blackpool
Integrates with NEAR Intents (1Click) for private cross-chain bridging, allowing agents to submit private transfers to solver deposit addresses and track bridge status.
Supports Blackpool private pools on Robinhood Chain, enabling agents to check balances, shield ETH/USDG, send privately, and swap on that network.
Supports private bridging to Solana through NEAR Intents, using Solana destination addresses and assets such as sol_usdc.
This server has a remotely hosted endpoint. Open its connector listing for connection details, authentication requirements, and setup instructions:
Blackpool
Private payments that leave no trail.
Shield an asset once. Send, swap and bridge it privately after that, from a web app, a CLI or an MCP server for AI agents, with no account, no custody and no trail back to your wallet.
Blackpool is a set of zero-knowledge privacy pools on EVM chains. Every pool is a Poseidon Merkle tree of encrypted notes; spending a note means proving in zero knowledge (Groth16) that you own a leaf without saying which one. A relayer submits the transaction and pays the gas, so your wallet never appears on-chain again after the deposit.
wallet ──sign once──► account keys (derived from the signature)
│
▼
┌────────────── private balance (notes in a pool) ──────────────┐
│ │ │ │
private send same-chain swap private bridge recover
(any EVM address) (ETH ⇄ stablecoin via DEX) (NEAR Intents) (from signature)
│ │ │
└──────────── relayer submits, pays gas ──────────┘The relayer sees a proof and an encrypted payload. It cannot link a withdrawal to a deposit, cannot spend notes and cannot decrypt anything: the AES key for recovery data is keccak256(signature) and the backend only ever learns a one-way derived identifier.
Networks
Chain | Pools | Status |
Robinhood Chain (4663) | ETH · USDG | live |
Base (8453) | ETH · USDC | live |
Arbitrum One (42161) | ETH · USDC | live |
BNB Smart Chain (56) | BNB · USDC · USDT | live |
Pool proxies (UUPS; the admin can upgrade and pause, nothing else). Admin on every chain: the 2-of-3 Safe 0x401027251176A8AFec701fE37412edeC45ec6FdB:
Chain | ETH / BNB pool | Stablecoin pool(s) |
Robinhood Chain | ||
Base | ||
Arbitrum One | ||
BNB Smart Chain | USDC |
Admin on every chain: 0xB1aCad20c0D0F6dA98841b09369eFAe46FdD8126. Several addresses repeat across chains (same deployer, same nonce) while being different contracts: always read an address with its chain.
Implementations, verifiers, hashers and deploy blocks for every chain are in deploy/ADDRESSES.md. The running API reports the pools it serves at GET https://api.blackpool.cash/api/health.
Related MCP server: Zcash MCP Server
Using it
Web app. blackpool.cash/app: connect a wallet, sign once, shield. blackpool.cash/recover recovers anything that got stuck mid-flow from the same signature, on any device.
CLI. @blackpool/cli drives the same API from a terminal, for scripts and agents:
npm i -g @blackpool/cli # or: npx @blackpool/cli help
blackpool login # key via hidden prompt (or BLACKPOOL_KEY for agents/CI)
blackpool balance --chain robinhood
blackpool deposit 0.5 --chain robinhood # shield
blackpool send 0x… 0.1 --chain robinhood # private send, no gas from you
blackpool send 0x… max --chain all # send every private balance to one address
blackpool bridge sol_usdc <solana address> 0.1 --from hood_eth
blackpool recover --chain all # sweep anything stranded, idempotentThe CLI keeps the key you give it and the cached sign-in signature in ~/.blackpool/ (mode 600). BLACKPOOL_KEY skips the interactive login for agents and CI.
MCP server
Blackpool ships a Model Context Protocol server, so AI agents in any MCP client (Cursor, VS Code, desktop chat apps and more) can shield, send, swap and bridge privately as tool calls. It is listed in the official MCP Registry as cash.blackpool/blackpool.
Local server (stdio), implemented in cli/bin/mcp.js. Proofs are built on the machine that runs it and the key never leaves it:
{
"mcpServers": {
"blackpool": {
"command": "npx",
"args": ["-y", "@blackpool/cli@latest", "mcp"],
"env": { "BLACKPOOL_KEY": "0x..." }
}
}
}Tool | What it does | |
| Address of the agent wallet | read-only |
| Private and public balances, per pool or every chain | read-only |
| Shield funds from the agent wallet into a private pool | writes |
| Pay any EVM address privately ( | writes |
| Private same-chain swap between the native coin and the stablecoin | writes |
| Private cross-chain transfer via NEAR Intents | writes |
| Every bridge of this account with its status | read-only |
| Bridge destinations and valid origins | read-only |
| Sweep anything stranded on one-time burners back into the private balance | idempotent |
BLACKPOOL_MCP_TOOLS=balance,send limits the tools, BLACKPOOL_MCP_READONLY=1 exposes only the read-only ones. The server starts and answers initialize and tools/list without a key; tools that move funds need BLACKPOOL_KEY.
Hosted server (Streamable HTTP), read-only, no key: https://mcp.blackpool.cash/mcp, with blackpool_assets, blackpool_bridge_quote, blackpool_fees, blackpool_analytics, blackpool_status and blackpool_guide.
Full agent guide: AGENTS.md.
How it works
Sign-in. The wallet signs one fixed message.
keccak256(sig)becomes the encryption key, its hash the UTXO spending key; the same wallet reproduces the same account anywhere. Keys, note scanning and Groth16 proofs are computed on the user's device (web worker in the app, Node in the CLI,cli/lib/zk.js); the relayer API receives finished proofs only and never the signature.Shield. A deposit inserts a commitment
Poseidon(amount, pubkey, blinding)into the pool's tree. The amount is free-form: no fixed denominations.Spend. A 2-in / 2-out Groth16 circuit (
circuits/) proves ownership of the inputs, correctness of the outputs and that the nullifiers are fresh. The relayer verifies the proof on-chain throughVerifier2.Swap. Same-chain swaps withdraw to a one-time burner wallet, swap on the chain's DEX, and re-shield. Burner keys are registered encrypted (client-side AES-GCM) so a stalled swap is recoverable from any device.
Bridge. Cross-chain transfers withdraw privately to a NEAR Intents (1Click) solver deposit address; the solver delivers on the destination chain. Refunds go back to the burner, which recovery re-shields.
The protocol reference lives at blackpool.cash/docs; the roadmap in ROADMAP.md.
Repository
circuits/ circom circuit (transaction2) + build artifacts
contracts/ EtherPool / ERCPool, MerkleTreeWithHistory, Verifier2, per-chain variants
src/ keypair, UTXO, proving, encryption, registry-auth derivation
scripts/ deploy + upgrade scripts, hasher/verifier generation
cli/ @blackpool/cli
frontend/ Next.js static app (blackpool.cash)
deploy/ the address book (ADDRESSES.md)
test/ hardhat test-suite (149 tests)Development
npm ci && npm ci --prefix cli
npm run compile # Hardhat 3 build + Poseidon hasher bytecode
npm run validate:upgrades # OpenZeppelin upgrade-safety checks on every pool contract
npm test # 150 tests, ~2 min (proves real Groth16 proofs)
node scripts/zkParity.js # client-side prover (cli/lib/zk.js) against the reference implementationContracts build with Hardhat 3 (hardhat.config.ts, solc 0.8.24, optimizer 200, EVM paris); the runtime bytecode is identical to the deployed implementations. Deploy a pool with scripts/deployPool.mjs and prepare an upgrade with scripts/prepareUpgrade.mjs (both npx hardhat run --network <chain> …, DEPLOYER_KEY in the environment). Pools are administered by a Safe: an upgrade deploys the new implementation and writes a Safe Transaction Builder file under deploy/safe/ with the upgradeToAndCall, which the Safe owners sign.
The relayer API and indexer are operated by Blackpool and are not part of this repository; the frontend and CLI talk to https://api.blackpool.cash. The frontend is a static export: cd frontend && npm run build.
Security
Non-custodial by construction: no server ever holds a key that can spend a note or decrypt recovery data. The relayer refuses anything that is not a fee-paying withdraw with a known root and unspent nullifiers, and simulates every transaction before broadcasting it.
Found something? Please read SECURITY.md and write to hello@blackpool.cash rather than opening a public issue.
Contributing
Issues and pull requests are welcome; see CONTRIBUTING.md. The cryptographic core (circuit, tree, note format, sign-in message) is frozen — changes there need a migration plan, not a PR.
License
MIT. See LICENSE.
Available Tools
9 toolsblackpool_addressWallet addressARead-onlyIdempotentInspect
Address of the agent wallet. Fund it with the asset to shield plus a little native gas for deposits.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already declare readOnlyHint=true, idempotentHint=true and destructiveHint=false, so the safety profile is fully covered. The description adds operationally useful context about funding the returned address with the shielded asset plus native gas. It does not say what the return value looks like (format, chain prefix) or whether the address is stable across sessions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, zero filler, with the core fact (this returns the wallet address) front-loaded and the funding hint following as supporting context. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter read with rich annotations and no output schema, this is nearly complete; the funding guidance covers the main follow-up action. The only real gap is not characterizing the returned address format, which matters slightly because no output schema exists.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes no parameters and the schema is trivially complete, so the baseline is 4. The description correctly implies a no-input read that simply yields the wallet address, leaving nothing ambiguous.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific resource, the agent wallet's address, and is clearly distinguishable from siblings such as blackpool_balance, blackpool_send and blackpool_deposit. It lacks an explicit retrieval verb such as 'returns' or 'get', so it falls just short of the crisp verb+resource form.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives an implicit use case: call this so you can fund the wallet with the asset to shield plus native gas before depositing. It never states when to call it versus blackpool_balance, nor any precondition such as needing the wallet initialized, so usage is inferred rather than spelled out.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
blackpool_assetsBridge assetsCRead-onlyIdempotentInspect
Bridge destination assets and valid origins.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, openWorldHint=true, and destructiveHint=false, so safety is covered. The description adds nothing beyond them: no statement of what data is returned, whether the result is static reference data or reflects live chain state, or what 'valid origins' means in practice. It does not contradict the annotations, but it contributes no behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
It is a single short phrase with no padding, so nothing is wasted. However, it is concise to the point of being an incomplete sentence rather than a front-loaded explanation, so brevity costs clarity here.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no parameters, no output schema, and annotations already covering the safety profile, the description is the only source of meaning about what this tool returns. It does not say whether the response is a list of bridgeable asset pairs, a mapping of origins per asset, or something else, leaving the tool's output shape entirely unknown.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters and the description has no parameter semantics to explain, so the baseline of 4 applies. The mention of 'destination assets' and 'origins' hints at what the invisible output is keyed on, but no parameters exist to clarify.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Bridge destination assets and valid origins' is a noun-phrase fragment that restates the title without a clear verb or object. It never says whether the tool lists bridgeable assets, returns supported origin/destination pairs, or performs a bridge. It also does nothing to distinguish itself from the sibling blackpool_bridge_quote.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance, no prerequisites, and no mention of the obvious alternative, blackpool_bridge_quote, which an agent would need to choose between. The agent is left to infer usage entirely from the name.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
blackpool_balanceBalancesBRead-onlyIdempotentInspect
Private (shielded) and public balances. With pool: one private pool only. wait=true polls up to 30 s while a private balance reads 0 (right after a deposit).
| Name | Required | Description | Default |
|---|---|---|---|
| pool | No | Pool on that chain: eth|usdc (base, arbitrum), eth|usdg (robinhood), bnb|usdc|usdt (bsc). Default: the chain's stablecoin pool. | |
| wait | No | ||
| chain | No | Chain, or "all". Default base. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly/idempotent/non-destructive/openWorld, so the bar is lower, and the description still adds real behavior beyond them: that both shielded and public balances are returned, that passing `pool` restricts results to a single private pool, and that `wait=true` blocks for up to 30 seconds due to eventual consistency after a deposit. It omits any mention of authorization requirements or the shape/ordering of returned balances.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences with no filler, and the resource scope is front-loaded before the parameter caveats. The telegraphic "With pool:" fragment is terse to the point of being slightly cryptic, but nothing is wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is read-only with no output schema, so the description must carry the return-value burden; it says private and public balances come back but not in what structure, units, or whether zero balances are included. Combined with the unresolved question of which account is being queried, an agent has enough to call it but not to fully anticipate the response.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The `wait` parameter has no schema description, and the description compensates well: "wait=true polls up to 30 s while a private balance reads 0 (right after a deposit)" explains semantics, latency and the triggering scenario. The schema already covers `pool` and `chain` (67% coverage), so the description only needed to fill the `wait` gap, which it does.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
"Private (shielded) and public balances" identifies the resource returned and the pool scoping rule, but it uses a noun phrase with no verb and never says whose balances are returned (the connected wallet vs. an address, which matters given the sibling blackpool_address). An agent can infer the core purpose but must guess at the subject of the query.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use guidance is given and no sibling is named: it is unclear how this differs from blackpool_assets or blackpool_address. The only conditional statement is about the `pool` parameter narrowing output to one pool, which is scoping rather than usage guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
blackpool_bridgePrivate bridgeADestructiveInspect
Private cross-chain transfer via NEAR Intents. from = origin private pool (base_eth, base_usdc, hood_eth, hood_usdg, arb_eth, arb_usdc, bsc_bnb, bsc_usdc, bsc_usdt); dest_asset from blackpool_assets; recipient is EVM 0x… or a Solana address for sol_*. Returns once submitted unless wait=true.
| Name | Required | Description | Default |
|---|---|---|---|
| from | Yes | ||
| wait | No | Poll delivery up to 6 minutes. Default false. | |
| amount | Yes | Decimal amount in token units, e.g. "10" or "0.25", or "max" (send: the whole pool balance; swap/bridge: the most one operation can move). Never wei. | |
| recipient | Yes | ||
| dest_asset | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true, openWorldHint=true, idempotentHint=false, so the risk profile is known from structured data. The description adds genuinely new behavior: the transfer is private, and it returns upon submission rather than delivery unless wait=true — important for an async cross-chain operation. It still says nothing about fees, minimums, failed-route behavior, or irreversibility of a submitted transfer, which matters for a destructive tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three compact sentences, purpose first, then parameter disambiguation, then return semantics — no filler. The semicolon-separated clauses and the pool enumeration are dense but each carries actionable information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive, open-world mutation with no output schema, the description covers what it does, valid inputs, and when it returns, which is enough to call it correctly. Missing are quantitative context (fees, limits), error/failure handling for a cross-chain route, and any note on whether a submitted transfer can be recalled.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With only 40% schema coverage, the description carries most of the burden and does it well: it enumerates the nine valid `from` pool values, points `dest_asset` at blackpool_assets, and explains that `recipient` is either an EVM 0x address or a Solana address when the asset is sol_*. Only `amount` is left to the schema, which already documents it thoroughly.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource — 'Private cross-chain transfer via NEAR Intents' — which is far more than the title's restatement and clearly implies bridging rather than sending or swapping. It never names a sibling such as blackpool_send or blackpool_swap, so the agent must infer the boundary from the 'cross-chain' qualifier alone.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives clear preconditions: `from` must be one of the enumerated private pools, and `dest_asset` must come from the blackpool_assets sibling, which routes the agent to the right lookup call before invoking this one. It stops short of explicit exclusions — nothing says to use blackpool_send for same-chain moves or when a bridge route is unavailable.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
blackpool_bridgesBridge historyARead-onlyIdempotentInspect
Every bridge of this account with status (PENDING_DEPOSIT, PROCESSING, SUCCESS, REFUNDED, FAILED) and refund address.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already declare readOnlyHint, idempotentHint and destructiveHint=false, so the safety profile is covered. The description adds genuine context beyond them by disclosing the full status taxonomy (PENDING_DEPOSIT, PROCESSING, SUCCESS, REFUNDED, FAILED) and that each record carries a refund address, which tells the agent how to interpret results. It omits ordering, pagination and account-selection behaviour, which keeps it from a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler; the status list is the most decision-relevant content and appears early. The phrasing 'every bridge ... with status (...) and refund address' is slightly elliptical but readable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-argument read tool with no output schema, the description carries the burden of describing the return, and it only names two pieces of each record (status and refund address). Amount, source/destination chain, timestamps and ordering are unstated, so an agent cannot fully predict the shape of the response even though it can call the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are zero parameters, so the baseline is 4. The description usefully confirms the scope is implicit-account-wide ('this account') rather than requiring a filter, which is the only semantic an agent could get wrong here.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names the resource precisely ('every bridge of this account') and enumerates the status values returned, so an agent can tell it is a history/listing read rather than the bridge-creation sibling blackpool_bridge. It stops short of explicitly contrasting itself with that sibling, so it stops at 4.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied: the enumeration of statuses like PENDING_DEPOSIT and PROCESSING suggests this is the tool to poll for bridge progress, but the description never states when to call it or what alternative exists. With blackpool_bridge and blackpool_recover as near neighbours, an explicit 'use blackpool_bridge to initiate a bridge' line would have removed the inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
blackpool_depositShield (deposit)ADestructiveInspect
Shield public funds from the agent wallet into the private pool. Signs and pays gas from the agent wallet. Takes 30-90 s. Do not retry after a timeout without checking blackpool_balance.
| Name | Required | Description | Default |
|---|---|---|---|
| pool | No | Pool on that chain: eth|usdc (base, arbitrum), eth|usdg (robinhood), bnb|usdc|usdt (bsc). Default: the chain's stablecoin pool. | |
| chain | No | Chain. Default base. | |
| amount | Yes | Decimal amount in token units, e.g. "10" or "0.25", or "max" (send: the whole pool balance; swap/bridge: the most one operation can move). Never wei. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already flag this as destructive, non-idempotent, and open-world, so the description doesn't need to re-establish risk. It adds genuinely new behavioral facts: gas is paid from the agent wallet, execution takes 30-90 seconds, and a timeout is not evidence of failure, which directly addresses the non-idempotent hazard.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, front-loaded with the purpose, then cost, then timing and the retry warning. Every sentence carries distinct information with no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive, open-world mutation with no output schema, the description covers cost, latency, and retry safety well, but never says what the call returns (transaction hash? receipt?) or whether it waits for confirmation. An agent can call it correctly but cannot predict the result shape.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so amount, chain, and pool semantics (including the 'max' sentinel and per-chain pool options) are already fully documented in the schema. The description adds no parameter-level meaning beyond that, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action (shielding/depositing funds) with a clear source (agent wallet) and destination (private pool), which is distinct from siblings like blackpool_send or blackpool_swap. It never names a sibling to contrast with explicitly, but the verb+resource+scope combination is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives operational guidance (expect 30-90 s, don't retry on timeout without checking blackpool_balance) but no guidance on when to choose deposit over blackpool_send or blackpool_bridges, nor any stated prerequisites such as needing a funded wallet.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
blackpool_recoverRecoverBIdempotentInspect
Sweep every registered burner that still holds funds back to the agent wallet (or to). Safe to run any time.
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | ||
| chain | No | Chain. Default base. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare idempotentHint=true and destructiveHint=false, and "safe to run any time" is consistent with that, adding confirmation context. However, the description never explains what happens to burners with zero funds, whether gas is required on each chain, whether partial failures are possible, or what the call reports back — meaningful gaps for a funds-moving operation with openWorldHint=true.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with the action and destination first, then the safety note. The trailing parenthetical "(or to)" is slightly awkward, but nothing is wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a two-parameter, zero-required, no-output-schema tool, the description covers the core action and destination adequately. It remains thin on return behavior, gas handling, and the meaning of "registered burner," which an agent would need to use it confidently across the five supported chains.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 50% schema coverage, the `chain` enum is documented in the schema while `to` has only a regex pattern. The description's "(or to)" does add real meaning by framing `to` as an alternate sweep destination, but it does not say whether that address must be registered or whether the override applies across all chains.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
"Sweep every registered burner that still holds funds back to the agent wallet (or to)" names a specific verb (sweep) and resource (burner-held funds) plus the destination, which separates it from siblings like blackpool_send or blackpool_deposit. The only gap is the undefined term "registered burner," which an agent may not be able to resolve without external knowledge.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
"Safe to run any time" gives a rough usage signal but no explicit when-to-use versus when-not-to-use, and it never points to an alternative such as blackpool_balance for checking holdings or blackpool_send for targeted transfers. Usage is implied rather than stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
blackpool_sendPrivate sendADestructiveInspect
Pay any EVM address privately from the private balance. The relayer pays gas; the recipient receives amount minus the fee (flat + 0.35%). amount "max" sends the whole balance of the pool (or of every pool when pool is omitted), splitting across several sends when needed and leaving dust untouched. Takes 30-90 s per send. Never retry after a timeout without checking blackpool_balance.
| Name | Required | Description | Default |
|---|---|---|---|
| pool | No | Pool on that chain: eth|usdc (base, arbitrum), eth|usdg (robinhood), bnb|usdc|usdt (bsc). Default: the chain's stablecoin pool. | |
| chain | No | Chain. Default base. | |
| amount | Yes | Decimal amount in token units, e.g. "10" or "0.25", or "max" for the whole private balance. Never wei. | |
| recipient | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already flag destructive, non-idempotent, open-world behavior, but the description adds substantial context beyond them: the relayer pays gas, the fee is flat plus 0.35% deducted from the received amount, "max" splits across sends and leaves dust, and each send takes 30-90 s. The timeout retry warning is exactly the operational guidance an agent needs for a non-idempotent send.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with purpose, then fee, then max semantics, then latency, then the retry hazard. Four compact sentences with no filler; each one changes how an agent would call the tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive, non-idempotent payment tool with no output schema, the description covers cost, timing, and failure handling well. It stops short of saying what a successful call returns (e.g., a tx hash or operation id) and leaves the flat fee amount unspecified, which an agent may need before committing funds.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 75% and the description adds meaning on top, especially the "max" token behavior (whole pool balance, or every pool when pool is omitted) which the schema pattern alone does not convey. Recipient remains undocumented in both, but its regex constraint makes that low-risk.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb and resource ("Pay any EVM address privately from the private balance"), which immediately separates it from siblings like blackpool_deposit, blackpool_swap, and blackpool_bridge. An agent knows exactly which operation this is without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It states the context of use (private balance payout), clarifies the "max" case including the multi-pool variant, and explicitly routes post-timeout behavior to blackpool_balance. It does not, however, explicitly say when to prefer blackpool_bridge or blackpool_swap instead, so the sibling routing is only partially covered.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
blackpool_swapPrivate swapADestructiveInspect
Private same-chain swap between the native pool and the stablecoin pool; output is re-shielded. If it stops half-way, run blackpool_recover.
| Name | Required | Description | Default |
|---|---|---|---|
| from | Yes | Pool to swap from (eth|usdc on base/arbitrum, eth|usdg on robinhood, bnb|usdt on bsc). | |
| chain | No | Chain. Default base. | |
| amount | Yes | Decimal amount in token units, e.g. "10" or "0.25", or "max" (send: the whole pool balance; swap/bridge: the most one operation can move). Never wei. | |
| slippage_bps | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the annotations, the description discloses privacy, same-chain scope, re-shielded output, and recovery behavior on partial failure. It does not mention fees, rate behavior, or approval requirements, but it adds meaningful operational context for a destructive swap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two short sentences, front-loads what the tool does, and immediately follows with the recovery path. There is no redundant or filler wording.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a four-parameter swap with no output schema, it covers the core operation, privacy behavior, same-chain constraint, and failure recovery. Minor gaps remain around slippage behavior and fee/rate expectations, but the essential invoke-and-recover guidance is present.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 75%, so the schema already documents from, chain, and amount. The description adds no parameter-level meaning, and slippage_bps remains unexplained in both the schema and the description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: a private same-chain swap between the native pool and stablecoin pool, with re-shielded output. It clearly distinguishes same-chain swaps from bridge-related siblings, though it does not explicitly contrast with send or deposit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives a useful recovery instruction: if the swap stops halfway, run blackpool_recover. However, it does not explicitly say when to use this swap versus blackpool_bridge, blackpool_send, or blackpool_deposit beyond the same-chain constraint.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
9 tool updates
v0.1.0- First observed
blackpool_address - First observed
blackpool_assets - First observed
blackpool_balance - First observed
blackpool_bridge - First observed
blackpool_bridges - First observed
blackpool_deposit - First observed
blackpool_recover - First observed
blackpool_send - First observed
blackpool_swap
TDQS
Scored across 9 tools
Most tools map to clearly distinct actions (deposit vs send vs swap vs recover), but blackpool_bridge (initiate a cross-chain transfer) and blackpool_bridges (list existing bridges) differ only by a plural 's', which is an easy misselection trap. blackpool_assets and blackpool_bridges are also both read-only metadata/list tools that could be confused at a glance. The descriptions do disambiguate once read, which keeps this above a 2.
All nine tools share the same blackpool_ prefix and a flat lowercase style with no camelCase or multi-word mixing, so the surface looks uniform. However, the naming is noun-based for some tools (address, balance, assets, bridges) and verb-based for others (send, deposit, swap, recover), and the singular/plural bridge pair is not a predictable pattern.
Nine tools is well within the sweet spot and each one covers a distinct facet of a private wallet: identity, balances, shield, send, swap, bridge (create/list/assets), and recovery. Nothing appears redundant or padded, and nothing essential is obviously missing from the count.
The lifecycle is largely covered: funding address, shielded balance reads, deposit in, private send out, swap, cross-chain bridge with status listing and destination metadata, plus a recovery sweep for stuck funds. The main gap is an explicit unshield/withdraw-to-public operation and any transaction history beyond bridge records, though send-to-self could work around the former.
Maintenance
Related MCP Connectors
Crypto transaction firewall and risk tools for MCP agents.
Non-custodial USDC yield vaults on Base mainnet with 9 MCP tools for AI agent treasury.
Private stablecoin payments for people and AI agents on mainnet, hosted or local with limits.
Production-grade MCP gateway delivering 8 real-time AI tools with instant x402 micropayments settled in USDC on Base Mainnet or SPL-USDC on Solana. Features Basescan contract auditing, wallet analytics, headless browser scraping, and pre-scraped oracle data feeds.
Related MCP Servers
- AlicenseAqualityCmaintenanceZcash MCP server for AI agents. 12 tools for shielded operations, memo decoding, ZAP1 attestation. Works with Claude, ChatGPT, OpenClaw.2088 npm1MIT
- AlicenseAqualityDmaintenanceEnables AI agents to send and receive private Zcash payments with shielded transactions, balance checks, and encrypted memos.5MIT

@coinbase/payments-mcpofficial
AlicenseNot gradedqualityDmaintenanceCombines wallets, onramps, and payments via x402 to enable AI agents to autonomously discover and pay for services without API keys or complex setup.48 npm58Apache 2.0- AlicenseNot gradedqualityBmaintenanceNon-custodial BVCC Agent Wallet MCP server: let an AI agent check balances, send native/ERC-20, approve, and swap on Uniswap v3/v4 across Ethereum, BNB Chain, Arbitrum and Base, within on-chain enforced limits.601 npm2MIT