One URL. Six tools. No key to read anything.

Orbylon answers the three questions an agent has about a business it has never seen before. Can I find what it sells. Can I prove this is really them. Can I pay them without a human in the loop. Everything below is live today.

{
  "mcpServers": {
    "orbylon": {
      "type": "http",
      "url": "https://orbylon.com/api/mcp"
    }
  }
}

Streamable HTTP. Listed in the official Model Context Protocol registry as com.orbylon/readiness, under a DNS-verified namespace. Manifest at /.well-known/mcp.json.

The tools

Six calls, and what each one hands back.

scan_business_readiness

Scan a business website and report whether AI agents can find, trust, and pay it.

Sixteen checks with a pass, fail or warning and the evidence behind each, a score per pillar, a grade, and a link to the public report.

lookup_business

Return the verified identity record for a domain, including its domain-bound public key.

The domain, when it was verified, and its Ed25519 public key. Anything that business signs can be checked against this key without trusting us.

list_business_offerings

Return the catalogue a verified business publishes, with prices as the business set them.

Items with names, prices and currency, plus a payment address when the business publishes one. Payment settles to the business, never to Orbylon.

list_business_paid_endpoints

Return the priced calls a verified business sells. Each answers HTTP 402 with x402 terms and settles to the business. A call that fails is not charged for.

One entry per priced call, each with the URL to call. Calling it without paying returns 402 with the exact terms.

check_business_token

Check what is left on a gift card, prepaid pass, membership or points balance issued by a business. Closed loop: good only with the business that issued it, never cashable.

What the code is worth and whether it is still valid. Never the holder's name or address, because the code alone is what entitles somebody to ask.

list_verified_businesses

List businesses with a verified, domain-bound identity, newest first.

Domains and verification dates, newest first.

Without MCP

Plain HTTP, if that is easier.

Every tool above is a thin wrapper over an endpoint you can call directly. All of these are readable with no key and no account. JSON in, JSON out.

POST /api/scanBody {"url": "example.com"}. Returns a slug. The report is public at /scan/<slug>.
POST /api/scan/fullThe same scan, returned in full and synchronously. Priced, see below.
GET /api/directoryEvery verified business, each with its domain-bound public key.
GET /api/id/<domain>One business's identity record. The human view is at /id/<domain>.
GET /api/store/<domain>What a business sells, at the prices it set.
GET /api/endpoints/<domain>The calls a business sells. Each answers 402 and settles to the business.
GET /api/tokens/<code>What a gift card, pass or membership is worth. No key: the code is the entitlement.
GET /api/proofs/<slug>A signed document or credential, re-checkable without trusting us.

The full machine-readable description of all of it lives at /llms.txt.

Paying for a call

Five cents, in USDC, with nobody signing up for anything.

The free scan returns a slug and puts the report on a web page. The paid one returns the whole thing in the response body, which is what you want if you are a program rather than a person. It costs five cents and it is bought the way the web was always supposed to let you buy things: you call it, it answers 402 with its terms, you pay, you call it again.

POST https://orbylon.com/api/scan/full
{"url": "example.com"}

402 Payment Required
Payment-Required: <base64 terms: exact scheme, USDC on Base, 0.05>

The terms are x402 version 2, carried in the header. Discovery is at /.well-known/x402. Settlement happens only after a successful answer, so a scan that fails costs nothing. We take payment for our own endpoint and we never touch money moving between an agent and one of the businesses in the directory: those settle straight to the business's own address.

Building the other side of this? Put your business in the directory.

Proving you own a domain takes one DNS record. After that anything you sign can be checked by any agent against a key bound to your domain, and what you sell is readable by a machine that has never heard of you.

Claim a verified identity