Glossary

Terms Orbilo uses on screen, and the ones from the standards you will meet alongside them.

Product terms

Check One assessment of a site against one standard, run from outside. Produces a grade, or one of the states below.

Could not tell / indeterminate A check that did not complete — rate limited, timed out, or a server error. Deliberately distinct from "not implemented", and it never produces a grade, never opens or closes an issue, and never sends an alert.

Event One recorded WebMCP tool call. The unit your monthly allowance is measured in, and the only thing collected.

Grade A to F, or N/A. Capped by failures rather than derived from the score alone — see reading a report.

Issue A problem tracked from when it appears until it stops. Opens, stays open, resolves. See issues.

Visit Tool calls grouped by the hour, so one agent calling a tool forty times does not read as forty arrivals. Deliberately too coarse to identify anybody.

Site key Identifies your site to the page snippet. Public by design: it appears in your page source, and can report tool calls for one site and nothing else.

Standards and protocols

Agent Software acting on a person's behalf — finding products, comparing options, filling carts. Distinct from a crawler, which reads pages to build an index or train a model. See AI crawlers vs AI agents.

Capability A named thing a UCP profile declares it supports, in reverse-domain form such as dev.ucp.shopping.checkout. Its schema URL must be served from the authority its namespace implies.

JWK JSON Web Key, the format keys are published in. A d member in a published key is a private key and should never appear in a public profile — the highest-severity finding a check can produce.

MCP Model Context Protocol. The standard for exposing tools to language models. WebMCP is its in-browser form.

Profile The JSON document served at /.well-known/ucp describing what a business sells and how to transact with it. Must be served over HTTPS, without redirects, with a public Cache-Control.

Tool An action a page offers an assistant through WebMCP — search the catalogue, add to cart. Registered by JavaScript at runtime and called inside the agent's browser, which is why only a page script can observe one and no server log ever will.

UCP Universal Commerce Protocol. Commerce-specific, and versioned by date (2026-04-08) rather than semver.

Web Bot Auth Signed HTTP requests (RFC 9421) that let an agent cryptographically prove who it is, via Signature-Agent and a published key directory. Relevant to how agents identify themselves to your server; Orbilo does not read your server's requests, so it plays no part in what we record.

WebMCP The browser API that lets a page hand an assistant tools it can call. Applies to almost any interactive site, not only commerce.

Well-known path A URL under /.well-known/ reserved for machine-readable metadata. Public by design, and nothing browsing normally requests one.