Skip to main content
Glama

Verify SIWE signature and get a JWT

submit_auth_verify

Exchange a signed SIWE challenge message (from get_auth_challenge) for a JWT scoped to that wallet. The returned jwt must be passed explicitly as the jwt argument to submit_deposit/submit_withdrawal/submit_config for that same wallet — this server does not cache or store it. The JWT is only valid for the walletAddress that produced the signature; using it for a different wallet's write call will be rejected upstream. Reuse the same jwt for subsequent write calls to this wallet instead of re-authenticating every time — the response's expiresAt (decoded from the JWT's own exp claim) says how long it's good for. Rate limited to 5 calls/minute per caller, no more than one call every 12s.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
chainNoChain name, e.g. BASE, ETHEREUM, POLYGON. Defaults to ETHEREUM if omitted. For an EOA wallet this is irrelevant (signature recovery is chain-agnostic). For a smart-contract wallet, this MUST be the chain it has (or, if undeployed, would have via ERC-6492 counterfactual deployment) a valid signer on for this signature — it determines which chain's RPC is queried to validate it (ERC-1271/6492), and does not need to match the chain passed to get_auth_challenge.
signatureYespersonal_sign signature of the SIWE message from get_auth_challenge.
walletAddressYesEVM wallet address (0x-prefixed, 40 hex chars). Any casing is accepted — it is normalized to its EIP-55 checksum before being forwarded upstream.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations only indicate non-read-only and non-destructive; the description carries the behavioral detail. It discloses that the server does not cache or store the JWT, that the JWT is wallet-scoped, that expiration comes from the JWT's exp claim, and that the endpoint is rate limited to 5 calls/minute with a 12s minimum interval. This goes well beyond the structured annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four dense sentences, each earning its place: the exchange purpose, downstream consumption requirement, wallet-scoping constraint, and rate-limiting constraint. The most operationally important details are front-loaded after a one-sentence purpose, with no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description still names the key return values (jwt and expiresAt) and explains how to consume and reuse them. It also covers relevant failure modes and rate limits, making the tool safely callable with just the provided description and schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already documents all three parameters at 100% coverage, including chain behavior, address normalization, and signature type. The description reinforces wallet scoping and signature origin but adds no new field-level semantics beyond the schema. A baseline 3 is appropriate because the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific exchange: a signed SIWE challenge message from get_auth_challenge is turned into a JWT scoped to a wallet. This clearly differentiates it from the sibling get_auth_challenge, which produces the challenge rather than consuming the signature.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly tells the agent to pass the returned jwt to submit_deposit/submit_withdrawal/submit_config, to reuse the same jwt, and that using it for a different wallet will be rejected upstream. It also states the rate limit, so an agent knows when calls may fail. This is direct, actionable usage guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources