Skip to main content
Glama

pre_trade_safety_check

Pre-trade decision-input integrity checkpoint for AI agents. Call this BEFORE executing any on-chain swap/borrow/lend/liquidation/repay to verify that the price the action relies on can be trusted. First assessment domain: oracle risk — aggregates cross-oracle consensus prices, per-provider deviation, data freshness, stablecoin peg status, and reputation into a single verdict. An optional decisionInput object adds a separate Chainlink/CEX/DEX input-sufficiency assessment against the caller-supplied venue quote and explicit limits, with an independently verifiable EIP-712 signature when signing is enabled; it never changes the verdict. Verdicts are PASS / CAUTION / DANGER / BLOCK. AI agents MUST NOT execute trades when the verdict is DANGER or BLOCK. Also returns a recommended maximum position size. A PASS is not principal authorization or a guarantee of price correctness or economic safety.

Input Schema

NameRequiredDescriptionDefault
assetYesAsset symbol being traded, e.g. BTC, ETH, USDC
actionYes
chainIdYesChain ID where the trade executes, e.g. 1=Ethereum, 42161=Arbitrum, 8453=Base. Use 0 for chain-agnostic.
tradeAmountUsdYesTrade size in USD
targetProvidersNoOptional: restrict the check to specific oracle providers

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed1 schema field changed
    • changedInput schema / properties / targetProviders / items / enum
      Previous value: -[
      -  "chainlink",
      -  "pyth",
      -  "stork",
      -  "api3",
      -  "redstone",
      -  "dia",
      -  "winklink",
      -  "supra",
      -  "twap",
      -  "reflector",
      -  "flare",
      -  "band"
      -]New value: +[
      +  "chainlink",
      +  "pyth",
      +  "stork",
      +  "chronicle",
      +  "api3",
      +  "redstone",
      +  "dia",
      +  "winklink",
      +  "supra",
      +  "twap",
      +  "reflector",
      +  "flare",
      +  "band"
      +]
  2. Changed1 schema field changed
    • changedInput schema / properties / targetProviders / items / enum
      Previous value: -[
      -  "chainlink",
      -  "pyth",
      -  "api3",
      -  "redstone",
      -  "dia",
      -  "winklink",
      -  "supra",
      -  "twap",
      -  "reflector",
      -  "flare",
      -  "band"
      -]New value: +[
      +  "chainlink",
      +  "pyth",
      +  "stork",
      +  "api3",
      +  "redstone",
      +  "dia",
      +  "winklink",
      +  "supra",
      +  "twap",
      +  "reflector",
      +  "flare",
      +  "band"
      +]
  3. Changed1 schema field changed
    • changedInput schema / properties / targetProviders / items / enum
      Previous value: -[
      -  "chainlink",
      -  "api3",
      -  "redstone",
      -  "dia",
      -  "winklink",
      -  "supra",
      -  "twap",
      -  "reflector",
      -  "flare",
      -  "band"
      -]New value: +[
      +  "chainlink",
      +  "pyth",
      +  "api3",
      +  "redstone",
      +  "dia",
      +  "winklink",
      +  "supra",
      +  "twap",
      +  "reflector",
      +  "flare",
      +  "band"
      +]
  4. First observed

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does a lot: it discloses the four-level verdict taxonomy, the fail-closed rule for DANGER/BLOCK, that the optional decisionInput assessment never changes the verdict, that a signature is independently verifiable via EIP-712, and that PASS is not authorization or a price guarantee. It omits operational traits — auth/API-key requirements, latency, rate limits, caching of oracle data. The explicit 'never changes the verdict' clause is a genuinely useful behavioral detail an agent couldn't infer.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The when-to-call instruction and the MUST-NOT rule are front-loaded, followed by scope and caveats. It is dense but each sentence does work — aggregation scope, decisionInput semantics, verdict enums, and disclaimer. Slight cost from the jargon-heavy opening ('decision-input integrity checkpoint') and the caveat stacking at the end.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no annotations and no output schema, the description does explain the verdict domain and mentions a recommended max position size, which covers the most decision-relevant return values. However, the return shape beyond the verdict is unclear (deviation figures? per-provider breakdowns?) and the phantom decisionInput parameter conflicts with a closed schema, leaving an agent with an inaccurate mental model of the call.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 80% (asset, chainId, tradeAmountUsd, targetProviders all documented), so the baseline is 3 and the description adds little per-parameter guidance — no explanation of how tradeAmountUsd interacts with the 'recommended maximum position size' output. Worse, it describes an 'optional decisionInput object' that does not exist in the schema, which has additionalProperties: false; this can send an agent looking for a parameter it cannot supply.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a concrete capability — a pre-execution integrity checkpoint that aggregates cross-oracle consensus price, per-provider deviation, freshness, stablecoin peg, and reputation into a single PASS/CAUTION/DANGER/BLOCK verdict. It implicitly distinguishes itself from the granular siblings (get_oracle_health, compare_oracle_deviation, get_feed_freshness) by framing itself as the aggregated decision gate. It stops short of naming a specific sibling as the alternative, but the 'one verdict vs many data points' framing is clear.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is explicit and actionable: 'Call this BEFORE executing any on-chain swap/borrow/lend/liquidation/repay,' and it states a hard rule — agents MUST NOT execute when the verdict is DANGER or BLOCK. That maps cleanly onto the action enum. It does not state when NOT to use it or how it relates to adjacent preflight tools like execution_preflight or check_position_safety, leaving sibling selection partly to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.