scvd.store WebMCP audit

Name: scvd.store WebMCP audit
Creator: ora

audited Aug 31, 2026in 42s

Agent-readyA real browser exposes modelContext natively on this page, and every registered tool declares a handler an agent can call.

75/ 100100% of the applicable check weight evaluated

5 tools registered. Every measured layer scored 0.

Shared experience0

Task completion0

Tool quality0

Trust0

https://scvd.store

Tools

5 read, 0 write

Loading map

read_store_guide

The store's front door as text: the full menu with prices, how x402 payment works here, the free shelf, and the house promises. Free. Completes when the guide text returns. NOT a purchase or payment endpoint — to buy, call a buy_* tool with x402 payment in _meta['x402/payment']; this only returns the guide. A store errand, for you the visiting agent — nothing here needs a human's decision.Answers a question. Declared read only.

pagehttps://scvd.store/

implementation

viaimperative

entry pointdocument

registered after923ms

executepresent

api surfaceTakes no parameters.

annotations

read onlytrue

untrusted contentnot declared

titleStore Guide

destructive (MCP-only)false

idempotent (MCP-only)true

open world (MCP-only)false

1 finding

warningHuman parity

weight 10

5 of 5 tools run through the JavaScript API with no visible counterpart, so the person co-browsing cannot see what the agent is offered. Declarative forms (or at least a title annotation) close the gap.

read_store_guide, preflight_endpoint, check_before_you_pay, check_conformance, verify_artifact

fix

// Make the tool's effect visible on the page the person is looking at:
// update the same UI your existing human flow uses when read_store_guide runs,
// so the person co-browsing sees what the agent just did.
execute: async (args, { signal }) => {
  const result = await performAction(args, signal);
  renderResultInPage(result); // the human-visible half of the same action
  return result;
}

tool json

{
  "name": "read_store_guide",
  "description": "The store's front door as text: the full menu with prices, how x402 payment works here, the free shelf, and the house promises. Free. Completes when the guide text returns. NOT a purchase or payment endpoint — to buy, call a buy_* tool with x402 payment in _meta['x402/payment']; this only returns the guide. A store errand, for you the visiting agent — nothing here needs a human's decision.",
  "inputSchema": {
    "type": "object",
    "properties": {},
    "additionalProperties": false
  },
  "annotations": {
    "readOnlyHint": true,
    "destructiveHint": false,
    "idempotentHint": true,
    "openWorldHint": false,
    "title": "Store Guide"
  }
}

Findings

Shared experience

0 / 100 · weight 30

warningHuman parity

weight 10

toolread_store_guide

read_store_guide, preflight_endpoint, check_before_you_pay, check_conformance, verify_artifact

fix

// Make the tool's effect visible on the page the person is looking at:
// update the same UI your existing human flow uses when read_store_guide runs,
// so the person co-browsing sees what the agent just did.
execute: async (args, { signal }) => {
  const result = await performAction(args, signal);
  renderResultInPage(result); // the human-visible half of the same action
  return result;
}

warningPage experience

weight 20

1 of 4 page-experience marks came back short: clarity The page is mostly text with no clear actions or purpose for a user..

clarity: poor

Task completion

0 / 100 · weight 25

failTool selection

weight 15

An agent chose an existing tool and built a schema-valid call that held up on 1 of 3 canonical intents; on "Show me the details of one of those results." no tool on the page served it. Nothing was executed, so this verifies selection, not outcomes.

not applicableCoverage vs. site type

weight 10

This tool set does not place the site in a category with a known expected tool shape, so there is no coverage baseline to score it against.

Tool quality

0 / 100 · weight 25

passRegistration timing

weight 1

Every measured tool registered within 924ms of navigation.

toolcheck_conformance

passCanonical entry point

weight 3

All 5 tools register on the canonical document.modelContext entry point.

passSchema validity

weight 4

All 5 declared input schemas are structurally valid object schemas.

warningSchema quality

weight 4

4 of 5 tool schemas are harder for an agent to use than they need to be: preflight_endpoint description is 741 characters, over Chrome's 500-character guidance.

toolpreflight_endpoint

preflight_endpoint: description is 741 characters, over Chrome's 500-character guidance; check_before_you_pay: description is 1227 characters, over Chrome's 500-character guidance; check_before_you_pa

fix

{
  name: "preflight_endpoint",
  inputSchema: {
    type: "object",
    properties: {
      query: { type: "string", description: "What to search for" }
    },
    required: ["query"]
  }
}

warningNaming quality

weight 2

Tool naming makes selection harder than it needs to be: 1 name does not start with a verb (preflight_endpoint).

toolpreflight_endpoint

fix

{ name: "preflight_endpoint" /* short, unique, verb-based */ }

passStub detection

weight 4

All 5 tools declare an execute handler.

passRegistration errors

weight 2

No tool registration threw during the capture.

passDescription quality

weight 5

All 5 rated tool descriptions say what the tool does, when to use it, and what it returns.

Trust

0 / 100 · weight 20

passAnnotations present

weight 6

All 5 tools declare a readOnlyHint, the one hint WebMCP defines for telling a read from a write.

passAnnotation mismatch

weight 6

No tool claims to be read-only while its name says it writes (5 declared hints checked).

not applicableUntrusted content hint

weight 4

No tool's contract suggests it returns text written by somebody other than the site, so there is nothing to flag as untrusted.

not applicableInjection surface

weight 4

No tool contract showed an obvious prompt-injection or unsafe-argument surface. This check only ever flags; it never credits a site.

Tool selection

33% across 3 intents

Search this site for whatever it is best known for.ok

choseread_store_guideexpected searchkind not applicable

arguments

{}

Show me the details of one of those results.missed

choseno toolexpected detail readkind not applicable

No tool was picked for this intent.

arguments

{}

Do the main action this site exists for.missed

choseno toolexpected primary actionkind not applicable

No tool was picked for this intent.

arguments

{}

model: gemini-2.5-flash

Add the tools this site is missing

Our scanner reads your website and suggests the right WebMCP tools for it.

The open source webmcp plugin teaches your coding agent to audit a site, implement tools on document.modelContext, and verify them in a real browser. npx @ora-ai/webmcp-verify runs the verification on its own. No signup, no hosted service.

how this was captured

observed via: native modelContext
chrome: 148.0.7778.96
capture shim: v1
spec snapshot: 2026-08
mode: fast
pages: 1 - entry page only
tools: 5
run time: 42s
finished: Aug 31, 2026

Checked the way in-browser agents discover tools: the top-level document's modelContext registry, read after the page settles.