Skip to main content
Glama

ExchangeRebel — pay-per-call APIs for AI agents (x402 on Solana)

sdk_safety_check

$0.01 USDC on Solana per check - the payment buys one signed SDK version-safety report for the one SDK name + version you submit: per-flaw outcomes for all 25 recorded flaws in the pinned snapshot x402-sdk-flaws/v1-2026-10-24 (AFFECTED / FIXED / NOT-APPLICABLE / NOT-ESTABLISHED), the overall verdict (including NOT-IN-RECORD when the submitted SDK or version is outside the pinned record's established data), and the factors. Factors printed; no composite score. Nothing submitted is stored beyond the payments ledger's closed field list.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "sdk": "<sdk>",
      "version": "<version>"
    },
    "name": "sdk_safety_check"
  }
}

Input Schema

NameRequiredDescriptionDefault
sdkYesThe x402 SDK name to check against the pinned flaw snapshot.
versionYesThe SDK version to check (semver: optional leading v, MAJOR.MINOR.PATCH, optional -prerelease / +build).

Schema Changelog

Changes observed during successful MCP inspections.

  1. Added

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations supplied, the description carries the full burden and does so well: it discloses the price and rail ($0.01 USDC on Solana per check), that the payment buys exactly one signed report, that the snapshot is pinned and deterministically enumerates 25 flaws, that no composite score is produced, and that nothing submitted is retained beyond the payments ledger's closed field list. It also pre-announces the NOT-IN-RECORD verdict for out-of-record SDKs/versions, which is the main surprising behavior an agent would otherwise hit blind.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Everything in the text earns its place — price first (the decision-critical fact), then what the payment buys, then the return shape, then the data-retention guarantee. It is a single heavily nested sentence, though, so the verdict semantics and retention clause are harder to scan than they need to be.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, so the description must explain the return value, and it does: per-flaw outcomes across four states, the overall verdict including the NOT-IN-RECORD edge case, and factors with no composite score. Combined with the cost and retention disclosure, an agent has everything needed to call this correctly and interpret the result.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and both parameters are already described there (name and semver format), so the baseline is 3. The description adds real meaning on top: the sdk value is resolved against a specific pinned flaw snapshot, and an out-of-record SDK or version yields NOT-IN-RECORD rather than an error — semantics the schema does not convey.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb and resource: a paid SDK version-safety check producing one signed report for a submitted SDK name + version. It also pins the exact scope (all 25 flaws in snapshot x402-sdk-flaws/v1-2026-10-24) and the verdict vocabulary, so an agent can tell this apart from the adjacent sdk_safety_criteria / sdk_safety_precheck without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied rather than stated: submit an SDK name + version and pay to get the report. There is no explicit when-to-use vs. when-not-to-use, and the sibling tools sdk_safety_precheck and sdk_safety_criteria are never mentioned, so the agent must infer the routing (precheck first? criteria for rubric? this for the paid verdict?) on its own.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources