Skip to main content
Glama
aiexp1

Tanod MCP server

chainpeek: list a wallet's live token approvals (ERC-20 and Permit2) with revoke transactions

audit_token_approvals
Read-onlyIdempotent

List a wallet's live ERC-20 and Permit2 token approvals, flag risky or stale spenders, and return unsigned revoke transactions to set allowances to zero.

Instructions

chainpeek: List a wallet's live token approvals and get revoke transactions. For tokens already pulled out use check_wallet_drain; for one allowance use get_allowance. Returns the live ERC-20 and Permit2 allowances of wallet: amount, unlimited, spender code (key-controlled, contract, new contract), newest approval and pull, stale, flags with evidence, and revoke, the unsigned transaction that sets it to 0. Candidates: approval events in the latest 6,000 blocks, Permit2, and spenders. High: unlimited to a key-controlled account. Medium: limited to one, or unlimited to a contract with no code 30 days ago. Low: other unlimited or stale. Older approvals are found only via spenders or Permit2. Bad input is a 422, a failed read a 502 (neither charged). Nothing is signed or sent. Typically 3-15 s. Price: USD 0.005. Free: 10 chain reads per IP per UTC day. Docs: https://tanod.dev/learn/token-approval-audit-api.html

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
chainYesbase or ethereum (the chains with built-in USDC and USDT here).
tokensNoUp to 50 token contracts to audit. Default: USDC, USDT and up to 18 tokens the wallet has sent (from its transfer history).
walletYesThe wallet whose approvals are audited (0x + 40 hex).
spendersNoUp to 50 spender addresses whose ERC-20 and Permit2 allowances are read directly on every audited token, however old (tokens x spenders at most 200). The full-coverage path for spenders you know.
stale_daysNoAn allowance is stale when the spender pulled nothing from the wallet in this many days (1-3,650; default 90).
lookback_blocksNoLatest blocks scanned for approval events (0-6,000; default 6,000, about 3.3 hours on Base and 20 hours on Ethereum). 0 scans nothing and checks `spenders` and Permit2 only.

Output Schema

TableJSON Schema
NameRequiredDescriptionDefault
riskNo
blockNo
chainNo
errorNoOnly on an error result: an object {code, message}, or the reason string of an x402 PaymentRequired object.
rulesNo
limitsNo
tokensNo
walletNo
checkedNo
historyNo
reasonsNo
rpc_callsNo
allowancesNo
stale_daysNo
block_timestampNo
allowances_totalNo

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.3.0

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly/idempotent/non-destructive, and the description goes further with material context: 'Nothing is signed or sent,' error semantics (422 for bad input, 502 for failed read, neither charged), runtime (3-15 s), price (USD 0.005), a free tier (10 chain reads per IP per UTC day), and a docs link. This is rich disclosure beyond the structured annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads the verb and the sibling routing, then layers return fields, risk tiers, errors, timing, and pricing. Dense but mostly load-bearing per sentence. It loses a point for enumerating return fields ('amount, `unlimited`, spender code... `revoke`') that the output schema already supplies.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 6-parameter, Permit2-aware audit tool the description covers scope, candidate sources, risk semantics, staleness, errors, latency, cost, and safety. With an output schema present, the return values needn't be re-explained, and nothing needed to invoke it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3; the description nonetheless adds behavior beyond the schema by explaining that the 6,000-block scan only surfaces recent candidates and that older approvals require `spenders` or Permit2, plus how risk tiers (High/Medium/Low) are assigned from unlimited/key-controlled vs contract-with-no-code distinctions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource+scope: 'List a wallet's live token approvals and get revoke transactions,' naming ERC-20 and Permit2 coverage in the title. It explicitly distinguishes itself from two siblings, check_wallet_drain (already-drained tokens) and get_allowance (single allowance), so an agent can route without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit when-to-use routing ('For tokens already pulled out use check_wallet_drain; for one allowance use get_allowance') and an edge-case condition ('Older approvals are found only via `spenders` or Permit2'). It also explains when the spenders/lookback_blocks path is the necessary choice.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools