smartretry.com WebMCP audit

Name: smartretry.com WebMCP audit
Creator: ora

Rescan

audited Oct 29, 2026in 9s

80/ 100Incomplete audit · 50% of the applicable check weight evaluated

3 tools registered. Strongest in tool quality, weakest in shared experience. Tool selection was not measured.

Shared experience50

Tool selectionN/A

Tool quality100

Trust100

https://smartretry.com

Tools

3 read, 0 write

Loading map

lookup_decline_code

Look up a card payment decline (issuer response) code or message and get what it means, which provider and group it belongs to, and whether it is worth retrying.Answers a question. Declared read only.

pagehttps://www.smartretry.com/

implementation

viaimperative

entry pointdocument

registered after270ms

executepresent

api surface

queryrequired

annotations

read onlytrue

untrusted contentnot declared

titlenot declared

1 finding

warningHuman parity

weight 8

3 tools run through the JavaScript API and the page itself was not graded on this run, so parity could not be confirmed. A visible effect in your existing UI when a tool runs closes the gap.

lookup_decline_code, estimate_failed_payment_loss, get_pricing_model

fix

// Make the tool's effect visible on the page the person is looking at:
// update the same UI your existing human flow uses when lookup_decline_code runs,
// so the person co-browsing sees what the agent just did.
execute: async (args, { signal }) => {
  const result = await performAction(args, signal);
  renderResultInPage(result); // the human-visible half of the same action
  return result;
}

tool json

{
  "name": "lookup_decline_code",
  "description": "Look up a card payment decline (issuer response) code or message and get what it means, which provider and group it belongs to, and whether it is worth retrying.",
  "inputSchema": {
    "type": "object",
    "properties": {
      "query": {
        "type": "string",
        "description": "A decline code such as \"05\" or \"51\", or a message such as \"do not honor\"."
      }
    },
    "required": [
      "query"
    ]
  },
  "annotations": {
    "readOnlyHint": true
  }
}

Findings

Shared experience

50 / 100 · weight 30

not applicableVisible effect

weight 6

Not invoked on this run: this audit did not call any tool. Scheduled re-audits only read the registry; a live audit from the report page calls the tools that declare readOnlyHint: true and not consequentialHint: true.

not measuredPage experience

weight 16

The page-experience model hop returned no usable result, so the page was not graded.

warningHuman parity

weight 8

3 tools run through the JavaScript API and the page itself was not graded on this run, so parity could not be confirmed. A visible effect in your existing UI when a tool runs closes the gap.

toollookup_decline_code

lookup_decline_code, estimate_failed_payment_loss, get_pricing_model

fix

// Make the tool's effect visible on the page the person is looking at:
// update the same UI your existing human flow uses when lookup_decline_code runs,
// so the person co-browsing sees what the agent just did.
execute: async (args, { signal }) => {
  const result = await performAction(args, signal);
  renderResultInPage(result); // the human-visible half of the same action
  return result;
}

Tool selection

not measured

not applicableInvoke success rate

weight 6

not measuredTool selection

weight 12

The tool-selection model hop returned no usable result.

not applicableCoverage vs. site type

weight 7

This tool set does not place the site in a category with a known expected tool shape, so there is no coverage baseline to score it against.

Tool quality

100 / 100 · weight 25

passRegistration timing

weight 1

Every measured tool registered within 271ms of navigation.

toolestimate_failed_payment_loss

passCanonical entry point

weight 3

All 3 tools register on the canonical document.modelContext entry point.

passSchema validity

weight 4

All 3 declared input schemas are structurally valid object schemas.

passSchema quality

weight 4

All 2 of 3 tool schemas that declare parameters describe them (the other 1 declares no parameters), and every description stays within Chrome's size guidance.

passNaming quality

weight 2

All 3 tool names are consistent, verb-led, and within Chrome's size guidance.

passStub detection

weight 4

All 3 tools declare an execute handler.

passRegistration errors

weight 2

No tool registration threw during the capture.

not measuredDescription quality

weight 5

The description-quality model hop returned no usable result, so descriptions were not rated.

Trust

100 / 100 · weight 20

passAnnotations present

weight 4

All 3 read-shaped tools declare readOnlyHint: true - the one declared claim that lets an agent treat a call as safe to make without asking.

passAnnotation mismatch

weight 4

No tool claims to be read-only while its own name or description says it writes (3 declared hints checked).

not applicableUntrusted content hint

weight 3

No tool's contract suggests it returns text written by somebody other than the site, so there is nothing to flag as untrusted.

not applicableConsequential hint

weight 3

No tool name reads like a consequential action (a purchase, a booking, a payment, a transfer, a deletion), so there is no consequentialHint to expect.

not applicableHint vs. observed

weight 3

not measuredInjection surface

weight 3

The injection-surface model hop returned no usable result, so tool contracts were not reviewed for injection surface.

Tool selection

The tool-selection model hop returned no usable result.

Add the tools this site is missing

Our scanner reads your website and suggests the right WebMCP tools for it.

The open source webmcp plugin teaches your coding agent to audit a site, implement tools on document.modelContext, and verify them in a real browser. npx @ora-ai/webmcp-verify runs the verification on its own. No signup, no hosted service.

how this was captured

observed via: capture shim (Chromium 151.0.7922.34)
chrome: 151.0.7922.34
capture shim: v3
spec snapshot: 2026-10-16
mode: fast
pages: 1 - entry page only
tools: 3
invoked: not invoked; a live audit calls them
run time: 9s
finished: Oct 29, 2026

Checked the way in-browser agents discover tools: the top-level document's modelContext registry, read after the page settles.