Skip to main content
Glama

Agent safety checks: prompt-injection scan, honeypot check, x402 preflight + crypto data (USDC/x402)

Pre-purchase check for any shop, checkout link, payment page, API or x402 endpoint

preflight
Read-only

Before an agent buys, pays or calls an unknown endpoint: one unpaid request to any https shop, checkout or payment link (Stripe, Shopify, PayPal and others), API or x402 endpoint. Checks TLS, domain age, look-alike domains, redirects to foreign gateways, the payment provider, card fields in the page, http forms, text aimed at agents in the page and, for x402, USDC contract, payTo, EIP-712 domain and price traps. Verdict pay, caution or do_not_pay, risk_score, merchant_signals. 0.015 USDC base (new payers 0.015, >10 payments 0.0105; 1 pack call). After: input-guard on the page text you will act on, gas-window before you settle on Base (the result's next field has the exact call).

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "url": "<url>"
    },
    "name": "preflight"
  }
}

Input Schema

NameRequiredDescriptionDefault
urlYesthe shop, checkout or payment link, API or x402 endpoint to check (public https domain, port 443)
methodNo
payment_txNoHash of a USDC transfer on Base to payTo (≥ the price, ≤ 72 h old) instead of an x402 signature.
bundle_tokenNoToken from buy_signal_pack, buy_subscription (pro/desk) or buy_enterprise instead of paying per call.
partner_linkNodefault true: on verdict pay for a shop with an affiliate program, the answer adds partner_link (same merchant, disclosed: Angel may earn a commission, merchant sets the price); false omits it
max_price_usdNo
payer_addressNoWallet you pay from: the payment-required error quotes your tier (0 payments base price (new-payer surcharge paused), 1-10 base, >10 -30 %) and, from the third payment, an upgrade with your own spend.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed1 schema field changed
    • addedInput schema / properties / partner_link
      Added value: +{
      +  "description": "default true: on verdict pay for a shop with an affiliate program, the answer adds partner_link (same merchant, disclosed: Angel may earn a commission, merchant sets the price); false omits it",
      +  "type": "boolean"
      +}
  2. Changed1 schema field changed
    • changedInput schema / properties / url / description
      Previous value: -"the paid endpoint to check (public https domain, port 443)"New value: +"the shop, checkout or payment link, API or x402 endpoint to check (public https domain, port 443)"
  3. Added

TDQS

A4.1/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only say readOnly/openWorld; the description goes well beyond them by disclosing cost and tier dynamics (0.015 USDC base, 0.0105 above 10 payments, 1 pack call), the tier quoted back in the payment-required error, and even a commercial disclosure that partner_link may earn Angel a commission with the merchant setting the price. The unpaid-probe nature of the request is consistent with readOnlyHint and no mutation of the target is implied.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Well front-loaded: what it does first, then verdict fields, then price, then the required follow-up calls. It is dense and the core is a single 60-word sentence with heavy parenthetical stacking, which costs some readability, but nearly every clause carries actionable information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With 7 parameters and no output schema, the description carries the return-value burden and does so by naming verdict, risk_score and merchant_signals and hinting at a 'next' field. Pricing, bundle options and post-call sequencing are covered. The main gaps are the unexplained method and max_price_usd parameters and no statement of latency or failure behaviour when the endpoint is unreachable.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 71%, so the schema already documents url, payment_tx, bundle_token, partner_link and payer_address in detail. The description adds pricing-tier context that reinforces payer_address but says nothing about method (GET/POST) or max_price_usd, the two parameters with no schema description. Useful reinforcement, but no net-new meaning beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb and scope ('one unpaid request to any https shop, checkout or payment link ... API or x402 endpoint') and enumerates the exact checks (TLS, domain age, look-alike domains, redirects, card fields, x402 USDC/payTo/EIP-712/price traps), so the agent knows precisely what it gets back (pay/caution/do_not_pay, risk_score, merchant_signals). It does not explicitly contrast itself with the one listed sibling, which keeps it from a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The trigger is stated up front and unambiguously: 'Before an agent buys, pays or calls an unknown endpoint'. The follow-up sequencing is also explicit ('After: input-guard on the page text you will act on, gas-window before you settle on Base'). There is no explicit when-not clause (e.g. skip for already-trusted merchants), but the 'unknown endpoint' framing implies it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources