Skip to main content
Glama

Sato Hub: Build Onchain & Crypto Agents

by ai.satohub
OverviewDiscussionsAdmin

Check what an install can do with your keys and funds

onchain_agent_check_install
Read-onlyIdempotent

USE WHEN you are about to install a crypto package, MCP server or skill and want to know what it can do with your keys and funds: before npm/pnpm/yarn/bun add, npx -y, pip install, uvx or claude mcp add, or before pasting an {"mcpServers": …} config. NOT FOR a token, repo, endpoint or agent you were handed (use onchain_agent_preflight instead), install steps for a stack pick (use onchain_agent_get_deploy_spec), or an agent skill's disclosure (use onchain_agent_search_skills).

RETURNS a Sato Check custody summary for every target in the command or config you pass, answering four questions: does it take your key, does your key leave, can it move funds on its own, what changed.

Each answer rests on evidence of one class — declared (the project says so), traced (our static read of the published artifact) or observed (a sandbox run with planted test keys). A stored profile answers first; an unstored target is read live within a bounded budget. Targets that could not be profiled are listed in unresolved with the reason. has_observed_key_egress is true only when a planted test key was seen leaving — the one fact to stop on.

RULE ENFORCED: a profile describes what was read and run, with dates. It is not a safety rating, an audit or an endorsement; "unknown" means we could not look, and "none found" is not "not there". Local signing is what a wallet does.

RETURNS (json): { schema: "sato.custody/v1", subjects: [{ subject, summary: { key_access, key_egress, fund_action_count, notable, version, as_of, check_url }, answers: { key_access, key_egress, fund_actions, changes }, solana_receipt }], unresolved: [{ input, reason }], has_observed_key_egress }. solana_receipt is where that version's reading is recorded on Solana ({ attestation_address, explorer_url, cluster, as_of, digest_hex }), or null when none is. install/cmd/package/text are read as command, mcp/mcpServers as config (labelled); {} checks nothing and answers needs_input. Read-only.

Example: { command: "npm i viem @goat-sdk/core" } · { config: "{"mcpServers":{"wallet":{"command":"npx","args":["-y","some-wallet-mcp"]}}}" }

Input Schema

NameRequiredDescriptionDefault
cmdNoRead as `command`.
mcpNoRead as `config` (an MCP config block, as text or an object).
textNoRead as `config` when it is a JSON block, else as `command`.
configNoAn MCP config block as text, e.g. {"mcpServers": {...}}. A JSON object is read as its text. Up to 16 KB is checked.
commandNoAn install command, e.g. "npm i @solana/web3.js viem" or "claude mcp add wallet -- npx -y some-wallet-mcp".
installNoRead as `command`.
packageNoRead as `command` (an install command or package names).
mcpServersNoRead as `config`: { mcpServers: <this> }.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed8 schema fields changed
    • addedInput schema / properties / cmd
      Added value: +{
+  "description": "Read as `command`.",
+  "maxLength": 16384,
+  "type": "string"
+}
    • changedInput schema / properties / config / description
      Previous value: -"An MCP config block as text, e.g. {\"mcpServers\": {...}}."New value: +"An MCP config block as text, e.g. {\"mcpServers\": {...}}. A JSON object is read as its text. Up to 16 KB is checked."
    • changedInput schema / properties / config / maxLength
      Previous value: -16384New value: +262144
    • addedInput schema / properties / install
      Added value: +{
+  "description": "Read as `command`.",
+  "maxLength": 16384,
+  "type": "string"
+}
    • addedInput schema / properties / mcp
      Added value: +{
+  "description": "Read as `config` (an MCP config block, as text or an object).",
+  "maxLength": 262144,
+  "type": "string"
+}
    • addedInput schema / properties / mcpServers
      Added value: +{
+  "additionalProperties": {},
+  "description": "Read as `config`: { mcpServers: <this> }.",
+  "propertyNames": {
+    "type": "string"
+  },
+  "type": "object"
+}
    • addedInput schema / properties / package
      Added value: +{
+  "description": "Read as `command` (an install command or package names).",
+  "maxLength": 16384,
+  "type": "string"
+}
    • addedInput schema / properties / text
      Added value: +{
+  "description": "Read as `config` when it is a JSON block, else as `command`.",
+  "maxLength": 16384,
+  "type": "string"
+}
  2. Changed1 schema field changed
    • changedInput schema / $schema
      Previous value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"
  3. Added

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare the safety profile (readOnly, idempotent, non-destructive, openWorld), and the description adds substantial context beyond them: the three evidence classes (declared/traced/observed), stored-profile-vs-live-read with a 'bounded budget,' the `unresolved` list with reasons, and the specific meaning of `has_observed_key_egress` as the one fact to stop on. It also states the interpretation rule ('unknown' ≠ 'none found', not a safety rating).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with USE WHEN before detail, and organized into clear labeled blocks (USE WHEN / NOT FOR / RETURNS / RULE / json shape). It is long and repeats the return shape verbosely, but almost every sentence carries operative information rather than filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description carries the full return-format burden and does so completely: it documents the sato.custody/v1 payload, the per-subject summary/answers fields, `solana_receipt`, `unresolved`, and `has_observed_key_egress`, plus worked examples. An agent has everything needed to call and interpret it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so per-dimension baseline is 3. The description adds real value on top: it maps the alias params ('install/cmd/package/text are read as `command`; mcp/mcpServers as `config`') and explains that `{}` checks nothing and answers needs_input, which the schema alone does not convey.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ('check what an install can do with your keys and funds') with the exact inputs it operates on (crypto package, MCP server, skill). It explicitly names the siblings it is not for (onchain_agent_preflight, onchain_agent_get_deploy_spec, onchain_agent_search_skills), so an agent can route without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

USE WHEN gives concrete triggers ('before npm/pnpm/yarn/bun add, npx -y, pip install, uvx or claude mcp add, or before pasting an {mcpServers} config'). NOT FOR enumerates three alternative tools with the exact condition that selects each. Nothing is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Sato Hub: Build Onchain & Crypto Agents toolsInspect
Try in Browser
One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources