Skip to main content
Glama

Get SIWE auth challenge

get_auth_challenge

Get a Sign-In-With-Ethereum challenge message for a wallet, required before any deposit/withdrawal/config-update tool. The returned message must be signed with personal_sign (EIP-191) by the wallet's own signer, then passed to submit_auth_verify. Does NOT itself authenticate anything — it only issues the message to sign. Repeated calls for the same walletAddress within a short window (a few minutes) return the SAME message rather than a fresh one — the backend only keeps one pending challenge per wallet at a time, and generating a new one would invalidate whatever an earlier caller is about to sign, so this is deliberate, not a caching bug. chain does not affect which cached message you get back. Rate limited to 10 calls/minute per caller, no more than one call every 6s.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
chainNoChain name, e.g. BASE, ETHEREUM, POLYGON. Defaults to ETHEREUM if omitted. Cosmetic only — shown as the 'Chain ID:' line in the SIWE message text, does not need to match the chain passed to submit_auth_verify.
walletAddressYesEVM wallet address (0x-prefixed, 40 hex chars). Any casing is accepted — it is normalized to its EIP-55 checksum before being forwarded upstream.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds substantial behavioral context beyond the annotations, including the deliberate caching behavior for repeated walletAddress calls, the one-pending-challenge-per-wallet invalidation effect, the cosmetic nature of chain, and the rate limits. This is exactly the kind of non-obvious runtime behavior an agent needs to avoid misinterpreting repeated same-message responses as a bug.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but every sentence carries essential information: purpose, prerequisite role, signing flow, non-authentication clarification, idempotent caching semantics, chain behavior, and rate limits. It is front-loaded with the core purpose and then layers critical caveats without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's central role in an authentication precondition flow, the description covers all invocations-critical facts: what to do with the returned message, how to proceed next, the caching behavior that could otherwise confuse agents, rate limiting, and parameter nuances. The lack of an output schema is mitigated because the description clearly references the returned message and its intended use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema already documents both parameters. The description adds meaningful extra nuance: chain is cosmetic and need not match the chain passed to submit_auth_verify, and walletAddress casing is normalized to EIP-55. This goes beyond the baseline schema descriptions and helps the agent use the parameters correctly.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the specific action: obtaining a Sign-In-With-Ethereum challenge message for a wallet. It also differentiates itself from submit_auth_verify by explicitly noting that this tool does NOT authenticate and only issues the message to sign, making its role unmistakable among the sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit when-to-use guidance: it is required before any deposit/withdrawal/config-update tool. It also explains the exact follow-up flow—sign the message with personal_sign and pass it to submit_auth_verify—and clarifies that the tool itself does not perform authentication, so an agent knows not to treat it as the final auth step.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources