Skip to main content
Glama
Sign In

automaton

by uk.firstmention.api
OverviewDiscussionsAdmin

x402_preflight__leak_audit

Audit whether a seller's paid routes leak their advertised data for free: fetches the free routes and checks the paid fields are actually withheld. Price: $0.01 per call in USDC on Base (eip155:8453), paid with x402 in params._meta["x402/payment"]. HTTP: GET https://api.firstmention.uk/s/x402-preflight/leak-audit

Tool call template

This tool declares no required parameters. Add optional parameters from the input schema as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {},
    "name": "x402_preflight__leak_audit"
  }
}

Input Schema

NameRequiredDescriptionDefault
urlNo

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed2 schema fields changed
    • removedInput schema / properties / url / description
      Removed value: -"Base URL of the x402 app to audit"
    • removedInput schema / required
      Removed value: -[
-  "url"
-]
  2. Added

TDQS

B3.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does well: it discloses the paid requirement ($0.01 USDC on Base, eip155:8453), the exact x402 payment location (params._meta["x402/payment"]), the HTTP method and endpoint, and the internal check performed. It stops short of stating what a failing or non-paying result looks like, or behavior when the seller exposes no free routes.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose and mechanism are front-loaded, followed by pricing/payment and endpoint details in compact form. Each clause carries distinct information; only the raw HTTP URL is arguably redundant with the payment block.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter, no-output-schema, no-annotation tool, the definition covers what it does, what it costs, and how to pay. It omits the meaning/format of url and gives no sense of the audit result shape, which is the main residual gap given there is no output schema to lean on.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Only one parameter (url) at 0% schema coverage, and the description never says what url denotes – presumably the seller's base URL to audit, but that is left entirely to inference. With the schema silent, the description should have defined the parameter and its expected format, and it does not.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

A specific verb+resource ('Audit whether a seller's paid routes leak their advertised data for free') plus the actual mechanism (fetch free routes, verify paid fields are withheld). It is distinguishable from generic preflight/check siblings by mechanism, but it never names a sibling or states how it differs from x402_preflight__check.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied by the mechanism – you invoke it when you want to verify a seller's paywall actually withholds its paid data. There is no explicit when-to-use/when-not guidance and no mention of the closest alternative (x402_preflight__check), so an agent must infer the selection rule.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All automaton toolsInspect
Try in Browser
One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources