Orbylon
by orbylon.com · remote · no sign-in to list tools · v1.5.0 · published by com.orbylon
Check that a business proved who it is, read what it sells, and order straight from it.
9 tools: 1 can delete or cancel things, 3 change things and 5 only read.
Scanned Oct 21, 2026
- Deletes or cancels1Claude Code: deny: see these tools
- Can't be undone0Claude Code: ask
- Changes things3Claude Code: ask: see these tools
- Only reads5Claude Code: allow: see these tools
1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.
claude mcp add --transport http readiness https://orbylon.com/api/mcpFindings
Matches of fixed checks, with the text they matched.
The server marks "check_business_token" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "return": a word for reading.
Tools
Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.
9 tools
Deletes or cancels 1Claude Code: deny
place_orderOrder an item a verified business publishes (see list_business_offerings or find_businesses).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Order an item a verified business publishes (see list_business_offerings or find_businesses). Two steps. First call without confirm: it places nothing and returns the seller, the item, the quantity, the unit price, the full total, the currency, how payment happens, and the refund and cancelling terms. Show those to the customer. Then call again with the same fields and confirm: true, only after the customer agreed. The order goes straight to the business, where it already works: email, its own store or its own system, and the answer carries a reference to pass to get_order_status. When the business connected a payment account (Stripe, PayPal, Mollie, Razorpay, Lemon Squeezy or Paddle), the answer carries a pay_url on that account; the money goes to the business, never to Orbylon. For an appointment, the answer can carry a book_url where the buyer chooses the time on the business's own booking page.
Annotations the server declares
- title: Order from a verified business
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: false
- openWorldHint: true
Changes things 3Claude Code: ask
check_business_tokenReturn what is left on a closed-loop token issued by a business through Orbylon: a gift card, prepaid hours, a membership or a points balance.1 finding
Why it is in this group
- The description's first verb is "return": a word for reading.
- The input takes a statement or command to run (input.code), which can change anything it can reach.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "check_business_token" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "return": a word for reading.
Description, as the server wrote it Return what is left on a closed-loop token issued by a business through Orbylon: a gift card, prepaid hours, a membership or a points balance. Takes the code printed on the card. The amount left is balance_cents for a gift card (integer cents, in currency), balance_hours for prepaid hours or balance_points for points, and reads_as says it in words, money written like every price here (e.g. CA$25.00 left); a membership is only valid or not. These are not money and cannot be cashed out or transferred: they are only good with the business that issued them, which is named in the answer.
Annotations the server declares
- title: Check a gift card, pass or membership
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
request_quoteAsk a verified business for a quote on an item it lists as price on request (price_on_request: true in list_business_offerings): a roofer, a lawyer, a garage.No findings
Why it is in this group
- The name "request_quote" says "request": a word for a change.
Description, as the server wrote it Ask a verified business for a quote on an item it lists as price on request (price_on_request: true in list_business_offerings): a roofer, a lawyer, a garage. The request is emailed to the business, which replies to the customer with its price. Nothing is paid or owed and no wallet is needed. Ask the customer first and send consent: true only if they agreed that their name, contact and request go to the business. Returns a reference and a status URL.
Annotations the server declares
- title: Ask a verified business for a quote
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
scan_business_readinessScan any business website and report whether AI agents can find, trust, and pay it.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Scan any business website and report whether AI agents can find, trust, and pay it. Returns pillar scores, a grade, per-check evidence, and a link to the report (it opens for whoever has the link and is not listed anywhere).
Annotations the server declares
- title: Scan business readiness
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
Only reads 5Claude Code: allow
find_businessesFind businesses that sell what the customer needs in the place they name, for example need "espresso beans" and place "Montreal", or need "plumber" and place "H2X".No findings
Why it is in this group
- The name "find_businesses" says "find": a word for reading.
Description, as the server wrote it Find businesses that sell what the customer needs in the place they name, for example need "espresso beans" and place "Montreal", or need "plumber" and place "H2X". Both are required. Searches businesses published on Orbylon whose owners proved they own their website, by the words of what they sell and the place they named. Results are ordered by how closely those words match, then by name. No business pays to rank higher, and a business that is not on Orbylon is not here. Each result gives the business's name, city, address, hours and phone as its owner confirmed them, what it sells with exact prices, and which tool to use next: place_order for a priced item, request_quote for an item priced on request, list_business_offerings for the full list. At most 10 results. To try it on Orbylon's fictional test businesses, use the place "Orbylon Test City".
Annotations the server declares
- title: Find businesses by need and place
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_order_statusReturn what happened to an order placed with place_order: its status, the item, the quantity, the total, and, when the business takes card payment, whether it is paid and the pay_u…No findings
Why it is in this group
- The name "get_order_status" says "get": a word for reading.
Description, as the server wrote it Return what happened to an order placed with place_order: its status, the item, the quantity, the total, and, when the business takes card payment, whether it is paid and the pay_url if not. Takes the business domain and the reference the order answer gave. Never returns the buyer's address, email or phone.
Annotations the server declares
- title: Check an order
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
list_business_offeringsReturn the machine-readable catalogue a verified business publishes.No findings
Why it is in this group
- The name "list_business_offerings" says "list": a word for reading.
Description, as the server wrote it Return the machine-readable catalogue a verified business publishes. Under owner_provided: who and where the business is, then each item with its name, description, integer price in cents, currency and unit, as the business typed them. Prices are exactly what the business published. An item with price_on_request: true has no price (it reads "Price on request"): the business quotes each job, so ask it with request_quote rather than estimate a number.
Annotations the server declares
- title: List what a verified business sells
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_business_paid_endpointsReturn the priced endpoints a verified business publishes: each with its title, what it does, the HTTP method, the price, and the URL to call.No findings
Why it is in this group
- The name "list_business_paid_endpoints" says "list": a word for reading.
Description, as the server wrote it Return the priced endpoints a verified business publishes: each with its title, what it does, the HTTP method, the price, and the URL to call. Calling that URL returns HTTP 402 with payment terms in the Payment-Required header, and the payment settles directly to the business. A call that fails is never charged for. A business that sells none answers an empty list with a note saying so.
Annotations the server declares
- title: List the calls a verified business sells
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
lookup_businessReturn the verified identity record for a domain: its domain-bound Ed25519 public key, when it was verified and how, and what it can prove: its signed documents (under capabilities…No findings
Why it is in this group
- The name "lookup_business" says "lookup": a word for reading.
Description, as the server wrote it Return the verified identity record for a domain: its domain-bound Ed25519 public key, when it was verified and how, and what it can prove: its signed documents (under capabilities.proofs.list, each with its slug, when it was signed, its SHA-256 and a verify link anyone can open) and a published catalogue of what it sells. Use this before trusting or transacting with a business. A 'not verified' answer means Orbylon has no proof about them, not that they are fraudulent.
Annotations the server declares
- title: Look up a verified business
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Install
Pinned to version 1.5.0. Values in angle brackets are yours to fill in.
claude mcp add --transport http readiness https://orbylon.com/api/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__readiness__find_businesses",
"mcp__readiness__lookup_business",
"mcp__readiness__list_business_offerings",
"mcp__readiness__get_order_status",
"mcp__readiness__list_business_paid_endpoints"
],
"ask": [
"mcp__readiness__scan_business_readiness",
"mcp__readiness__request_quote",
"mcp__readiness__check_business_token"
],
"deny": [
"mcp__readiness__place_order"
]
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as readiness. Review it before you use it.