Skip to main content
Glama

x402 Preflight Security & Payment Risk Check

agent_preflight
Read-onlyIdempotent

Inspects public x402 terms or a Base recipient and returns decision.verdict, score, confidence, payment observations, evidence, warnings, freshness and nextActions. It identifies observable mismatches but cannot guarantee safety or authorize spending. Before paying, transferring to, or interacting with an unfamiliar machine resource, x402 endpoint, recipient, or Base address. Do NOT use when: You only need market execution conditions or webpage extraction. Price: $0.01 USDC per call via x402 V2 with separately authorized payment. If unsure, use the free signal_layer_router.

Input Schema

NameRequiredDescriptionDefault
intentNopay
targetYes
routingIdNo
maxPriceUsdNo
expectedNetworkNo

Output Schema

NameRequiredDescriptionDefault
dataNo
metaNo
toolNo
statusNo
decisionNo
evidenceNo
warningsNo
freshnessNo
requestIdNo
nextActionsNo

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed1 schema field changed
    • changedOutput schema / (root)
      Previous value: -nullNew value: +{
      +  "$schema": "https://json-schema.org/draft/2020-12/schema",
      +  "additionalProperties": {},
      +  "properties": {
      +    "data": {
      +      "additionalProperties": {},
      +      "propertyNames": {
      +        "type": "string"
      +      },
      +      "type": "object"
      +    },
      +    "decision": {
      +      "additionalProperties": {},
      +      "properties": {
      +        "confidence": {
      +          "maximum": 1,
      +          "minimum": 0,
      +          "type": "number"
      +        },
      +        "score": {
      +          "type": "number"
      +        },
      +        "summary": {
      +          "type": "string"
      +        },
      +        "verdict": {
      +          "type": "string"
      +        }
      +      },
      +      "type": "object"
      +    },
      +    "evidence": {
      +      "items": {},
      +      "type": "array"
      +    },
      +    "freshness": {
      +      "additionalProperties": {},
      +      "properties": {
      +        "checkedAt": {
      +          "type": "string"
      +        },
      +        "maxAgeSeconds": {
      +          "type": "number"
      +        }
      +      },
      +      "type": "object"
      +    },
      +    "meta": {
      +      "additionalProperties": {},
      +      "propertyNames": {
      +        "type": "string"
      +      },
      +      "type": "object"
      +    },
      +    "nextActions": {
      +      "items": {},
      +      "type": "array"
      +    },
      +    "requestId": {
      +      "type": "string"
      +    },
      +    "status": {
      +      "type": "string"
      +    },
      +    "tool": {
      +      "type": "string"
      +    },
      +    "warnings": {
      +      "items": {},
      +      "type": "array"
      +    }
      +  },
      +  "type": "object"
      +}
  2. First observed

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, openWorldHint and destructiveHint=false, so the description must add value beyond that. It does: it discloses the $0.01 USDC x402 V2 cost model with separately authorized payment, and states the tool's limits ('identifies observable mismatches but cannot guarantee safety or authorize spending'). It stops short of any latency, rate-limit, or freshness-of-evidence detail beyond the returned 'freshness' field name.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The paragraph is front-loaded with purpose, then conditions, then cost, then a fallback — a sensible order with no filler prose. The one weak sentence is the enumerated return-field list, which duplicates what the existing output schema already declares and could be cut.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Output schema is present, so not explaining return values is acceptable, yet the description still names the key verdict fields for quick triage. Combined with explicit when/when-not guidance, cost disclosure, and a fallback route, an agent has enough to decide and call it; the missing parameter-level semantics is the only substantive hole.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% across five parameters, so the description carries the full burden and does not meet it. It never explains what 'target' accepts (URL vs. Base address), what 'routingId' is for, how 'maxPriceUsd' gates the $0.01 charge, or what 'expectedNetwork'/'intent' change in behavior. The 'intent' enum values are only inferable from the usage sentence, not explained.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb and resource ('Inspects public x402 terms or a Base recipient') and enumerates the decision payload it returns (verdict, score, confidence, evidence, warnings, freshness, nextActions). It is immediately distinguishable from market_execution_intel and structured_extract, which it explicitly contrasts itself against.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It states the trigger condition precisely ('Before paying, transferring to, or interacting with an unfamiliar machine resource, x402 endpoint, recipient, or Base address'), gives explicit exclusions ('Do NOT use when: You only need market execution conditions or webpage extraction'), and routes uncertain callers to a named free alternative, signal_layer_router.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources