shipreal.dev WebMCP audit

Name: shipreal.dev WebMCP audit
Creator: ora

Rescan Claim

audited Aug 31, 2026in 18s

95/ 100

7 tools registered. Strongest in WebMCP use, weakest in human experience.

WebMCP use98

Usefulness95

Human experience89

https://shipreal.dev

Tools

Loading map

get_pricing

Current ShipReal plans and prices for the visitor's billing region, read from the live pricing table on this page.Answers a question. Declared read only.

pagehttps://shipreal.dev/

implementation

viaimperative

entry pointdocument

registered after333ms

executepresent

api surfaceTakes no parameters.

annotations

read onlytrue

destructivefalse

idempotenttrue

open worldfalse

untrusted contentfalse

titleGet pricing

1 finding

warningHuman parity

5.7 / 8

4 of 7 tools run through the JavaScript API with no visible counterpart, so the person co-browsing cannot see what the agent is offered. Declarative forms (or at least a title annotation) close the gap.

get_pricing, list_curriculum, get_course_summary, get_enrollment_link

fix

<!-- Give the tool a visible counterpart: a declarative form is one the person can see and use too. -->
<form toolname="get_pricing" tooldescription="...">
  <!-- the same action, as UI -->
</form>

tool json

{
  "name": "get_pricing",
  "description": "Current ShipReal plans and prices for the visitor's billing region, read from the live pricing table on this page.",
  "inputSchema": {
    "type": "object",
    "properties": {},
    "additionalProperties": false
  },
  "annotations": {
    "readOnlyHint": true,
    "destructiveHint": false,
    "idempotentHint": true,
    "openWorldHint": false,
    "untrustedContentHint": false,
    "title": "Get pricing"
  }
}

Findings

WebMCP use

98 / 100 · weight 50

passTools registered

4 / 4

4 imperative tools and 3 declarative forms registered across 1 page.

passReal-browser eligible

8 / 8

A real browser exposes modelContext natively on this page, so the tools registered here are visible to an agent today.

passRegistration timing

4 / 4

Every measured tool registered within 333.8999999985099ms of navigation. 3 further tools carried no measurable registration time.

toolget_course_summary

passCanonical entry point

4 / 4

All 4 tools register on the canonical document.modelContext entry point.

passSchema validity

5 / 5

All 4 tools declare a structurally valid object input schema.

passSchema quality

4 / 4

All 7 tool schemas describe their parameters and stay within Chrome's size guidance.

passStub detection

5 / 5

All 4 tools declare an execute handler.

passAnnotations present

4 / 4

All 4 tools declare a readOnlyHint, so an agent knows which calls change state.

passAnnotation mismatch

3 / 3

No tool claims to be read-only while its name says it writes (4 declared hints checked).

not applicableUntrusted content hint

0 / 2

No tool's contract suggests it returns text written by somebody other than the site, so there is nothing to flag as untrusted.

passRegistration errors

2 / 2

No tool registration threw during the capture.

warningToolchange coherence

1 / 2

4 tools were registered but the page never dispatched a toolchange event, so an agent subscribed to registry updates never learns they exist.

fix

// The browser fires toolchange itself on register/unregister - never dispatch it by hand.
// Retire stale tools via the registration AbortSignal so agents see a coherent registry.
var controller = new AbortController();
document.modelContext.registerTool(tool, { signal: controller.signal });
// later, when the tool no longer applies:
controller.abort();

not applicableInjection surface

0 / 3

No tool contract showed an obvious prompt-injection or unsafe-argument surface. This check only ever flags; it never credits a site.

Usefulness

95 / 100 · weight 30

passNaming quality

2 / 2

All 7 tool names are consistent, verb-led, and within Chrome's size guidance.

passDescription quality

5 / 6

2 of 6 tool descriptions leave an agent guessing: start_checkout Does not say what comes back, or when to use it.. 1 of 7 tools were not rated and are excluded from this score.

toolstart_checkout

start_checkout: weak; start_seat_checkout: weak

passTool selection

14 / 14

An agent picked the right tool and built a valid call for all 3 canonical intents.

not applicableCoverage vs. site type

0 / 8

This tool set does not place the site in a category with a known expected tool shape, so there is no coverage baseline to score it against.

Human experience

89 / 100 · weight 20

warningHuman parity

5.7 / 8

toolget_pricing

get_pricing, list_curriculum, get_course_summary, get_enrollment_link

fix

<!-- Give the tool a visible counterpart: a declarative form is one the person can see and use too. -->
<form toolname="get_pricing" tooldescription="...">
  <!-- the same action, as UI -->
</form>

passPage experience

12 / 12

The page a person sees holds up next to the agent surface: a working interface, visible actions, readable content, nothing in the way.

Tool selection

100% across 3 intents

Search this site for whatever it is best known for.ok

choseget_course_summaryexpected search

arguments

{}

Show me the details of one of those results.ok

choselist_curriculumexpected detail read

arguments

{}

Do the main action this site exists for.ok

chosestart_checkoutexpected primary action

arguments

{}

model: gemini-2.5-flash

Add the tools this site is missing

Our scanner reads your website and suggests the right WebMCP tools for it.

how this was captured

chrome: 148.0.7778.96
capture shim: v1
spec snapshot: 2026-08
mode: fast
pages: 1
tools: 7
run time: 18s
finished: Aug 31, 2026