Read NablaZ's open record: agent actions under permission, cited onchain. Evidence, not a verdict.
Scored across 1 tool
With only one tool there is no risk of selection confusion between competing options. However, the single surface is tasked with several conceptually different concerns (raw facts, permission labels, provenance/citation, and block-range caveats), so the agent gets no disambiguation aid beyond the description.
read_subject is a clean verb_noun name, and with a single tool there is by definition no inconsistency in convention.
The tool itself is substantive rather than trivial, covering a full address fact dump, but a one-tool surface is thin and pushes every distinct read intent (chain discovery, filtering, provenance lookup) through a single catch-all call.
Reading indexed facts is covered end-to-end for one address on one chain, but obvious adjacent operations are absent: no way to list supported chains/IDs, no pagination or filtering by fact type or permission label, and no method to reproduce a log directly despite the description referencing an RPC command.
Returns every fact the reader has indexed about an address on one chain, as GET /read/:chainId/:address JSON: each fact names its source, carries a permission label of shape (a) to (e), and cites the block, transaction and log index with a command that returns the same log from any RPC. A note reading nothing indexed (blocks X..Y) covers only that block range, and does not mean nothing happened on chain.
| Name | Required | Description | Default |
|---|---|---|---|
| address | Yes | The subject address, 0x-prefixed | |
| chainId | Yes | EVM chain id, for example 42161 (Arbitrum One) or 8453 (Base) |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly, idempotent, non-destructive and closed-world, so the description rightly spends its words elsewhere: it discloses the response shape, that each fact names its source and carries a permission label, and that facts cite block/transaction/log index with a reproducing RPC command. The most valuable addition is the caveat that a 'nothing indexed (blocks X..Y)' note covers only that range and does not mean nothing happened on chain, which prevents a false negative inference.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the outcome and followed by the caveat, with little wasted wording. The parentheticals are dense to the point of opacity ('permission label of shape (a) to (e)'), which costs a bit of clarity but not length.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description must explain return values, and it does so only partially: the permission labels (a)–(e) are referenced but never defined, and nothing is said about result size, ordering, or limits despite promising 'every fact'. The empty-range caveat is a genuine completeness win, but the return contract remains under-specified.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, with both address and chainId documented including example chain ids, so the schema carries the parameter burden. The description only restates the chain scoping ('on one chain') and the path form, adding no format or validation detail beyond what the schema already provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Returns every fact the reader has indexed about an address on one chain') and pins the scope to a single chain plus a concrete endpoint shape (GET /read/:chainId/:address). An agent knows exactly what it gets back without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There are no siblings to route against, but the description never explicitly states when to call this tool or what its prerequisites are. Usage is only implied by the resource description, and the one interpretive rule given (the empty-range note) is about reading results rather than choosing the tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
read_subjectSigned, publicly logged records of what your AI agent did, with proofs anyone can check offline.
Audit AI agents' tool calls, planning and memory; Base on-chain data; pay per call via x402.
Read-only watchtower for AI agents on-chain: decoded receipts, plan vs execution, Safe audits.
Signed, append-only receipts of an AI agent's decisions and outcomes, with public proof links.
Add one secure layer between your agents and this server.