code402

Simulate Spend Sentinel policy defense and delivery predicates

simulate_spend_sentinel

Read-onlyIdempotent

Run synthetic prompt-injection halts, malformed-delivery rejection, and bounded-spend eligibility examples under AP2 envelopes. No live escrow, refund, facilitator or chain action occurs.

Example tool call

This call uses example arguments supplied in the tool’s input schema.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "scenario": "injection"
    },
    "name": "simulate_spend_sentinel"
  }
}

Input Schema

Name	Required	Description	Default
`scenario`	No	Simulation scenario: 'injection' (prompt attack), 'garbage' (bad subagent output), or 'provable' (verified settlement). Default 'injection'.

Output Schema

Name	Required	Description	Default
`code`	No
`tool`	No
`scope`	No
`valid`	Yes
`status`	No
`verdict`	Yes
`scenario`	Yes
`simulated`	No
`telemetry`	No
`action_taken`	No
`is_synthetic`	No
`settlement_recipient`	No
`requested_amount_usdc`	No
`actual_wallet_loss_usdc`	No

Schema Changelog

Changes observed during successful MCP inspections.

AddedOct 25, 2026

TDQS

A4/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already establish read-only, idempotent, and open-world behavior. The description adds useful specific context by stating that no live escrow, refund, facilitator, or chain action occurs, which clarifies the simulation boundary beyond the annotation hints.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two focused sentences: the first states what the tool does, and the second immediately bounds its effects. It is front-loaded and contains no redundant or filler language.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With a rich output schema, complete parameter description, and safety annotations, the description provides enough context for correct invocation. It could say slightly more about when the simulation is appropriate, but the essential operational and safety context is present.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single optional scenario parameter is fully documented in the schema, including its allowed values and default. The description mentions the scenario themes but does not add mapping or formatting details beyond what the schema already provides, so the high schema coverage supports a baseline 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb and resource: it runs synthetic prompt-injection halts, malformed-delivery rejection, and bounded-spend eligibility examples. It clearly distinguishes this simulation tool from live escrow, refund, facilitator, or chain actions, so an agent can understand its role without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied by the simulation scenarios and the statement that no live actions occur, but the description does not explicitly say when to choose this tool, when not to, or which alternatives exist. With no close sibling tool, the implied context is adequate but not directive.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All code402 tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.