backend
Server Details
Deterministic pre-trade risk checks for autonomous AI trading agents.
- Status
- Healthy
- Last Tested
- Transport
- Streamable HTTP · MCP 2025-11-25
- URL
TDQS
Scored across 5 tools
Each tool targets a clearly distinct function: token-level safety, trade-level risk evaluation, asset registry lookup, balance simulation, and audit verification. There is no meaningful overlap that would cause an agent to misselect.
All tool names follow a consistent verb_noun pattern in snake_case: check_token_safety, evaluate_trade, get_supported_assets, simulate_balance, verify_audit_trail. The naming convention is uniform and predictable.
Five tools is well-scoped for a trading guardrail backend: each tool maps to a distinct step in the pre-trade and post-trade workflow. There is no redundancy or bloat.
The set covers the core guardrail workflow: token safety checks, trade evaluation, supported asset lookup, balance simulation, and audit verification. Minor gaps exist, such as no direct current-balance query or decision-history listing, but agents can work around these.
Available Tools
5 toolscheck_token_safetyCheck Token SafetyARead-onlyIdempotentInspect
Honeypot / contract safety check for any ERC-20 token.
| Name | Required | Description | Default |
|---|---|---|---|
| contract_address | Yes | Token contract address (0x...). |
Output Schema
| Name | Required | Description |
|---|---|---|
| error | No | If present, the check failed. Do not assume 'safe'. |
| severity | Yes | Overall classification. |
| risk_factors | No | Specific issues detected. |
| sell_simulation_ok | No | Whether a simulated sell succeeded. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, openWorldHint, idempotentHint, and destructiveHint=false. The description adds context beyond these by specifying that it performs a 'honeypot / contract safety check', which is behavioral information not captured in the annotations. It adds value without contradicting any annotations, and the safety profile is already disclosed by annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that front-loads the core purpose. It is concise with no filler or unnecessary details, efficiently communicating the tool's role.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple (one parameter) and has both an output schema and annotations that cover safety traits. The description, while brief, is sufficient for an agent to understand the tool's basic function. It could mention expected output format, but that is already covered by the output schema, so the description is reasonably complete for this context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and the parameter is well-described in the schema ('Token contract address (0x...).'). The description does not add any additional semantics or details about the parameter beyond what the schema already provides, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('check') and clearly identifies the resource ('contract safety for any ERC-20 token'). It also mentions 'honeypot' which is a specific type of check, effectively distinguishing it from sibling tools like evaluate_trade or simulate_balance, which have different purposes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage when a token safety check is needed, but it does not explicitly state when to use this tool versus alternatives, nor does it mention any exclusions or conditions. There is no reference to sibling tools or guidance on when not to use it, leaving the agent to infer from purpose alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
evaluate_tradeEvaluate TradeARead-onlyIdempotentInspect
Pre-trade risk check for a proposed trade. Call this BEFORE executing any trade and treat a "deny" decision as a hard stop.
Evaluated at a fixed Tier 1 ceiling ($5,000 notional) — MCP callers do not get COLR tier gating. For higher tiers, use the REST API with wallet-signature authentication.
| Name | Required | Description | Default |
|---|---|---|---|
| side | Yes | "buy" or "sell". | |
| asset | Yes | Asset symbol, e.g. NVDA, AAPL, TSLA, USDG. | |
| amount | Yes | Quantity in token units — NOT a pre-computed USD value. | |
| wallet | Yes | EVM wallet address (0x...) the trade would execute from. | |
| request_id | No | Optional idempotency key. | |
| contract_address | Yes | Token contract address (0x...). Must match the official registry address for that symbol, or the trade is denied as a suspected fake token. | |
| max_slippage_bps | No | Max slippage in basis points (default 100). |
Output Schema
| Name | Required | Description |
|---|---|---|
| tier | Yes | Tier the wallet was evaluated at (1-3). |
| error | No | If present, no verdict was produced. Treat as a hard stop; do not execute the trade. |
| reasons | Yes | Human-readable reasons. Entries prefixed with 'ADVISORY:' are non-blocking context; all other entries drove the decision. |
| decision | Yes | Final verdict. 'deny' is a hard stop. |
| audit_seq | No | Monotonic sequence number of this decision. |
| price_usd | Yes | Asset price used for the valuation. |
| audit_hash | No | SHA-256 hash chaining this decision. |
| request_id | No | Echoed idempotency key, if provided. |
| risk_score | Yes | Composite risk score from 0 (safe) to 100 (blocked). |
| price_source | Yes | Where the price came from. |
| max_trade_usd | Yes | USD ceiling for this tier. |
| calculated_notional_usd | Yes | USD value of the proposed trade. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, covering the safety profile. The description adds the fixed Tier 1 ceiling and the hard-stop semantics, which are not in annotations. It doesn't contradict annotations and provides extra behavioral context without over-explaining.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two short paragraphs with no filler. The critical instruction to call before executing and the hard-stop treatment are front-loaded. The tier ceiling and alternative are concisely stated in the second paragraph. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the output schema exists and annotations cover safety, the description is complete. It covers when to call, the decision semantics, the tier limitation, and the alternative for higher tiers. Nothing essential for correct invocation is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all parameters thoroughly. The description adds no additional parameter-level meaning beyond what the schema provides, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: 'Pre-trade risk check for a proposed trade.' It clearly differentiates from siblings like check_token_safety and simulate_balance by focusing on evaluating a trade's risk before execution. The 'deny' decision as a hard stop adds specificity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly instructs to call this BEFORE executing any trade and to treat a 'deny' decision as a hard stop. It also provides an exclusion: for higher tiers, use the REST API with wallet-signature authentication. This leaves no ambiguity about when and when not to use the tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_supported_assetsGet Supported AssetsARead-onlyIdempotentInspect
List every asset in the guardrail's official Robinhood Chain registry, with its canonical contract address.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| error | No | If present, the registry was unreachable. |
| assets | No | Registered assets. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, openWorldHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is well-covered. The description adds useful context about the official registry and canonical addresses, but it does not go further into behavior such as ordering, pagination, or any response characteristics beyond what the output schema likely provides.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, front-loaded sentence with no filler. It immediately states the action and the object, and every phrase adds value. This is an example of appropriately concise description.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a parameterless listing tool with rich annotations and an output schema, the description fully covers what the agent needs to invoke it correctly. It states what is returned (assets and their canonical addresses) and the source scope (official Robinhood Chain registry). No additional caveats or details are necessary given the low complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters and schema description coverage is 100%, so there is nothing the description must compensate for. The description focuses on output content instead, which is appropriate for a parameterless operation. Baseline 4 is suitable given that no parameters exist.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('List') and a clear resource ('every asset in the guardrail's official Robinhood Chain registry'), and even specifies the included field ('canonical contract address'). It is easily distinguished from sibling tools like check_token_safety or evaluate_trade, which clearly do different things.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no guidance on when to use this tool versus alternatives. It does not mention any exclusions, prerequisites, or conditions, leaving the agent to infer that this is simply the go-to listing tool. There is no explicit 'use when' or 'use instead' statement.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
simulate_balanceSimulate BalanceARead-onlyIdempotentInspect
Simulate a wallet's ERC-20 balance after a hypothetical trade using eth_call state override. Read-only: no transaction is ever sent.
| Name | Required | Description | Default |
|---|---|---|---|
| delta | Yes | Signed amount (negative = spend). | |
| holder | Yes | Wallet address whose balance is simulated (0x...). | |
| decimals | No | Token decimals (default 18). | |
| token_address | Yes | ERC-20 contract address (0x...). |
Output Schema
| Name | Required | Description |
|---|---|---|
| after | No | Balance after. |
| delta | No | Signed change. |
| error | No | If present, the simulation failed. |
| before | No | Balance before. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint, covering the safety profile. The description adds 'Read-only: no transaction is ever sent,' which reinforces but doesn't meaningfully extend the annotations. It also mentions the technical method (eth_call state override), but this is more about implementation than behavior. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no filler. The primary purpose and the key safety fact (read-only) are front-loaded. Every word earns its place, and the structure is immediately scannable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple, has an output schema, and all parameters are documented. The description conveys the intended use, the method, and the non-destructive nature. Nothing critical for an agent to invoke it correctly is missing. It could mention edge cases (e.g., token decimals), but the schema already handles that.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so every parameter already has a description. The tool description adds no additional parameter-specific meaning; it only frames the overall purpose. Per the rubric, when schema coverage is high, a score of 3 is appropriate without further elaboration.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific verb ('simulate') and resource ('a wallet's ERC-20 balance') with the context of a hypothetical trade and the method (eth_call state override). It is unambiguous and not a tautology, but it does not explicitly distinguish itself from sibling tools like evaluate_trade, so it loses the top point.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the use case: simulating a balance after a hypothetical trade. It provides context but gives no explicit guidance on when to use this tool over alternatives or when not to use it. No alternatives are mentioned, so the agent must infer the appropriate context from the wording alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
verify_audit_trailVerify Audit TrailARead-onlyIdempotentInspect
Verify the tamper-evident audit trail for a wallet's past guardrail decisions.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | How many recent records to verify (1-1000, default 100). | |
| wallet | Yes | EVM wallet address (0x...). |
Output Schema
| Name | Required | Description |
|---|---|---|
| error | No | If present, verification could not run. |
| healthy | Yes | True only if every record's hash matches and the chain is unbroken. |
| records_checked | No | Number of records verified. |
| first_broken_seq | No | Sequence number of the first broken link, if any. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, carrying the safety profile. The description adds useful context by characterizing the trail as tamper-evident and scoping it to past guardrail decisions, which hints at what verification entails. No contradiction with annotations, but little added beyond the annotations' coverage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence with zero filler. The verb and core object are front-loaded, and every word earns its place by clarifying the scope (wallet's past guardrail decisions).
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only verification tool with a full output schema, the definition is nearly complete: annotations cover the safety profile, the schema documents the parameters, and the description conveys the tool's purpose and scope. A minor gap is the absence of any guidance on what a failed verification implies, but nothing essential to invoking the tool is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema fully documents both parameters (wallet format and limit with its 1-1000 range and default). The description adds no parameter-level meaning beyond the schema, matching the baseline of 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Verify), a specific resource (tamper-evident audit trail), and a precise scope (a wallet's past guardrail decisions). The purpose is unambiguous and easily distinguishable from siblings like check_token_safety and evaluate_trade, which operate on different data entirely.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no explicit when-to-use or when-not-to-use guidance and names no alternatives. However, usage is reasonably implied by the domain — an agent needing to confirm the integrity of a wallet's guardrail history can infer this is the right tool, and none of the four siblings overlap with audit verification.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
5 tool updates
- First observed
check_token_safety - First observed
evaluate_trade - First observed
get_supported_assets - First observed
simulate_balance - First observed
verify_audit_trail
Related MCP Connectors
- mcpOAuthmarkets.tally
The risk officer for AI-assisted trading: enforced exit rules, cooling-off, and public receipts.
Risk preflight for AI Agent tool actions and Polymarket settlement and execution checks.
Verifiable, deterministic risk math for autonomous agents; re-runnable proof on every answer.
Pre-execution governance for AI agents. Deterministic PASS/FAIL/REVIEW verdicts, replayable proof.
Related MCP Servers
- AlicenseNot gradedqualityBmaintenancePre-trade risk validation and position sizing for AI trading agents via G-formula and Iron Fist.2MIT
- AlicenseNot gradedqualityBmaintenanceProvides risk guardrails for AI trading agents by analyzing portfolio risk, checking trades against policies, and generating risk policies.2MIT
- AlicenseAqualityBmaintenanceDeterministic risk governance for crypto trading agents. 5-level policy engine with position sizing, leverage limits, and trade blocking. One tool: get_risk_policy. Supports BTC and ETH.412 npm1MIT
- FlicenseBqualityCmaintenanceAn MCP trading server over a paper broker with a deterministic risk layer that enforces limits before orders reach the handler, ensuring safe AI agent trading.7-
Glama MCP Gateway
Add one secure layer between your agents and this server.