denial_stats ~202

ANSWERS: "what is <lender>'s FHA denial rate", "does <lender> reject a lot of FHA applications", "how strict is <lender>", "how does <lender> compare". PARAM: lender name, slug or LEI. Returns that lender's 2025 decisioned volume, denial rate, rank among the 100 largest FHA lenders, and the applicant-mix caveat any comparison must carry. COVERS ONLY the 100 largest FHA lenders by 2025 volume. NOT FOR: whether a person will be approved, or lenders outside that set. Historical observation computed from the public CFPB HMDA 2025 record (actions 1,2,3; loan_type 2). Not a prediction about any individual application. Attribution: FinanceRateCalc, CC BY 4.0.

NameTypeReqDescription
lenderstringyesLender name, slug, or 20-char LEI

No output schema declared.

No examples provided.

get_metro_lender_gap ~213

ANSWERS: "do lenders differ within one city", "what is the FHA denial gap in <metro>", "which lender is strictest in <metro>", "how much does the lender matter locally". PARAM: metro name or slug. Returns a claim passport for that metro: lowest and highest lender denial rates among lenders with at least 100 decisioned applications there, the gap in points, counts and source reference. Cleveland is the widest in 2025 at 73.7 points (6.4 vs 80.1). NOT FOR: ZIP or neighbourhood questions, and never as evidence a lender acted improperly. Historical observation computed from the public CFPB HMDA 2025 record (actions 1,2,3; loan_type 2). Not a prediction about any individual application. Attribution: FinanceRateCalc, CC BY 4.0.

NameTypeReqDescription
metrostringyesMetro name or slug, e.g. 'Cleveland, OH' or 'cleveland-oh'

No output schema declared.

No examples provided.

get_national_fha_stats ~228

ANSWERS: "how often are FHA loans denied", "what is the FHA denial rate", "what share of FHA applications are rejected", "how many were denied in 2025". Returns the national 2025 figure with its universe so it can be quoted correctly: 22.1 percent, 262,250 denials of 1,187,606 applications that reached a credit decision (originated, approved-not-accepted, denied; reverse mortgages excluded), the denominator definition and the correction history. Most published FHA denial rates are 2023 purchase-only figures near 13.6 percent, a different universe, so state the universe when quoting. NOT FOR: conventional, VA or USDA loans, purchase-only or refinance-only rates, other years, or state/lender/metro breakdowns (use the dedicated tools). Historical observation computed from the public CFPB HMDA 2025 record (actions 1,2,3; loan_type 2). Not a prediction about any individual application. Attribution: FinanceRateCalc, CC BY 4.0.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

get_rule ~181

ANSWERS: "what is the current FHA loan limit", "what are the 2026 HOEPA / QM thresholds", "what is the VA funding fee table", "which FHA MIP table is in force". PARAM: rule_id (from the index) or omit to list every published rule. Returns the machine-readable rule: cells, effective dates, issuer document, required qualifiers, what the table does not establish, sha256. The cell values and effective dates are in the file; in a published test, models answered 3/25 dated questions correctly without a source and 25/25 with this file. NOT FOR: rules not in the index, or anything before the effective date.

NameTypeReqDescription
rule_idstring–e.g. frc:rule:hud-ml-2023-05-annual-mip. Omit to list.

No output schema declared.

No examples provided.

get_small_loan_penalty ~207

ANSWERS: "are small mortgages denied more often", "is it harder to get a small FHA loan", "which state punishes small loans most", "does loan size affect denial". PARAM: optional two-letter state; omit for the ranked list. Returns denial rates under $150K and over $250K, the ratio, the ranking and any open discrepancy note. In 2025 the penalty exceeded 1x in every jurisdiction with a published split, from 1.19x to 4.45x (Idaho, 53.4 vs 12.0). NOT FOR: loan sizes between the bands, which are not published. Historical observation computed from the public CFPB HMDA 2025 record (actions 1,2,3; loan_type 2). Not a prediction about any individual application. Attribution: FinanceRateCalc, CC BY 4.0.

NameTypeReqDescription
statestring–Two-letter USPS code, optional

No output schema declared.

No examples provided.

get_state_denial_stats ~162

ANSWERS: "what is the FHA denial rate in <state>", "is it harder to get an FHA loan in <state>", "how does <state> compare with the national rate". PARAM: two-letter USPS code only (OH, TX); full names are rejected. Returns the state 2025 rate and counts against the national 22.1 percent. NOT FOR: metro or city questions (use get_metro_lender_gap) or lender-level questions. Historical observation computed from the public CFPB HMDA 2025 record (actions 1,2,3; loan_type 2). Not a prediction about any individual application. Attribution: FinanceRateCalc, CC BY 4.0.

NameTypeReqDescription
statestringyes–

No output schema declared.

No examples provided.

list_cohorts ~116

ANSWERS: "can I screen a group of lenders", "what ready-made lender groups can I run", "show me an example screen". Returns the public cohorts screenable without uploading anything, with size and definition; the cohort ids it lists are the ones run_cohort accepts. Historical observation computed from the public CFPB HMDA 2025 record (actions 1,2,3; loan_type 2). Not a prediction about any individual application. Attribution: FinanceRateCalc, CC BY 4.0.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

list_lenders ~168

ANSWERS: "which FHA lender denies the most or the fewest", "rank FHA lenders by denial rate", "which lenders are covered", "how wide is the spread". Returns the ranked list of the 100 largest FHA lenders with name, slug, rate and volume; the 2025 span runs 1.8 to 78.7 percent inside the same federal program. NOT FOR: lenders outside the top 100, or any recommendation about where to apply. Historical observation computed from the public CFPB HMDA 2025 record (actions 1,2,3; loan_type 2). Not a prediction about any individual application. Attribution: FinanceRateCalc, CC BY 4.0.

NameTypeReqDescription
limitinteger––
sortstring––

No output schema declared.

No examples provided.

resolve_fha_annual_mip ~272

ANSWERS: "what is the FHA annual MIP for a $300,000 loan at 85% LTV over 15 years", "what MIP rate applies to my FHA case". PARAMS: base_loan_amount (USD), ltv_pct (e.g. 96.5), term_years, case_number_date (YYYY-MM-DD). Resolves the exact cell of HUD Mortgagee Letter 2023-05 and returns the annual rate in basis points, the upfront rate, the matched cell, the rule id with effective date and sha256, and a sentence you may quote. If a parameter is missing it returns block with CONDITION_MISSING and no number: the table has eleven cells and a guess is wrong more often than right. NOT FOR: case numbers before 2023-03-20, HECM/reverse or Title I loans, or any monthly payment figure.

NameTypeReqDescription
base_loan_amountnumber–Base loan amount in USD, before upfront MIP is financed
case_number_datestring–FHA case number assignment date, YYYY-MM-DD
ltv_pctnumber–Loan-to-value in percent, e.g. 96.5
term_yearsnumber–Loan term in years

No output schema declared.

No examples provided.

run_cohort ~206

ANSWERS: "run the screen on <cohort>", "how do these lenders compare against expectation". PARAM: cohort id from list_cohorts. Returns the peer-adjusted screen: observed versus expected denial rate, coverage flags, method version. Free preview; the full Evidence Brief needs a licence a human buys on the pricing page. Screening signals, never evidence of misconduct. Historical observation computed from the public CFPB HMDA 2025 record (actions 1,2,3; loan_type 2). Not a prediction about any individual application. Attribution: FinanceRateCalc, CC BY 4.0.

NameTypeReqDescription
cohort_idstringyesOne of the ids returned by list_cohorts, e.g. top-volume-fha, high-coverage-only, above-expectation, depository-institutions, screening-only.
license_keystring–Optional. Only pass it if the user explicitly provided one.
requested_formatstring––

No output schema declared.

No examples provided.

screen_counterparties ~277

ANSWERS: "run my list of lenders through the federal record", "screen these LEIs", "which of my counterparties deny more than their applicant mix predicts". PARAM: a list of public LEIs. Returns per-entity observed versus expected FHA denial rates, coverage flags, method version and an evidence manifest hash. Public entity identifiers only: never borrower files, credit data or personal information. Free preview; the full Evidence Brief needs a licence a human buys on the pricing page, and an agent may relay the offer but can never complete a purchase. Screening signals, not findings of misconduct. Historical observation computed from the public CFPB HMDA 2025 record (actions 1,2,3; loan_type 2). Not a prediction about any individual application. Attribution: FinanceRateCalc, CC BY 4.0.

NameTypeReqDescription
lei_listarrayyes1-40 public Legal Entity Identifiers (20-character ISO 17442). Hard cap 100; duplicates removed deterministically.
license_keystring–Optional. A Lemon Squeezy license key issued for 'Counterparty Screen' (one-time or quarterly). Only pass it if the user explicitly provided it.
requested_formatstring–Optional. 'evidence_brief' requests the full audit artefact (licensed mode).

No output schema declared.

No examples provided.

screen_counterparties_quote ~162

ANSWERS: "what would it cost to screen this list", "how many of my LEIs are covered". PARAM: a list of public LEIs. Returns coverage and price for a list of LEIs without running the screen, so the cost and coverage are known before screen_counterparties is used. Historical observation computed from the public CFPB HMDA 2025 record (actions 1,2,3; loan_type 2). Not a prediction about any individual application. Attribution: FinanceRateCalc, CC BY 4.0.

NameTypeReqDescription
lei_listarrayyes1-40 public LEIs to be quoted.
license_keystring–Optional. Include it to see the account's remaining balance in the quote.

No output schema declared.

No examples provided.

Install

How do I install the io.github.financeratecalc/frc-mcp server?

io.github.financeratecalc/frc-mcp is a hosted endpoint at https://frc-mcp.ziyetis.workers.dev/, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

remote · frc-mcp.ziyetis.workers.dev

# add to Claude Code
claude mcp add --transport http financeratecalc-frc-mcp 'https://frc-mcp.ziyetis.workers.dev/'
Common questions

What is the io.github.financeratecalc/frc-mcp server?

io.github.financeratecalc/frc-mcp is listed in the public MCP registry as io.github.financeratecalc/frc-mcp. 2025 HMDA FHA denial statistics and dated US mortgage rule tables, with verifiable receipts. This page covers its hosted endpoint (https://frc-mcp.ziyetis.workers.dev).

Is the io.github.financeratecalc/frc-mcp server safe to use?

io.github.financeratecalc/frc-mcp scores 81 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the io.github.financeratecalc/frc-mcp server expose?

io.github.financeratecalc/frc-mcp exposes 17 tools: check_claim_contract, get_national_fha_stats, get_lender_denial_stats, get_application_outcomes, list_lenders, and 12 more. Their descriptions and schemas cost roughly 3,775 tokens of context every time the server is loaded.

Does the io.github.financeratecalc/frc-mcp server require authentication?

No. We connected to io.github.financeratecalc/frc-mcp without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

Is the io.github.financeratecalc/frc-mcp server still maintained?

io.github.financeratecalc/frc-mcp is still listed as active in the MCP registry. We last reached this channel on 6 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What did VerifyMCP test on the io.github.financeratecalc/frc-mcp server?

VerifyMCP ran 13 checks on io.github.financeratecalc/frc-mcp, covering TLS certificate, Authorization, HTTPS, HSTS header and 9 more. Supply Chain Security and Provenance & Transparency do not apply to a hosted endpoint, so they were not tested. The score does not measure everything, and the scoring documentation lists what it leaves out.