Skip to main content
Glama

Verify SIWE signature and get a JWT

submit_auth_verify

[DEPRECATED] Exchange a signed SIWE challenge message (from get_auth_challenge) for a JWT scoped to that wallet. The returned jwt must be passed explicitly as the jwt argument to submit_deposit/submit_withdrawal/submit_config for that same wallet — this server does not cache or store it. The JWT is only valid for the walletAddress that produced the signature; using it for a different wallet's write call will be rejected upstream. Reuse the same jwt for subsequent write calls to this wallet instead of re-authenticating every time — the response's expiresAt (decoded from the JWT's own exp claim) says how long it's good for. Rate limited to 5 calls/minute per caller, no more than one call every 12s.

Input Schema

NameRequiredDescriptionDefault
chainNoChain name, e.g. BASE, ETHEREUM, POLYGON. Defaults to ETHEREUM if omitted. For an EOA wallet this is irrelevant (signature recovery is chain-agnostic). For a smart-contract wallet, this MUST be the chain it has (or, if undeployed, would have via ERC-6492 counterfactual deployment) a valid signer on for this signature — it determines which chain's RPC is queried to validate it (ERC-1271/6492), and does not need to match the chain passed to get_auth_challenge.
signatureYespersonal_sign signature of the SIWE message from get_auth_challenge.
walletAddressYesEVM wallet address (0x-prefixed, 40 hex chars). Any casing is accepted — it is normalized to its EIP-55 checksum before being forwarded upstream.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Adds substantial behavior beyond the annotations (readOnlyHint=false, openWorldHint=true, destructiveHint=false): the server does not cache the JWT, the token is scoped to the signing walletAddress and mismatched use is rejected upstream, expiry is exposed via the response's expiresAt, and there are concrete rate limits (5/min, one per 12s). This is exactly the operational context annotations cannot carry.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads the deprecation flag, then purpose, then the auth-flow contract; no sentence is filler. It runs long for a single call, but the length is driven by genuinely necessary multi-step auth and rate-limit detail rather than padding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description carries the burden of return values and does so (jwt, expiresAt decoded from the JWT exp claim), plus scope, reuse, and throttling. An agent has everything needed to call it correctly and to handle the result.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so chain, signature, and walletAddress are already fully documented in the schema, including chain semantics for EOA vs smart-contract wallets. The description adds no parameter-level detail of its own, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a concrete verb and resource: 'Exchange a signed SIWE challenge message (from get_auth_challenge) for a JWT scoped to that wallet.' It also names the upstream source tool and the downstream consumers (submit_deposit/submit_withdrawal/submit_config), so it is distinguishable from every sibling without opening a schema. The [DEPRECATED] prefix makes the tool's standing explicit.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives clear sequencing (obtain challenge via get_auth_challenge, use returned jwt in the submit_* calls) and explicitly instructs reuse rather than re-authentication. It does not, however, say when *not* to call it or name a replacement for the deprecated path, which is the one thing an agent most needs once it sees [DEPRECATED].

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.