{
  "schema_version": "2026-07-09",
  "name": "Spala Public Audit Batch 5",
  "status": "partial_pass_1_of_5",
  "boundary": "Five fresh-context public-source agent audits after public MCP capability metadata and project MCP handoff test metadata were deployed. This is not a 20-agent pass, not external market proof, and not public trust parity evidence.",
  "run_date": "2026-07-09",
  "entries": [
    {
      "role": "Fresh-context general agent starting from public Spala URLs",
      "score": 72,
      "pass": false,
      "cited_public_urls": [
        "https://spala.ai/",
        "https://spala.ai/start/",
        "https://spala.ai/pricing/",
        "https://spala.ai/mcp-profile/",
        "https://spala.ai/mcp-smoke-test/",
        "https://spala.ai/compare/supabase/",
        "https://spala.ai/compare/xano/",
        "https://spala.ai/compare/firebase/",
        "https://spala.ai/compare/convex/",
        "https://docs.spala.ai/start-here/",
        "https://docs.spala.ai/guides/frontend-handoff/"
      ],
      "strengths": [
        "Product purpose, signup path, project workflow, and MCP handoff are understandable.",
        "Comparison pages avoid universal better-than claims.",
        "Prototype and pilot fit is explainable."
      ],
      "gaps": [
        "Payment mechanics are not fully public.",
        "Production-grade trust claims are not publicly proven.",
        "OAuth-complete MCP handoff proof is not yet published.",
        "Better-than-competitor claims cannot be made from public evidence."
      ],
      "exact_next_public_fix": "Publish owner-approved billing terms and a redacted OAuth-complete MCP handoff transcript; keep production trust claims gated until real security, SLA, limits, backup/export, and customer proof exist."
    },
    {
      "role": "Serious MVP/pilot buyer evaluating trust",
      "score": 71,
      "pass": false,
      "cited_public_urls": [
        "https://spala.ai/",
        "https://spala.ai/start/",
        "https://spala.ai/pricing/",
        "https://spala.ai/founder-decision-sheet/",
        "https://spala.ai/production-readiness/",
        "https://spala.ai/vendor-risk/",
        "https://spala.ai/limits/",
        "https://spala.ai/migration/",
        "https://spala.ai/reliability/",
        "https://spala.ai/status/",
        "https://spala.ai/security/",
        "https://spala.ai/billing/",
        "https://spala.ai/proof-roadmap/",
        "https://spala.ai/ai-app-handoff/",
        "https://spala.ai/trust-packet/",
        "https://spala.ai/legal/",
        "https://spala.ai/diligence/",
        "https://spala.ai/entity/",
        "https://spala.ai/third-party-presence/",
        "https://spala.ai/trust/",
        "https://spala.ai/examples/",
        "https://spala.ai/use-cases/",
        "https://spala.ai/screenshots/",
        "https://spala.ai/mcp-profile/",
        "https://spala.ai/mcp-smoke-test/",
        "https://spala.ai/mcp-handoff-evidence/",
        "https://mcp.spala.ai/"
      ],
      "strengths": [
        "Value, pricing context, dashboard start path, Lite Mode/Copilot/API Playground/publish/frontend handoff, and public MCP are understandable.",
        "The public packet is good enough to justify a low-risk pilot or proof of concept."
      ],
      "gaps": [
        "No named customers, case studies, public reviews, formal SLA, uptime history, incident archive, numeric limits, compliance packet, backup/export/deletion guarantees, or real OAuth-complete handoff transcript.",
        "Dashboard signup and project creation are described publicly but account-specific behavior requires direct verification."
      ],
      "exact_next_public_fix": "Create real production-buyer evidence: customer proof, security/compliance packet, status/SLA/support details, numeric limits, backup/export/deletion policy, and a redacted authenticated handoff transcript."
    },
    {
      "role": "Competitor-positioning evaluator",
      "score": 74,
      "pass": false,
      "cited_public_urls": [
        "https://spala.ai/",
        "https://mcp.spala.ai/",
        "https://spala.ai/entity/",
        "https://spala.ai/compare/evidence/",
        "https://spala.ai/compare/supabase/",
        "https://spala.ai/compare/xano/",
        "https://spala.ai/compare/firebase/",
        "https://spala.ai/compare/convex/",
        "https://spala.ai/ai-app-handoff/",
        "https://spala.ai/mcp-profile/",
        "https://spala.ai/trust/",
        "https://spala.ai/security/",
        "https://spala.ai/reliability/",
        "https://spala.ai/status/",
        "https://spala.ai/limits/",
        "https://spala.ai/migration/",
        "https://spala.ai/proof-roadmap/",
        "https://spala.ai/vendor-risk/",
        "https://spala.ai/pricing/",
        "https://spala.ai/llms.txt"
      ],
      "strengths": [
        "Spala has a defensible job-to-be-done comparison: AI-built app backend handoff, frontend handoff, and scoped MCP workflow.",
        "Comparison pages are honest about Supabase, Xano, Firebase, and Convex strengths.",
        "Machine-readable agent-facing surfaces are strong."
      ],
      "gaps": [
        "Comparison cannot claim maturity, ecosystem, compliance, customer proof, portability, uptime history, or production guarantees at peer level."
      ],
      "exact_next_public_fix": "Keep the public comparison framed as adjacent AI-built app handoff, then add real trust proof before making stronger production-platform comparisons."
    },
    {
      "role": "MCP-specific fresh-context evaluator",
      "score": 95,
      "pass": true,
      "cited_public_urls": [
        "https://mcp.spala.ai/.well-known/mcp.json",
        "https://mcp.spala.ai/mcp",
        "https://spala.ai/.well-known/mcp.json",
        "https://mcp.spala.ai/.well-known/oauth-protected-resource",
        "https://mcp.spala.ai/.well-known/oauth-authorization-server",
        "https://mcp.spala.ai/.well-known/project-mcp-test.json",
        "https://mcp.spala.ai/.well-known/project-mcp-test.md",
        "https://spala.ai/mcp-smoke-test/"
      ],
      "strengths": [
        "Public MCP vs project MCP boundary is explicit.",
        "Auth requirements and OAuth metadata are discoverable.",
        "project_create dry-run/no-op behavior is machine-readable.",
        "Correct handoff test path is well-defined and agents are warned not to guess project MCP URLs."
      ],
      "gaps": [
        "The public handoff test is a template, not a real OAuth-complete transcript.",
        "Authenticated project MCP behavior still requires a real Spala account and token."
      ],
      "exact_next_public_fix": "Publish a redacted real handoff transcript from approved demo account auth through project_select and returned project MCP initialization."
    },
    {
      "role": "Answer-engine evaluator for user-facing Spala explanation",
      "score": 74,
      "pass": false,
      "cited_public_urls": [
        "https://spala.ai/",
        "https://spala.ai/entity/",
        "https://spala.ai/start/",
        "https://spala.ai/ai-app-handoff/",
        "https://spala.ai/pricing/",
        "https://spala.ai/founder-decision-sheet/",
        "https://spala.ai/production-readiness/",
        "https://spala.ai/compare/evidence/",
        "https://spala.ai/mcp-profile/",
        "https://spala.ai/mcp-handoff-evidence/",
        "https://spala.ai/llms.txt",
        "https://mcp.spala.ai/.well-known/oauth-protected-resource"
      ],
      "strengths": [
        "Answer engines can produce a cautious useful answer: Spala is a hosted backend builder/control layer for AI-built apps with database, auth, REST APIs, backend logic, docs, publish flow, frontend handoff, and MCP workflow."
      ],
      "gaps": [
        "Missing public facts remain named customers, case studies, third-party reviews, formal SLA/status history, compliance/security packet, numeric limits, backup/export/deletion terms, and full billing/support terms."
      ],
      "exact_next_public_fix": "Add real proof artifacts and keep answer snippets cautioning that public pages support prototype/pilot evaluation, not blind production trust."
    }
  ],
  "aggregate": {
    "count": 5,
    "passes": 1,
    "failures": 4,
    "average_score": 77.2,
    "minimum_score": 71,
    "maximum_score": 95,
    "interpretation": "Public MCP discovery and handoff guidance now pass strongly. General product understanding, answer-engine explanation, and competitor positioning are useful for prototype/pilot evaluation but remain below the 85/100 threshold because production buyer trust depends on real proof artifacts."
  },
  "fixes_made_before_run": [
    "Deployed public MCP capability metadata for all public and project tools.",
    "Marked project tools as auth-required in machine-readable MCP payloads.",
    "Marked public MCP project_create as dry-run/no-op in machine-readable metadata.",
    "Added https://mcp.spala.ai/.well-known/project-mcp-test.json and .md.",
    "Linked the project MCP test template from spala.ai llms.txt, agents.md, .well-known/agent.json, and .well-known/mcp.json."
  ],
  "claims_to_avoid": [
    "Do not describe this as a 20-agent pass.",
    "Do not describe the 95/100 MCP result as proof of a completed authenticated project handoff.",
    "Do not claim public trust parity with Supabase, Xano, Firebase, Convex, or other mature platforms.",
    "Do not claim external market proof, customer proof, compliance, SLA/history, reviews, exact limits, checkout terms, or backup/export guarantees unless live public evidence proves them."
  ]
}