ora.ai WebMCP audit

Rescan
audited Aug 29, 2026in 12s
79/ 100

3 tools registered. Strongest in usefulness, weakest in human experience.

WebMCP use74
Usefulness98
Human experience60
about:blank

No agent run recorded yet.

Tools

Loading map
scan_domain: warning

scan_domain

Run an Ora agent-readiness scan for a domain or MCP server URL. Returns the 0-100 score, grade, and per-layer breakdown; a recent stored result is served from cache instead of rescanning.Takes an action on the site.
pagehttps://ora.ai/
implementation
viaimperative
entry pointdocument
registered after105ms
executepresent
api surface
urlrequired
annotations
read onlynot declared
destructivenot declared
idempotentnot declared
open worldnot declared
untrusted contentnot declared
titlenot declared
3 findings
warningNaming quality
1.7 / 2
Tool naming makes selection harder than it needs to be: 1 name does not start with a verb (scan_domain).
fix
{ name: "scan_domain" /* short, unique, verb-based */ }
warningAnnotations present
2.7 / 4
1 of 3 tools declare no readOnlyHint, so an agent cannot tell a read from a write without guessing from the name.
scan_domain
fix
{
  name: "scan_domain",
  annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true }
}
warningHuman parity
0 / 8
3 of 3 tools run through the JavaScript API with no visible counterpart, so the person co-browsing cannot see what the agent is offered. Declarative forms (or at least a title annotation) close the gap.
scan_domain, get_score, get_leaderboard
fix
<!-- Give the tool a visible counterpart: a declarative form is one the person can see and use too. -->
<form toolname="scan_domain" tooldescription="...">
  <!-- the same action, as UI -->
</form>
tool json
{
  "name": "scan_domain",
  "description": "Run an Ora agent-readiness scan for a domain or MCP server URL. Returns the 0-100 score, grade, and per-layer breakdown; a recent stored result is served from cache instead of rescanning.",
  "inputSchema": {
    "type": "object",
    "properties": {
      "url": {
        "type": "string",
        "description": "Domain or URL to scan, e.g. stripe.com"
      }
    },
    "required": [
      "url"
    ],
    "additionalProperties": false
  },
  "annotations": {}
}
Showing scan_domain

Findings

WebMCP use

74 / 100 · weight 50
passTools registered
4 / 4
3 tools registered across 1 page.
failReal-browser eligible
0 / 8
The page's code registers these tools, but a real visitor's browser does not get them yet: WebMCP needs a native modelContext or a current origin trial token, and this page has neither.
passRegistration timing
4 / 4
Every measured tool registered within 105.30000000074506ms of navigation.
toolget_leaderboard
passCanonical entry point
4 / 4
All 3 tools register on the canonical document.modelContext entry point.
passSchema validity
5 / 5
All 3 tools declare a structurally valid object input schema.
warningSchema quality
2.7 / 4
1 of 3 tool schemas are harder for an agent to use than they need to be: get_leaderboard declares no required list, so an agent cannot tell which parameters are mandatory.
toolget_leaderboard
get_leaderboard: declares no required list, so an agent cannot tell which parameters are mandatory
fix
{
  name: "get_leaderboard",
  inputSchema: {
    type: "object",
    properties: {
      query: { type: "string", description: "What to search for" }
    },
    required: ["query"]
  }
}
passStub detection
5 / 5
All 3 tools declare an execute handler.
warningAnnotations present
2.7 / 4
1 of 3 tools declare no readOnlyHint, so an agent cannot tell a read from a write without guessing from the name.
toolscan_domain
scan_domain
fix
{
  name: "scan_domain",
  annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true }
}
passAnnotation mismatch
3 / 3
No tool claims to be read-only while its name says it writes (2 declared hints checked).
not applicableUntrusted content hint
0 / 2
No tool's contract suggests it returns text written by somebody other than the site, so there is nothing to flag as untrusted.
passRegistration errors
2 / 2
No tool registration threw during the capture.
warningToolchange coherence
1 / 2
3 tools were registered but the page never dispatched a toolchange event, so an agent subscribed to registry updates never learns they exist.
fix
document.modelContext.dispatchEvent(new Event("toolchange"));
not applicableInjection surface
0 / 3
No tool contract showed an obvious prompt-injection or unsafe-argument surface. This check only ever flags; it never credits a site.

Usefulness

98 / 100 · weight 30
warningNaming quality
1.7 / 2
Tool naming makes selection harder than it needs to be: 1 name does not start with a verb (scan_domain).
toolscan_domain
fix
{ name: "scan_domain" /* short, unique, verb-based */ }
passDescription quality
6 / 6
All 3 rated tool descriptions say what the tool does, when to use it, and what it returns.
passTool selection
14 / 14
An agent picked the right tool and built a valid call for all 3 canonical intents.
not applicableCoverage vs. site type
0 / 8
This tool set does not place the site in a category with a known expected tool shape, so there is no coverage baseline to score it against.

Human experience

60 / 100 · weight 20
warningHuman parity
0 / 8
3 of 3 tools run through the JavaScript API with no visible counterpart, so the person co-browsing cannot see what the agent is offered. Declarative forms (or at least a title annotation) close the gap.
toolscan_domain
scan_domain, get_score, get_leaderboard
fix
<!-- Give the tool a visible counterpart: a declarative form is one the person can see and use too. -->
<form toolname="scan_domain" tooldescription="...">
  <!-- the same action, as UI -->
</form>
passPage experience
12 / 12
The page a person sees holds up next to the agent surface: a working interface, visible actions, readable content, nothing in the way.

Tool selection

100% across 3 intents
Search this site for whatever it is best known for.ok
choseget_leaderboardexpected search
arguments
{}
Show me the details of one of those results.ok
choseget_scoreexpected detail read
arguments
{
  "domain": "stripe.com"
}
Do the main action this site exists for.ok
chosescan_domainexpected primary action
arguments
{
  "url": "stripe.com"
}
model: gemini-2.5-flash

Add the tools this site is missing

Our scanner reads your website and suggests the right WebMCP tools for it. Implement one snippet of code to go live.
Reads this site's public pages. Takes a few seconds.
how this was captured
chrome
148.0.7778.96
capture shim
v1
spec snapshot
2026-08
mode
fast
pages
1
tools
3
run time
12s
finished
Aug 29, 2026