Skip to main content
Glama

Vibes-Coded Agent Security and Commerce Tools

vc_lease_consume

Read-onlyIdempotent

Spend exactly one use of a lease, atomically. Blocks replay, expiry, revocation and overuse. Returns decision allow/block with a named reason plus an Ed25519 decision receipt. If a previous attempt timed out, call this again with the SAME use_nonce: a replay returns reason=replay — do not retry the write, reconcile it. ~$0.02/call.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
actionNoWhat you are about to do, for the ledger trail.
agent_idNoCaller identity; must match the lease holder unless it was issued to '*'.
lease_idNoLease to spend from.
use_nonceYesStable id for this attempt (the replay key). Reuse the SAME nonce on retry.
lease_tokenNoSigned lease token from vc_lease_issue (alternative to lease_id).
payment_signatureNoOptional x402 PAYMENT-SIGNATURE if not using X-Vibes-Key.

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
resultYes

Schema Changelog

Changes observed during successful MCP inspections.

  1. Added

TDQS

A3.6/5.0
Behavior1/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description explicitly characterises the operation as a write ("do not retry the write, reconcile it") and describes spending/consuming a lease, which mutates ledger state, while annotations declare readOnlyHint=true. This directly contradicts the structured safety metadata, so the description cannot be trusted to describe the failure modes the agent needs.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four short sentences, front-loaded with the core action and atomicity guarantee, then return shape, retry protocol, and cost. No filler; every sentence carries actionable information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a mutation tool with six params and an output schema present, the description covers atomicity, blocked conditions, return shape, retry/reconcile protocol and pricing. The main gap is that it does not resolve the read-only annotation conflict, leaving the agent unsure whether this is a side-effect-free call.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all six parameters are already documented, including use_nonce's replay-key semantics. The description mostly restates this ("SAME use_nonce") and adds only the cost signal, which is not parameter semantics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource with exact scope: "Spend exactly one use of a lease, atomically." The atomicity and single-use framing clearly separates it from vc_lease_issue, vc_lease_revoke and vc_lease_status without needing their schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit when-to-call-again guidance ("If a previous attempt timed out, call this again with the SAME use_nonce") and an explicit when-not ("do not retry the write, reconcile it"). It does not, however, name which sibling to use for checking lease state or when to prefer vc_lease_status over consuming.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.