Skip to main content
Glama

Crypto Bot Audit + Market Data (x402 paid)

Can this operator move a whole wallet?

chain_nft_approved_for_all
Read-onlyIdempotent

isApprovedForAll(owner, operator) — the setApprovalForAll permission behind most NFT drain headlines, answered per pair in one paid call. Costs $0.001 USDC per call. Chains: base, ethereum, arbitrum, bsc, polygon, optimism, avalanche. Byte-identical to GET /chain/nft-approved-for-all?chain=base&token=0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913&owner=0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913&operator=0x0000000000000000000000000000000000000000.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
chainYeschain key: base, ethereum, arbitrum, bsc, polygon, optimism, avalanche [required]
ownerYesholder address [required]
tokenYesNFT contract address [required]
operatorYesdelegate/operator address being tested [required]

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
tsNo
noteNo
chainNo
ownerNo
staleNo
tokenNo
caveatNo
reasonNo
sourceNo
chainIdNo
approvedNo
operatorNo
readableNo
chainLabelNo

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed1 schema field changed
    • changedOutput schema / (root)
      Previous value: -nullNew value: +{
      +  "$schema": "http://json-schema.org/draft-07/schema#",
      +  "additionalProperties": false,
      +  "properties": {
      +    "approved": {
      +      "type": "boolean"
      +    },
      +    "caveat": {
      +      "type": [
      +        "string",
      +        "null"
      +      ]
      +    },
      +    "chain": {
      +      "type": [
      +        "string",
      +        "null"
      +      ]
      +    },
      +    "chainId": {
      +      "anyOf": [
      +        {
      +          "type": "integer"
      +        },
      +        {
      +          "type": "null"
      +        }
      +      ]
      +    },
      +    "chainLabel": {
      +      "type": [
      +        "string",
      +        "null"
      +      ]
      +    },
      +    "note": {
      +      "type": [
      +        "string",
      +        "null"
      +      ]
      +    },
      +    "operator": {
      +      "type": "string"
      +    },
      +    "owner": {
      +      "type": "string"
      +    },
      +    "readable": {
      +      "type": "boolean"
      +    },
      +    "reason": {
      +      "type": [
      +        "string",
      +        "null"
      +      ]
      +    },
      +    "source": {
      +      "type": "string"
      +    },
      +    "stale": {
      +      "type": [
      +        "boolean",
      +        "null"
      +      ]
      +    },
      +    "token": {
      +      "type": "string"
      +    },
      +    "ts": {
      +      "type": "string"
      +    }
      +  },
      +  "type": "object"
      +}
  2. Added

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false, so the safety profile is covered. The description adds value by disclosing the cost ($0.001 USDC per call), the supported chains, and the byte-identical REST endpoint. It also explains the security relevance (NFT drain headlines), which helps the agent understand the semantic meaning of the result. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded with the core function name and security context. The cost and chains are listed efficiently. The byte-identical REST endpoint example is a bit long and arguably redundant, but it provides a concrete reference. Overall, every sentence earns its place, though the endpoint example could be trimmed.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has an output schema, so return values are covered elsewhere. The description covers the purpose, cost, chains, and the exact function. It doesn't mention pagination or edge cases, but for a simple boolean check that's acceptable. The only gap is not explicitly stating when to prefer this over chain_nft_approved, but the function name and 'per pair' make it clear enough.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all four parameters (chain, token, owner, operator). The description adds the function signature isApprovedForAll(owner, operator) and clarifies operator as 'delegate/operator address being tested' in the schema. The description doesn't add much beyond the schema, but the schema is complete. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool checks isApprovedForAll(owner, operator), the setApprovalForAll permission behind NFT drain headlines, per pair. It names the exact function and the resource (NFT approval state), and the title reinforces the question. It distinguishes itself from siblings like chain_nft_approved (single token approval) by specifying the setApprovalForAll permission.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context: it answers the setApprovalForAll permission per pair, and mentions chains supported. It doesn't explicitly say when to use this vs chain_nft_approved or chain_approvals_scan, but the phrase 'per pair' and the function name imply the use case. It also notes it's a paid call, which is a usage consideration. Missing explicit exclusions or alternatives, so not a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources