Read-only scope check
wever_read-only-scope-checkAgent Access: submit an agent meant to investigate and change nothing, with every tool it can call: how each is described (read, query, write or admin), its operations, the free-form input it passes on (SQL, GraphQL, an HTTP request, a shell command, a script or a filter expression), what the credential behind it can do, the HTTP methods a request tool can send and any side effects. The signed report names every mutation path: write, delete, send, execute, configure, admin and money operations, SQL or GraphQL passed on under a credential that can write, request tools that can send POST, PUT, PATCH or DELETE, shell and script runners and stated side effects, with the writes hiding inside query-shaped tools listed apart, so the read-only boundary is real rather than described. Reachable actions against an authority grant are wever_authority-scope-check and a sandbox’s routes into production are wever_escape-path-check. Verdict mutation_reachable, boundary_unverified or read_only. POST /api/read-only-scope-check. Reads only the material in the call: no network request, fetch, money movement, message, sharing, configuration change or external write. Paid URL: 0.10 USDC per call on Base via x402 exact, with the shared 10 signed-wallet free calls per rolling 30 days. Bind X-Wever-Wallet-Proof to the exact JSON arguments and the tool route. Returns a report with an Ed25519 signed receipt. Contract: /api/agent-access-contract. Human page: https://weverlabs.com/agent-access/.
Tool call template
Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {
"agent": "<agent>",
"tools": "<tools>"
},
"name": "wever_read-only-scope-check"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| agent | Yes | ||
| label | No | Optional name recorded in the report. | |
| tools | Yes | Every tool the agent can call. |