Marketo Munchkin events check published query fields.

Partial advisory checks for the pinned Munchkin165 visitWebPage/clickLink query producer on mktoresp.com and its tenant subdomains. Exact _mchVr=165 plus the generated _mchNc carrier select this profile. Three stable location-key presences and captured GET/POST transport are checked. IDs, tokens, URL/link values, coercion branches, other versions and receiver acceptance remain open; the loader is not a collector.

What this pack matches

Hosts: mktoresp.com
Paths: /webevents/visitWebPage, /webevents/clickLink
Vendor docs: munchkin.marketo.net/165/munchkin.js

Rules

Codes are stable. A finding in CI, MCP, or the playground lands on the same id.

Field	Required	What it checks	Rule ids	Source
`_mchVr`	optional	The literal version marker identifies the pinned producer only. This is selection evidence, not a receiver-wide version enum. Presence diagnostic severity: warning.		docs
`_mchNc`	optional	The source emits this query carrier in the generated route. Values remain open, with no timestamp spelling, time-window or cache-uniqueness rule. Presence diagnostic severity: warning.		docs
`_mchHo`	recommended	The actual x constructor supplies the current page hostname before Q serializes it. Only key presence is advised; repeated or empty configured values remain open. Presence diagnostic severity: warning.	`vendor.marketo-munchkin-events.param._mchHo.missing`	docs
`_mchPo`	recommended	The actual constructor supplies the page port, commonly an empty string. No nonempty or numeric-port grammar is imposed. Presence diagnostic severity: warning.	`vendor.marketo-munchkin-events.param._mchPo.missing`	docs
`_mchPc`	recommended	The actual constructor supplies the page protocol. Only key presence is advised, without an inferred scheme enum or HTTPS-only requirement. Presence diagnostic severity: warning.	`vendor.marketo-munchkin-events.param._mchPc.missing`	docs
`method`	recommended	Q uses bodyless sendBeacon POST, or GET through XHR/image fallback. No body or MIME requirement is imposed. Complete HTTP capture contract. Presence diagnostic severity: warning.	`vendor.marketo-munchkin-events.http.method.missing` `vendor.marketo-munchkin-events.http.method.empty` `vendor.marketo-munchkin-events.http.method.invalid`	docs

Validate a payload

pixellint validate request @request.json --rulepack vendor/marketo-munchkin-events

Try this failing payload in the playground. An example with a validation finding.

{"url":"https://123-xyz-456.mktoresp.com/webevents/visitWebPage?_mchNc=1792886400000&_mchCn=&_mchId=123-XYZ-456&_mchTk=_mch-publisher.example-12345678123456781234567812345678&_mchPo=&_mchRu=%2Farticle&_mchPc=https%3A&_mchVr=165&_mchEcid=&_mchHa=%23section&_mchRe=https%3A%2F%2Freferrer.example%2Fsource&_mchQp=one%3D1__-__two%3D2","method":"POST","headers":{}}

cargo install pixellint · npm install pixellint