Skip to main content
Glama

Toll

Check before signing

check_tx
Read-only

Pre-sign check, before an agent signs anything on Robinhood Chain (chain id 4663): send the transaction (to, data, value, and from), an EIP-712 signature request (typedData: Permit, Permit2, TransferWithAuthorization) or an x402 payment (x402: the PaymentRequired from the 402, or one accepts entry; agentId optional), and Toll answers ALLOW / WARN / BLOCK with the reasons, as an ERC-8265 RiskAssessment. It reads approvals (unlimited, to a plain wallet, to a contract we do not know, to a wallet the coin's own check names), transfers (to a burn address, the token itself, a router, a flagged wallet, an unknown contract), swaps (the router, who it pays out to, and the coin bought, through Toll's coin check: BLOCK only for findings whose coins rugged at 40% or more in our calibration), and x402 payments (ERC-8478 payee verification: payTo against the seller's ERC-8004 agent wallet or a payee delegation it signed, read live from the Robinhood Chain or Base identity registry, with the outcome in x-toll; the seller's last delivery spot-check, the asset and amount). Calldata it cannot read is WARN, never ALLOW; a coin still being read is WARN with the seconds to wait. Robinhood Chain only. Facts, not advice.

Input Schema

NameRequiredDescriptionDefault
toNoThe transaction's to: the contract or wallet it is sent to (0x + 40 hex)
dataNoThe calldata, hex (0x for a plain send)
fromNoThe signer's address (0x + 40 hex): a swap paying out to anyone else is flagged
x402NoAn x402 payment: the PaymentRequired the 402 sent (with accepts), or one accepts entry; optional payment (the signed payload) and resource (the URL)
valueNoWei sent with it, decimal or 0x hex (default 0)
strictNoStrict payee policy: an x402 payment whose payTo is not verified as the seller's (ERC-8478 verified-wallet or verified-delegation) is BLOCK instead of a warning; not read is BLOCK too
agentIdNoThe x402 seller's ERC-8004 agent id, when known
chainIdNoThe chain id: 4663 (Robinhood Chain), the only one read; leave it out for 4663
registryNoThe identity registry agentId is in, CAIP-10 (default eip155:4663:0x8004A169FB4a3325136EB29fA0ceB6D2e539a432, Robinhood Chain; Base: eip155:8453:0x8004A169FB4a3325136EB29fA0ceB6D2e539a432)
typedDataNoAn EIP-712 signature request: {domain, types, primaryType, message}

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A4.1/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only establish read-only, non-destructive, open-world; the description adds the substantive behavior: what categories get inspected (approvals, transfers, swaps, x402 payee verification), the fail-safe rule that undecidable calldata and in-progress coin reads degrade to WARN with a wait time, the BLOCK threshold for coin findings, and that payee data is read live from the Robinhood Chain or Base identity registry with the outcome in x-toll. The read-only hint is consistent with a check that returns a verdict rather than executing anything.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The lead clause is well front-loaded, but the remainder is two enormous sentences dense with nested parentheses and unexplained acronyms (ERC-8478, ERC-8004, x-toll). Content like the 40% rug calibration is useful but buried mid-sentence where an agent skimming for a verdict rule may miss it. Breaking the ALLOW/WARN/BLOCK rules into discrete statements would improve it materially.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 10-parameter tool with nested objects and no output schema, the description does the heavy lifting: it states the return shape, the verdict semantics, the failure modes, and the chain restriction. Gaps remain around strict (a policy switch that changes a warning into a BLOCK) and around what happens when no input mode is supplied, neither of which is addressed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline would be 3, but the description adds real semantics the schema lacks: it groups parameters by input mode (to/data/value/from for transactions, typedData for EIP-712, x402 plus optional agentId for payments) and enumerates the accepted typedData primaryTypes (Permit, Permit2, TransferWithAuthorization), which the schema does not. It never explains strict or registry as inputs, so coverage of meaning is partial.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb-scope (pre-sign check), a specific chain (Robinhood Chain, chain id 4663), the three accepted input modes (transaction, EIP-712 typedData, x402 payment) and the output shape (ALLOW/WARN/BLOCK with reasons, as an ERC-8265 RiskAssessment). That is far beyond a restatement of the name. It does not, however, distinguish itself from the sibling presign_risk_report, which an agent could plausibly pick instead.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The trigger is explicit and front-loaded: call it before an agent signs anything. The scope limits ('Robinhood Chain only', and the note that unreadable calldata is WARN, never ALLOW) tell the agent when the answer is untrustworthy. It names no alternative tools and gives no when-not-to-call guidance relative to check_coin, check_agent or presign_risk_report.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.