Skip to main content
Glama

Contract quick flags (free)

contract_quick_flags
Read-onlyIdempotent

Free, no payment: bytecode-only preview of a deployed smart contract. Covers proxy/upgradeability, ERC-20 probe (name, symbol, owner, paused), risky selectors found in the bytecode (mint, blacklist, fee/tax setters, pause, upgrade), SELFDESTRUCT/DELEGATECALL opcodes, and a partialScore/partialLevel computed from those on-chain signals only. Does NOT cover source verification (Blockscout, Sourcify) nor aderyn static analysis, so partialScore can be lower than the real risk. contract_risk_summary ($0.01 in USDC via x402) is the full report. Read-only, no side effects; an EOA is rejected; identical requests within 10 minutes return the cached result; the HTTP twin GET /v1/flags/:chainId/:address is rate limited to 30 requests per minute per IP.

Input Schema

NameRequiredDescriptionDefault
addressYesContract address, 0x followed by 40 hex characters
chainIdYesEVM chain id, one of: 1, 10, 56, 100, 130, 137, 146, 480, 5000, 8453, 42161, 42220, 43114, 59144, 81457, 84532, 421614, 534352, 11155111, 11155420

Schema Changelog

Changes observed during successful MCP inspections.

  1. Added

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations, it discloses important behavioral details: no payment required, EOA addresses are rejected, identical requests within 10 minutes return cached results, and the HTTP twin has a 30 requests/minute/IP rate limit. It also explains that partialScore can understate real risk because it excludes source verification and static analysis.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but front-loaded and well organized: it starts with the free bytecode preview scope, then coverage, exclusions, paid alternative, and operational behavior. Every sentence adds decision-relevant information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Although there is no output schema, the description explains the main returned concepts (proxy/upgradeability, ERC-20 probe, risky selectors, opcodes, partialScore/partialLevel) and the important limitations. With only two fully documented parameters and clear safety/operational notes, an agent has enough context to call it correctly and interpret the caveats.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is already 100%, so the schema documents address format and allowed chain IDs. The description adds one meaningful constraint beyond the schema: an EOA is rejected, meaning the address must be a deployed contract rather than any valid 0x address.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: a bytecode-only preview of a deployed smart contract. It enumerates the exact coverage areas and explicitly distinguishes itself from the paid sibling contract_risk_summary, which provides the full report.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It clearly positions this as the free quick preview and names the full paid alternative, contract_risk_summary ($0.01 via x402). It also states what the tool does not cover (source verification and aderyn static analysis), so an agent can decide when this preview is sufficient versus when to use the fuller report.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.