OneKeyAway: who controls this contract
Server Details
Who can change an EVM contract or Safe: proxy admin, owner, Safe signers, timelock. Free alerts.
- Status
- Healthy
- Uptime
- 98.7% over 21 days
- Last Tested
- Transport
- Streamable HTTP · MCP 2025-11-25
- URL
TDQS
Scored across 2 tools
control_map is a read-only analysis tool, while watch_contract is a subscription/alert setup tool. Their purposes are clearly distinct and non-overlapping, so an agent can easily select the right one.
Both names use snake_case, but control_map is a noun phrase whereas watch_contract follows the verb_noun pattern. This is a minor deviation, still readable and predictable.
Two tools for a service focused on contract control analysis and monitoring is on the thin side. There is no tool to list, manage, or remove watches, so the surface feels under-scoped for the apparent purpose.
The core workflow of analyzing control paths and subscribing to change alerts is covered. Minor gaps exist around watch management (e.g., listing or deleting watches) and historical alert retrieval, but agents can work around them.
Available Tools
2 toolscontrol_mapWho controls this contractARead-onlyInspect
On-chain control path of an EVM contract or Safe: proxy type and implementation; proxy admin, beacon owner, owner(), DEFAULT_ADMIN_ROLE holders, Aave PoolAddressesProvider owner, Morpho vault curator/guardian/timelock; each resolved through ProxyAdmin, Safe threshold and signers, timelock delay or Avocado wallet; plus a verdict (SINGLE KEY, MULTISIG NO TIMELOCK, TIMELOCKED, UNRESOLVED). For a Safe address: signers, threshold, modules, guard, fallback handler, singleton. Chains: ethereum (1), optimism (10), bsc (56), unichain (130), polygon (137), sonic (146), zksync (324), hyperevm (999), base (8453), arbitrum (42161), avalanche (43114), linea (59144), berachain (80094), blast (81457), katana (747474). Free, 100 calls/day.
| Name | Required | Description | Default |
|---|---|---|---|
| chain | Yes | Chain name or id, e.g. base, ethereum, arbitrum, 8453 | |
| address | Yes | Contract or Safe address, 0x + 40 hex |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare readOnlyHint and openWorldHint, so the safety profile is covered. The description adds valuable behavioral context: it is free with a 100 calls/day rate limit, the verdict vocabulary (SINGLE KEY, MULTISIG NO TIMELOCK, TIMELOCKED, UNRESOLVED), and the comprehensive scope of what gets resolved. It does not explain error conditions or what an UNRESOLVED result implies operationally.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the purpose but then becomes a dense run-on enumeration of protocols, roles, chains, and verdicts. The chain list in particular is long and could be deferred or summarized, hurting readability.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a two-parameter read-only tool with no output schema, the description covers what is resolved, the chain domain, and pricing limits. It is complete enough for an agent to invoke correctly, though it could better explain the verdict semantics or when UNRESOLVED occurs.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and both parameters are documented in the schema. The description adds chain IDs alongside names, which is useful but partially overlaps with the schema's example list. Baseline 3 is appropriate when the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource ('On-chain control path of an EVM contract or Safe') and enumerates exactly what is resolved (proxy type, admin, owners, roles, verdict). It clearly distinguishes itself from 'watch_contract' by focusing on current ownership/control resolution rather than ongoing monitoring.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage context is implied by the description ('control path,' 'verdict'), but there is no explicit when-to-use vs when-not-to-use guidance or mention of the sibling tool 'watch_contract'. An agent must infer that this is for point-in-time control analysis rather than monitoring.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
watch_contractEmail me if control of this contract changesAInspect
Free alerts (up to 3 contracts per email): sends a confirmation email, then an alert when the implementation, proxy admin, owner, DEFAULT_ADMIN_ROLE holders, Safe signers/threshold/modules/guard or Morpho vault timelock change. Checked about every 15 minutes. Only use with the user's own email address and their explicit consent.
| Name | Required | Description | Default |
|---|---|---|---|
| chain | Yes | ||
| Yes | The user's own email address (they must confirm by link) | ||
| address | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does so well: it discloses the confirmation-email step, the ~15 minute polling cadence, the free-tier limit, the exact monitored change set, and the consent/privacy constraint. The only minor omission is lifecycle behavior (how to stop or manage an existing watch).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single dense paragraph, front-loaded with the free-tier scope, followed by trigger conditions, timing, and the consent constraint. Every clause conveys distinct operational information; nothing is redundant with the title or schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 3-parameter, no-output-schema, annotation-free tool, the description covers the behavior an agent needs to invoke it safely (consent, email ownership, limits, timing). What remains thin is the undocumented chain/address parameters and the lack of detail on what the tool returns after registering.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 33% — only 'email' is documented in the schema, and chain/address have no descriptions. The description partially compensates by tightening the email semantics ('user's own email address') and implying the address is a contract under watch, but it says nothing about accepted chain identifiers or address formatting, so the gap is not closed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb (watch/alert) plus the exact resource and the exact conditions monitored: implementation, proxy admin, owner, DEFAULT_ADMIN_ROLE holders, Safe signers/threshold/modules/guard, Morpho vault timelock. It is clearly a subscription/monitoring tool, which an agent can distinguish from the sibling control_map (a read of current state) without opening schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It states real usage constraints: free tier capped at 3 contracts per email, requires the user's own email address, and requires explicit consent. It does not explicitly route the agent between this tool and control_map (e.g. 'use control_map for a one-off snapshot, watch_contract for ongoing monitoring'), so the alternative-selection guidance is implied rather than stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
2 tool updates
- First observed
control_map - First observed
watch_contract
Related MCP Connectors
Who can still change this EVM contract, and what can they do to holders?
Webhook alerts for EVM wallets, contract admin changes, Safe queues and custom events.
Read-only smart-contract security intelligence for autonomous agents.
Read-only honeypot, holder and liquidity scam checks for tokens across 64 networks.
Related MCP Servers
- AlicenseNot gradedqualityBmaintenanceEnables users to analyze EVM contracts for upgradeability, admin type, and retained powers such as minting, pausing, blacklisting, and ownership transfer, with evidence and a change feed.MIT
- FlicenseNot gradedqualityDmaintenanceProvides comprehensive smart contract analysis for EVM tokens, including proxy contract detection, ownership chain discovery, and OpenZeppelin AccessControl role management across multiple blockchain networks.-
- AlicenseAqualityDmaintenanceFetches verified EVM smart contract source code, scans for vulnerabilities, analyzes token holder distribution, and generates audit reports.5MIT
- AlicenseAqualityDmaintenanceNon-custodial agent wallet with a transaction preflight that decodes an unsigned EVM tx and flags drain patterns (unlimited/large approval, approve-all, token & NFT transferFrom, proxy upgrade, on-chain permit, approvals hidden in multicall) before signing.941 PyPI1MIT
Glama MCP Gateway
Add one secure layer between your agents and this server.