Skip to main content
Glama
Sign In

Borro

by markets.borro
OverviewDiscussionsAdmin

Prepare: register a policy

policy_register
Read-onlyIdempotent

An unsigned transaction to register a policy in the PolicyRegistry from its owner's wallet: manifest_hash (keccak256 of the manifest's bytes at uri), the manifest's https uri, and the model, prompt, image (the enclave's compose hash, for rung 1) and verification-key (SP1, for rung 2) hashes lenders read without the manifest; the zero hash for an image or vkey the policy has none of. The policy's id is keccak256(abi.encode(owner, manifest_hash)), returned here before the transaction is sent. The owner can later update the uri, transfer the policy, disown a wallet that claims it without running it, and pardon one it disowned. The registry holds no money. Rung 0: a signature from the wallet ("I run policy H"), checked by nobody, defaults up to 250 USDG a day. Rung 1: a hardware attestation (a dstack TEE quote) that the wallet's key lives in an enclave running image H, verified off chain by Borro's keeper, which attests on chain; the raw quote is public, so anyone can re-verify; up to 500. Rung 2: a zk proof per action (SP1) that the action is what program H outputs on committed inputs, checked by the SP1 verifier contract at the registry; up to 1,000. Simulated from the wallet; nothing is sent.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "wallet": "<wallet>",
      "manifest_hash": "<manifest_hash>",
      "uri": "<uri>",
      "model_hash": "<model_hash>",
      "prompt_hash": "<prompt_hash>"
    },
    "name": "policy_register"
  }
}

Input Schema

NameRequiredDescriptionDefault
uriYesThe manifest's https URL
vkeyNobytes32: the SP1 program's verification key, for rung 2 (optional; the zero hash without one)
walletYesThe wallet's address (0x...); the transactions are built for it to sign
image_hashNobytes32: the enclave's compose hash, for rung 1 (optional; the zero hash without one)
model_hashYesbytes32: the model's hash or id hash
prompt_hashYesbytes32: the prompt's hash
manifest_hashYesbytes32: keccak256 of the manifest's bytes at uri

Schema Changelog

Changes observed during successful MCP inspections.

  1. Added

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly/idempotent/non-destructive/not-open-world, and the description reinforces this by stating the transaction is simulated and nothing is sent, plus that the registry holds no money. It adds real behavioral context (off-chain keeper verification at rung 1, on-chain SP1 verifier at rung 2, raw quote public and re-verifiable, the id computed and returned before sending), though it says nothing about required permissions/authorization beyond ownership or about failure modes.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The core purpose is front-loaded, but the body is a long semicolon-chained sentence followed by a tangent about updating the uri, transferring, disowning and pardoning wallets, which does not help the caller invoke this tool. The rung-by-rung economics (250/500/1,000 USDG) are detail-heavy for a registration call.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 7-parameter mutation-preparation tool with no output schema, the description covers the essential contract: what is built, how the id is derived, what the transaction does not do (broadcast, hold funds). It would be stronger with a note on the unsigned transaction's return shape beyond the id, but it is otherwise sufficient to call correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3, but the description adds meaning: manifest_hash is tied to the manifest bytes at uri, image_hash is the enclave compose hash used only at rung 1, vkey is the SP1 key used only at rung 2, and zero hashes stand in when a policy lacks one. It also explains that the policy id derives from owner + manifest_hash, which is not visible from the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Opens with a specific verb and resource: an unsigned transaction that registers a policy in the PolicyRegistry from the owner's wallet. It clearly distinguishes itself from the sibling read/claim/prove tools (policy, policy_claim, policy_prove) by being the preparation step that builds the registration transaction.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied rather than stated: the rung 0/1/2 explanation tells the caller which hash parameters apply, and 'Simulated from the wallet; nothing is sent' clarifies that this never broadcasts. However, there is no explicit when-to-use/when-not statement and no named alternative among the many siblings, so the agent must infer the calling context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Borro toolsInspect
Try in Browser
One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources