A robots.txt rule on your image is now a warning rather than an error, because the card keeps its title and description and loses only the picture — the level and the message had been contradicting each other. The wording is also only as strong as each platform’s own documentation: X publishes that Twitterbot implements Google’s robots.txt specification, while Facebook reserves the right to bypass robots.txt for integrity checks, so we no longer state the two as though they were the same fact. And if a page’s <head> runs past the 300 KB we read, the tool says so instead of reporting the tags it never reached as missing — that window was 200 KB, set when the parser was far slower, which quietly made us stricter than the platforms we report on.
Each entry in the API’s checks array carries an id — title.long, image.refused-allowlisted, robots.image-blocked — alongside its English. Key off the id: the wording is free to improve, and four messages were reworded in a single afternoon this month because they claimed more than the tool had measured. Anything matching on their text would have quietly stopped matching, which is the failure an id exists to prevent. Renaming one is treated as a breaking change.
The preview now shows what each of X, Facebook, LinkedIn, WhatsApp and Slack would actually resolve from your tags, grouped by the answer rather than repeated five times. Where a page points og:image and twitter:image at different files, both are fetched and measured, because reporting one of two deliberately different pictures describes a card half the audience never sees. Slack is its own case: its documentation says it reads both namespaces and has never published which one wins, so where your two disagree the tool says it does not know instead of picking one.
If a site turns our crawler away, the tool now asks again as Facebook’s crawler and X’s before saying anything about your card. A site that allowlists the crawlers it recognises refuses us and serves them, and one that blocks bots outright refuses everybody — identical from our side, opposite for you. It used to report the second every time it saw the first. The same fix applies to an image your CDN refuses, and a robots.txt rule on your image now says your card loses its picture rather than that it will not render at all.
Give the tool a bare domain and it reads the sitemap, groups the URLs by shape and checks one page per template rather than all of them. A four-thousand-page blog is usually one template, and checking all four thousand costs four thousand times what checking one does to prove the same thing. It says which shapes it skipped and how many pages it did not look at, because a scan that quietly stops short reads exactly like one that found nothing wrong.
GET /og/quota returns your limit, what you have used, what remains and when it resets — and does not itself count against the allowance. A refused call now names that endpoint rather than only saying no, so a script can back off against a number instead of guessing. It also says how to raise the limit, which was documented on the website and nowhere the API itself would tell you.
Portrait photos are no longer reported as landscape
Social card preview
A phone photo is usually stored a quarter turn from the way it displays, and the tool was judging the stored numbers. That called a portrait image landscape and pointed the crop advice at the wrong two edges — advice that was confidently wrong rather than absent, which is worse. Orientation is now read from the file, the way every platform reads it.
Pages that used to take the checker down
Social card preview
Three shapes of crafted markup could crash a request, and a robots.txt of forty-six bytes could hang one long enough to time out. A tool that breaks on your page tells you nothing about your card, so both are fixed and both now have generated cases behind them — a quarter of a million of them per run. The daily allowance was also being counted against a value the caller could set for themselves; it is now stamped at the edge, where it cannot be chosen.
A freeze marker whose timestamp could not be read was treated as stale and deleted, so enforcement stopped silently — during the incident the freeze was declared for. Freezes now fail closed, a rollout halted by one exits non-zero instead of reporting success, and a freeze declared mid-rollout stops the regions still to come.
Five new checks, including the one you can't see yourself
Social card preview
The tool now fetches each page twice, once as a platform crawler and once as a browser, and tells you when the two differ. That catches the failure you cannot see yourself: a consent wall or bot gate makes a card that is broken only when shared, and you always look with a browser. It also reads robots.txt, which Facebook honours when fetching og:image, so a disallowed path is a card that silently never renders. A failed image now says which of blocked, too large or not-an-image it was, since each has a different fix. Title length is counted in glyphs, so emoji no longer trigger a truncation warning they did not earn. And og:url is checked against the page it was found on, not just the domain.
Social card preview is linked from the home page
Site
It was one click deep under Products. It is free and needs no sign-up, so it now sits on the front page where people arrive.
API keys, and a documented free allowance
Social card preview
The API stays open and anonymous by default. Identifying yourself raises the daily allowance, and a free key raises it further — issued by hand, revocable, and counted per key rather than per address.
Faster pages, and fixes for keyboard and screen-reader users
Site
Split the 404 page's game into its own bundle, so every other page ships 21 KB of script instead of 114 KB. Preloaded the font that decides when the page looks finished. Fixed a duplicate element id, a chart that shifted the layout as it loaded, and a wordmark that was invisible in dark mode.
Agent-native setup with MCP
ebman
ebman mcp setup gets an agent talking to Elastic Beanstalk in one command, and ebman is listed in the MCP Registry.
Just shipped shows real versions
Site
The home page strip shows each product's live version and release date, read at build time, instead of a hand-written label that went stale.
Social card preview 
ebman
candor