Skip to main content
Glama
clawallex

Clawallex MCP Server

by clawallex

@clawallex/mcp-server

MCP Server for the Clawallex payment API. Pay for anything with USDC — Clawallex converts your stablecoin balance into virtual cards that work at any online checkout.

Quick Start

1. Install

npm install -g @clawallex/mcp-server

Or use directly via npx (no install needed).

2. Get API Credentials

Sign up at Clawallex and create an API Key pair (api_key + api_secret).

3. Configure Your AI Client

Choose your client and add the configuration:

Claude Desktop

Add to your claude_desktop_config.json:

{
  "mcpServers": {
    "clawallex": {
      "command": "npx",
      "args": ["@clawallex/mcp-server"],
      "env": {
        "CLAWALLEX_API_KEY": "your_api_key",
        "CLAWALLEX_API_SECRET": "your_api_secret"
      }
    }
  }
}

Claude Code

claude mcp add --scope local clawallex -- npx @clawallex/mcp-server \
  --api-key your_api_key \
  --api-secret your_api_secret

Codex CLI

Add to your ~/.codex/config.toml or .codex/config.toml:

[mcp_servers.clawallex]
command = "npx"
args = [
  "@clawallex/mcp-server",
  "--api-key",
  "your_api_key",
  "--api-secret",
  "your_api_secret",
]

Gemini CLI

Add to your ~/.gemini/settings.json:

{
  "mcpServers": {
    "clawallex": {
      "command": "npx",
      "args": [
        "@clawallex/mcp-server",
        "--api-key", "your_api_key",
        "--api-secret", "your_api_secret"
      ]
    }
  }
}

OpenCode

Add to your opencode.json:

{
  "mcp": {
    "clawallex": {
      "type": "local",
      "command": ["npx", "@clawallex/mcp-server", "--api-key", "your_api_key", "--api-secret", "your_api_secret"],
      "enabled": true
    }
  }
}

4. Initialize Connection

After configuring, tell your AI agent:

"Run clawallex_setup to check the connection"

clawallex_setup verifies your API Key and automatically binds a client_id for data isolation. You only need to do this once.

5. Start Using

One-time payment:

"Pay $50 for OpenAI API credits"

Agent calls clawallex_pay → creates virtual card → get_card_detailsdecrypt_card_data → fills checkout.

Subscription:

"Set up a $100 card for AWS monthly billing"

Agent calls clawallex_subscribe → creates reloadable card → clawallex_refill when balance is low.

6. Smoke Test

Verify everything works:

clawallex_setup     → should show "ready" with bound client_id
get_wallet          → should return wallet balance
list_cards          → should return card list (empty if no cards yet)

Related MCP server: AgentCard MCP Server

Typical Flows

Payment Flow (Mode A — Wallet Balance)

1. clawallex_setup                           → verify connection & bind identity
2. get_wallet                                → check USDC balance
3. clawallex_pay({ amount, description })    → create a one-time virtual card
4. get_card_details({ card_id })             → get encrypted card data
5. decrypt_card_data({ nonce, ciphertext })  → decrypt PAN/CVV for checkout

Subscription Flow

1. clawallex_setup                                          → verify connection
2. get_wallet                                               → check USDC balance
3. clawallex_subscribe({ initial_amount, description })     → create reloadable card
4. get_card_details({ card_id })                            → get card number
5. clawallex_refill({ card_id, amount })                    → top up when needed

Tools

Tool

Description

clawallex_setup

Check connection status and bind agent identity

clawallex_pay

One-time payment — creates a single-use virtual card

clawallex_subscribe

Recurring subscription — creates a reloadable card

clawallex_refill

Top up a subscription card balance

Identity & Binding

Tool

Description

whoami

Query current API Key binding status (read-only)

bootstrap

Bind a client_id to this API Key

Wallet & Query

Tool

Description

get_wallet

Get wallet balance and status

get_wallet_recharge_addresses

Get on-chain USDC deposit addresses

list_cards

List virtual cards created by this agent

get_card_balance

Get card balance and status

batch_card_balances

Check balances for multiple cards in one call

update_card

Update card risk controls (tx_limit, allowed_mcc, blocked_mcc)

get_card_details

Get card details including risk controls, cardholder info, and encrypted PAN/CVV

decrypt_card_data

Decrypt PAN/CVV from get_card_details

list_transactions

List card transactions with optional filters

Advanced (x402 On-Chain)

Tool

Description

get_x402_payee_address

Get on-chain receiving address for x402 payments

create_card_order

Create a card with full control (supports Mode B two-stage)

refill_card

Refill a stream card with x402 or custom idempotency keys

CLI Options

Option

Env Variable

Required

Default

Description

--api-key

CLAWALLEX_API_KEY

Yes

Clawallex API Key

--api-secret

CLAWALLEX_API_SECRET

Yes

Clawallex API Secret (HMAC-SHA256 signing)

--base-url

CLAWALLEX_BASE_URL

No

https://api.clawallex.com

API base URL

--client-id

CLAWALLEX_CLIENT_ID

No

auto-generated

Agent identity UUID. See Client ID section.

--transport

No

stdio

Transport mode: stdio, sse, http

--port

No

18080

HTTP port for sse / http transport

CLI arguments take precedence over environment variables. You can mix both — e.g. set credentials via env vars and override --transport via CLI.

Requirements

  • Node.js >= 22

Client ID

client_id is the agent's stable identity, separate from the API Key. It is sent as X-Client-Id on every /payment/* request.

Key concept: An agent can have multiple API Keys (for rotation/revocation), but the client_id never changes. When switching to a new API Key, keep using the same client_id — the new key auto-binds on first request.

Data isolation:

  • Wallet: user-level, shared — all agents using the same API key see the same wallet balance

  • Cards & Transactions: client_id-scoped — each agent only sees data it created

Binding rules:

  • clawallex_setup automatically calls bootstrap to bind client_id on first use

  • Once bound, the client_id cannot be changed for that API Key (TOFU — Trust On First Use)

  • Losing the client_id = losing access to all cards created under it

Resolution order at startup:

  1. --client-id <value> CLI argument (must be >= 36 characters)

  2. ~/.clawallex-mcp/client_ids.json local file (from a previous run)

  3. Auto-generate UUID v4 and save locally

Recommendation: Always pass --client-id explicitly in production to avoid relying on the local file.

Transport Modes

stdio (default — local agent / Claude Desktop)

npx @clawallex/mcp-server \
  --api-key your_api_key \
  --api-secret your_api_secret

SSE (remote agent, compatible with older MCP clients)

npx @clawallex/mcp-server \
  --api-key your_api_key \
  --api-secret your_api_secret \
  --transport sse \
  --port 18080

Agent connects to: http://localhost:18080/sse

npx @clawallex/mcp-server \
  --api-key your_api_key \
  --api-secret your_api_secret \
  --transport http \
  --port 18080

Agent connects to: http://localhost:18080/mcp

Local Development

npm install
npm run build

# List all tools (stdio)
echo '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}' \
  | node dist/index.js \
    --api-key your_api_key \
    --api-secret your_api_secret \
  2>/dev/null

Security

Authentication

Every API request is signed with HMAC-SHA256:

canonical = METHOD + "\n" + PATH + "\n" + TIMESTAMP + "\n" + hex(sha256(body))
X-Signature = base64(hmac_sha256(api_secret, canonical))

Signing is handled automatically by the MCP server.

Card Details Encryption

get_card_details returns encrypted_sensitive_data containing card PAN and CVV. Use decrypt_card_data to decrypt:

  1. Derive key: HKDF-SHA256(ikm=api_secret, info="clawallex/card-sensitive-data/v1", length=32)

  2. Decrypt: AES-256-GCM(key, nonce, ciphertext)

  3. Result: { "pan": "4111...", "cvv": "123" }

Decrypted PAN/CVV must NEVER be displayed to the user — only used for filling checkout forms.

Available Tools

18 tools
batch_card_balancesB

Check balances for multiple cards in one call.

ParametersJSON Schema
NameRequiredDescriptionDefault
card_idsYesArray of card IDs

TDQS

B3.1/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. While 'Check' implies a read-only operation, the description does not confirm this, nor does it describe error handling (e.g., behavior when card_ids are invalid), rate limits, or return format.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise at only 8 words, front-loaded with the action, and contains no redundant or filler text. However, it borders on underspecification given the lack of supporting annotations or output schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a batch operation tool with no output schema and no annotations, the description is incomplete. It omits critical operational details such as maximum batch size, pagination behavior, error handling for partial failures, and the structure of returned balance data.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 100% schema description coverage ('Array of card IDs'), the schema fully documents the parameter. The description adds no additional semantic context, examples, or format constraints beyond what the schema provides, warranting the baseline score.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Check') and resource ('balances' for 'cards') and implies batch processing ('multiple cards in one call'). However, it does not explicitly differentiate from the sibling tool 'get_card_balance' despite the clear functional overlap.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'in one call' implies efficiency benefits for batch operations, suggesting when to use this tool (for multiple cards). However, it lacks explicit guidance on when to prefer 'get_card_balance' instead, or any limitations on batch size.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

bootstrapA

Bind a client_id to the current API Key, or let the server generate one. This is the recommended way to establish agent identity before making payment calls. Once bound, the client_id cannot be changed for this API Key. Behavior: • API Key not yet bound + no preferred_client_id → server generates a ca_ prefixed ID. • API Key not yet bound + preferred_client_id → binds the provided value. • API Key already bound + same value (or omitted) → idempotent, returns existing binding. • API Key already bound + different value → 409 conflict. On success, the returned client_id is automatically saved locally. Example: bootstrap() → { client_id: 'ca_abc123', created: true } Example: bootstrap({ preferred_client_id: 'my-agent-uuid' }) → { client_id: 'my-agent-uuid', created: true }

ParametersJSON Schema
NameRequiredDescriptionDefault
preferred_client_idNoOptional: your preferred client_id value. If omitted, server generates one with ca_ prefix.

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden and excels: it details the four-state behavior matrix (bound/unbound × provided/generated), declares idempotency, warns of 409 conflicts, and discloses the local side effect ('automatically saved locally').

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Well-structured with front-loaded purpose, followed by usage context, constraint warning, bulleted behavior specifications, and examples. Slightly verbose but information-dense; every sentence serves a specific function for agent decision-making.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite lacking an output schema, the description provides explicit JSON return examples showing the structure ({client_id, created}), covers error conditions (409 conflict), and explains the immutable binding constraint—sufficient for a stateful initialization tool with complex idempotency rules.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds concrete usage examples that clarify the parameter's role, but the schema already fully documents the optional string parameter and its 'ca_' prefix generation behavior.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with the specific action ('Bind a client_id to the current API Key') and clearly distinguishes this identity-establishment tool from payment-oriented siblings like 'clawallex_pay' or 'create_card_order' in the function list.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states this is the 'recommended way to establish agent identity before making payment calls,' providing clear temporal context. However, it doesn't explicitly contrast with the 'whoami' sibling tool or state when NOT to use it (beyond the implicit 409 conflict case).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

clawallex_payA

Pay for a product or service using USDC. Creates a single-use flash virtual card (card_type=100), deducts from wallet balance, returns card details for checkout.

Mode A (mode_code=100, default): wallet balance → flash card. Immediate settlement. Mode B (mode_code=200): for callers with self-custody wallets — signing is performed by the caller. x402 on-chain two-stage flow: Stage 1 (Quote): POST with mode_code=200, chain_code, token_code. The 402 response is EXPECTED — it is a quote, NOT an error. Returns: card_order_id, client_request_id, x402_reference_id, payee_address, asset_address, final_card_amount, issue_fee_amount, fx_fee_amount, fee_amount, payable_amount. Agent signs: construct and sign an EIP-3009 transferWithAuthorization using your own wallet/signing library. Stage 2 requires the resulting signature and your wallet address (authorization.from). authorization fields: from=your wallet address, to=payee_address, value=maxAmountRequired, validAfter/validBefore=unix seconds validity window, nonce=random 32-byte hex (unique per auth). Stage 2 (Settle): POST again with SAME client_request_id + signed x402 data: - payment_requirements.payTo MUST equal payee_address from Stage 1 - payment_requirements.asset MUST equal asset_address from Stage 1 - payment_requirements.maxAmountRequired MUST equal payable_amount × 10^decimals (USDC = 6 decimals, e.g. '207.59' → '207590000') - payment_requirements.extra.referenceId MUST equal x402_reference_id from Stage 1 - extra.card_amount MUST equal amount, extra.paid_amount MUST equal amount + fee_amount - If settle is rejected, order stays pending_payment — fix params and retry with same client_request_id.

Fee structure: fee_amount = issue_fee_amount + fx_fee_amount. total_amount = amount + fee_amount.

Example (Mode A): clawallex_pay({ amount: 50, description: 'OpenAI API credits' })

ParametersJSON Schema
NameRequiredDescriptionDefault
amountYesCard face amount in USD
descriptionYesWhat this payment is for
mode_codeNo100=wallet (default), 200=x402 on-chain
tx_limitNoPer-transaction limit in USD (optional, default 100.0000)
allowed_mccNoMCC whitelist, comma-separated (optional, e.g. '5734,5815')
blocked_mccNoMCC blacklist, comma-separated (optional, e.g. '7995')
client_request_idNoUUID idempotency key (<=64 chars). Mode B Stage 2: MUST reuse from Stage 1.
chain_codeNoChain code for Mode B Stage 1 (e.g. 'ETH')
token_codeNoToken code for Mode B Stage 1 (e.g. 'USDC')
extraNoMode B Stage 2 (required): { card_amount, paid_amount }
x402_reference_idNox402 reference ID. Card creation Stage 1: optional (server generates if omitted). Stage 2: use value from 402 response. Refill Mode B: required, serves as idempotency key.
x402_versionNox402 version (Mode B Stage 2, required)
payment_payloadNox402 payment payload (Mode B Stage 2, required)
payment_requirementsNox402 payment requirements (Mode B Stage 2, required)
payer_addressNoPayer wallet address (optional, final value from verify)

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full behavioral disclosure. It explains the fee structure (issue_fee_amount + fx_fee_amount), state management (order stays pending_payment if settle rejected), cryptographic requirements (EIP-3009 transferWithAuthorization), and precise decimal handling (USDC = 6 decimals). It also clarifies the mutating nature (deducts from wallet, creates card).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Despite substantial length, the description is well-structured with clear sections (Mode A, Mode B Stage 1/2, Fee structure, Example) and front-loaded purpose. Every paragraph serves a necessary function given the complexity of the x402 cryptographic flow. Minor deduction for density, but appropriate for a 15-parameter tool with two distinct operational modes.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex payment tool with 15 parameters, nested objects, no annotations, and no output schema, the description is remarkably complete. It covers return values for both modes (card details for Mode A, specific field list for Stage 1), error handling semantics, idempotency strategies, and cryptographic signing requirements—leaving no critical gaps in agent understanding.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

While the schema has 100% description coverage (baseline 3), the description adds significant semantic value by explaining cross-parameter relationships: how Stage 1 outputs (payee_address, asset_address, x402_reference_id) map to Stage 2 inputs (payment_requirements fields), the calculation logic for maxAmountRequired (payable_amount × 10^decimals), and idempotency constraints across stages.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a clear action ('Pay for a product or service using USDC') and specifies the resource created ('single-use flash virtual card'). It distinguishes itself from sibling tools like 'clawallex_refill' or 'create_card_order' by emphasizing the flash card nature and the two distinct payment modes (wallet vs. x402 on-chain).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly delineates Mode A (mode_code=100, default for wallet balance) versus Mode B (mode_code=200 for self-custody wallets with signing). Details the two-stage x402 flow (Quote vs. Settle), clarifies that 402 responses are expected quotes not errors, and specifies idempotency requirements using client_request_id. Provides concrete usage example for Mode A.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

clawallex_refillA

Top up the balance of a subscription (stream) card. Only stream cards (card_type=200) can be refilled. Refill mode follows the card's creation mode.

Mode A: deducts from wallet balance. client_request_id is the idempotency key (auto-generated if omitted). Mode B: x402 settle (no 402 challenge stage) — agent must first call get_x402_payee_address to get payee_address, then construct payment_requirements.payTo from it. Requires x402_reference_id, x402_version, payment_payload, payment_requirements. Mode B idempotency key is x402_reference_id (not client_request_id).

Tip: use get_card_balance first to check current balance. Example: clawallex_refill({ card_id: 'c_123', amount: 50 })

ParametersJSON Schema
NameRequiredDescriptionDefault
card_idYesStream card ID to refill
amountYesRefill amount in USD
client_request_idNoMode A idempotency key (auto-generated if omitted)
x402_reference_idNox402 reference ID. Card creation Stage 1: optional (server generates if omitted). Stage 2: use value from 402 response. Refill Mode B: required, serves as idempotency key.
x402_versionNox402 version (Mode B Stage 2, required)
payment_payloadNox402 payment payload (Mode B Stage 2, required)
payment_requirementsNox402 payment requirements (Mode B Stage 2, required)
payer_addressNoPayer wallet address (optional, final value from verify)

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With zero annotations provided, the description carries full behavioral disclosure burden excellently. Explains Mode A deducts from wallet, Mode B uses x402 settle without 402 challenge, differing idempotency key behaviors per mode, and auto-generation rules. No contradictions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Information-dense but well-structured: core purpose → restriction → Mode A logic → Mode B logic → prerequisite tip → concrete example. Every sentence serves a distinct purpose; complex dual-mode logic is explained without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given high complexity (8 params, 2 distinct payment modes, nested objects) and lack of annotations/output schema, the description comprehensively covers invocation logic and behavioral traits. Minor gap: does not describe return values or success indicators, though this is partially mitigated by the explicit example showing expected input format.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Despite 100% schema coverage (baseline 3), adds significant workflow context: explains Mode B requires constructing payment_requirements.payTo from the payee_address, clarifies that x402_reference_id serves as the idempotency key in Mode B (distinct from client_request_id), and maps parameters to their respective modes.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Opens with specific verb+resource ('Top up the balance of a subscription (stream) card') and immediately distinguishes from sibling tool 'refill_card' via the restriction 'Only stream cards (card_type=200) can be refilled', clearly scoping the tool's domain.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly names prerequisite tools ('use get_card_balance first', 'must first call get_x402_payee_address') and describes Mode A vs Mode B selection criteria. Deducts one point for not explicitly contrasting with sibling 'refill_card' for non-stream cards, though the card_type restriction implies this scope.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

clawallex_setupA

Check current Clawallex connection status and ensure agent identity is bound. Calls whoami to verify API Key, then bootstrap to bind client_id if not yet bound. Use this after starting the MCP server to confirm everything is ready for payment operations. Returns: user_id, api_key_id, bound_client_id, client_id_bound status.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries full burden. It discloses the internal two-step process (calls whoami, then conditionally bootstrap), explains the conditional binding logic ('if not yet bound'), and lists return fields (user_id, api_key_id, etc.) despite no output schema existing. Could mention error states or retry behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four sentences with zero waste: (1) purpose, (2) implementation mechanism, (3) usage timing, (4) return values. Well-structured and front-loaded. No redundant phrases or tautology.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter setup tool with no annotations, the description is comprehensive. It compensates for the missing output schema by explicitly documenting return values. Covers prerequisites (MCP server started), internal behavior, and success indicators (client_id_bound status).

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Tool has zero input parameters. Per evaluation rules, zero parameters establishes a baseline of 4. The description correctly focuses on behavior and return values rather than inventing parameter documentation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Specific verbs ('Check', 'ensure', 'bind') clearly state the tool verifies connection status and identity binding. It distinguishes itself from siblings by explicitly stating it 'Calls whoami' and 'bootstrap', positioning itself as a composite setup utility rather than requiring manual invocation of those lower-level tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit temporal guidance: 'Use this after starting the MCP server to confirm everything is ready for payment operations.' Clearly indicates this is an initialization/verification step. Lacks explicit 'when not to use' guidance (e.g., skipping if already verified), though it implies idempotency via 'if not yet bound'.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

clawallex_subscribeA

Set up a reloadable virtual card for recurring/subscription payments. Creates a stream card (card_type=200) that stays active and can be refilled via clawallex_refill.

Mode A (mode_code=100, default): wallet balance → stream card. Immediate settlement. Mode B (mode_code=200): for callers with self-custody wallets — signing is performed by the caller. Same x402 two-stage flow as clawallex_pay. The 402 response is EXPECTED (a quote, not an error). See clawallex_pay for full Stage 1/2 details.

Fee structure: fee_amount = issue_fee_amount + monthly_fee_amount + fx_fee_amount.

Example: clawallex_subscribe({ initial_amount: 100, description: 'AWS monthly billing' })

ParametersJSON Schema
NameRequiredDescriptionDefault
initial_amountYesInitial deposit in USD
descriptionYesSubscription purpose
mode_codeNo100=wallet (default), 200=x402 on-chain
tx_limitNoPer-transaction limit in USD (optional, default 100.0000)
allowed_mccNoMCC whitelist, comma-separated (optional, e.g. '5734,5815')
blocked_mccNoMCC blacklist, comma-separated (optional, e.g. '7995')
client_request_idNoUUID idempotency key (<=64 chars). Mode B Stage 2: MUST reuse from Stage 1.
chain_codeNoChain code for Mode B Stage 1 (e.g. 'ETH')
token_codeNoToken code for Mode B Stage 1 (e.g. 'USDC')
extraNoMode B Stage 2 (required): { card_amount, paid_amount }
x402_reference_idNox402 reference ID. Card creation Stage 1: optional (server generates if omitted). Stage 2: use value from 402 response. Refill Mode B: required, serves as idempotency key.
x402_versionNox402 version (Mode B Stage 2, required)
payment_payloadNox402 payment payload (Mode B Stage 2, required)
payment_requirementsNox402 payment requirements (Mode B Stage 2, required)
payer_addressNoPayer wallet address (optional, final value from verify)

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries full burden. Discloses critical behavioral traits: fee structure formula (issue + monthly + fx), card persistence ('stays active'), and Mode B's expected 402 response ('EXPECTED (a quote, not an error)'). Explains settlement differences between modes (immediate vs two-stage).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Information-dense but well-structured: purpose statement → mode differentiation → fee disclosure → example. No redundant text despite 15-parameter complexity. Front-loaded with core concept before diving into technical modes.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Excellent coverage for complex tool with nested objects and dual-mode operation. Addresses financial transparency (fees) and protocol specifics (x402). Lacks explicit description of return values, though no output schema exists to mandate this. References sibling tools appropriately rather than duplicating x402 documentation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% providing baseline 3. Description adds value by providing concrete example (initial_amount: 100), clarifying Mode B workflow requirements ('client_request_id: MUST reuse from Stage 1'), and explaining x402 reference ID usage across stages. Elevates above baseline but doesn't fully elaborate on all 15 parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description explicitly states 'Set up a reloadable virtual card for recurring/subscription payments' with specific resource (stream card/card_type=200). Clearly distinguishes from siblings by referencing clawallex_refill for refilling and clawallex_pay for x402 flow details, establishing distinct responsibility.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly defines when to use ('recurring/subscription payments') versus alternatives. Delineates Mode A (wallet) vs Mode B (self-custody/x402) usage patterns. References clawallex_pay for Stage 1/2 details, providing clear navigation between related tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

create_card_orderA

Advanced: create a virtual card with full control over payment mode and card type. Maps directly to POST /payment/card-orders. Most agents should use clawallex_pay or clawallex_subscribe instead.

Mode A (mode_code=100): wallet balance deduction, immediate settlement. Mode B (mode_code=200): for callers with self-custody wallets — signing is performed by the caller. x402 two-stage flow: Stage 1 (Quote): provide chain_code + token_code. The 402 response is EXPECTED (a quote, NOT an error). Returns: payee_address, asset_address, x402_reference_id, fee breakdown, payable_amount. Agent signs: construct and sign an EIP-3009 transferWithAuthorization using your own wallet/signing library. Stage 2 requires the resulting signature and your wallet address (authorization.from). authorization fields: from=your wallet, to=payee_address, value=maxAmountRequired, validAfter/validBefore=unix seconds validity window, nonce=random 32-byte hex (unique per auth). Stage 2 (Settle): reuse SAME client_request_id + provide x402_version, payment_payload, payment_requirements, extra. - payment_requirements.payTo MUST equal payee_address from Stage 1 - payment_requirements.asset MUST equal asset_address from Stage 1 - maxAmountRequired = payable_amount × 10^decimals (USDC = 6, e.g. '207.59' → '207590000'). If settle rejected, order stays pending_payment — retry with same client_request_id.

card_type: 100=flash (single-use), 200=stream (reloadable). Fee: flash = issue_fee + fx_fee; stream = issue_fee + monthly_fee + fx_fee.

ParametersJSON Schema
NameRequiredDescriptionDefault
mode_codeYesPayment mode: 100=Mode A (wallet balance), 200=Mode B (x402 on-chain USDC)
card_typeYesCard type: 100=flash (single-use), 200=stream (reloadable via refill_card)
amountYesCard face amount in USD, decimal string e.g. '100.0000'
client_request_idYesUUID idempotency key — MUST be same for both Stage 1 and Stage 2
fee_amountNoFee amount in USD (optional, must match server-calculated fee if provided)
tx_limitNoPer-transaction limit in USD (optional, default 100.0000)
allowed_mccNoMCC whitelist, comma-separated (optional, e.g. '5734,5815')
blocked_mccNoMCC blacklist, comma-separated (optional, e.g. '7995')
chain_codeNoChain code for Mode B Stage 1 (e.g. 'ETH', 'BASE')
token_codeNoToken code for Mode B Stage 1 (e.g. 'USDC')
extraNoMode B Stage 2: { card_amount, paid_amount }
x402_reference_idNox402 reference ID. Card creation Stage 1: optional (server generates if omitted). Stage 2: use value from 402 response. Refill Mode B: required, serves as idempotency key.
x402_versionNox402 version (Mode B Stage 2, required)
payment_payloadNox402 payment payload (Mode B Stage 2, required)
payment_requirementsNox402 payment requirements (Mode B Stage 2, required)
payer_addressNoPayer wallet address (optional, final value from verify)

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, description carries full behavioral burden effectively. Discloses that 402 responses are expected quotes (not errors) in Stage 1, explains the pending_payment state on settlement rejection, details the EIP-3009 signing requirements, and maps the endpoint (POST /payment/card-orders).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Lengthy but information-dense and well-structured with clear Mode A/Mode B separation. Front-loaded with purpose and sibling warnings. Every sentence conveys technical specification necessary for the complex x402 flow; no filler content despite length.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 16-parameter tool with nested objects and no output schema, description adequately explains Stage 1 return values (payee_address, asset_address, etc.) and final state behaviors. Minor gap: does not describe the final card object structure on success, though this may be retrievable via get_card_details.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema has 100% coverage (baseline 3). Description adds crucial semantic context: explains that client_request_id must remain identical across Stage 1 and 2, details the maxAmountRequired calculation (×10^decimals), and clarifies which parameters are required for which stage (e.g., chain_code/token_code for Stage 1, payment_payload for Stage 2).

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description explicitly states it creates a virtual card with full control over payment mode and card type. Critically, it distinguishes from siblings by stating 'Most agents should use clawallex_pay or clawallex_subscribe instead,' providing clear scope differentiation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit when-not-to-use guidance ('Most agents should use...instead'). Details when to use Mode A (wallet balance) vs Mode B (self-custody wallets with signing). Explains the two-stage flow requirements and retry conditions ('If settle rejected, order stays pending_payment — retry with same client_request_id').

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

decrypt_card_dataA

Decrypt the encrypted_sensitive_data from get_card_details to obtain PAN and CVV. Input: the nonce and ciphertext fields from encrypted_sensitive_data. Output: { pan, cvv } — the full card number and security code. Decryption: HKDF-SHA256(api_secret, info='clawallex/card-sensitive-data/v1') → AES-256-GCM. SECURITY: The decrypted PAN and CVV are STRICTLY for filling checkout/payment forms. NEVER display, log, or return the raw card number or CVV to the user. NEVER include PAN/CVV in conversation text shown to the user. If the user asks to see their card number, show only the masked_pan from get_card_details.

ParametersJSON Schema
NameRequiredDescriptionDefault
nonceYesThe nonce field from encrypted_sensitive_data (base64 encoded)
ciphertextYesThe ciphertext field from encrypted_sensitive_data (base64 encoded)

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries full burden. It discloses the decryption algorithm (HKDF-SHA256 → AES-256-GCM), output structure ({ pan, cvv }), and comprehensive security handling requirements (never log, never display to user, strict use-case limitation). Excellent behavioral disclosure for a sensitive cryptographic operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Information-dense and well-structured: purpose → input specification → output format → technical details → security warnings. Security constraints are appropriately emphasized with capitalization. No wasted words despite covering complex cryptographic and compliance requirements.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Comprehensive for a security-critical tool. Despite no output schema, it explicitly documents the return values (pan, cvv). Prerequisites (calling get_card_details first), cryptographic method, and security constraints are all thoroughly covered.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema has 100% coverage with base64 encoding details. Description adds valuable semantic context that these parameters come 'from encrypted_sensitive_data' (the output of get_card_details), helping the agent understand the data lineage beyond raw parameter definitions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description explicitly states the tool 'Decrypt[s] the encrypted_sensitive_data from get_card_details to obtain PAN and CVV' — specific verb, specific resource, and clearly distinguishes from sibling get_card_details by specifying it processes that tool's output.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when to use (to decrypt data from get_card_details), what input to use (nonce/ciphertext fields), and provides strict when-NOT-to-use security constraints: 'STRICTLY for filling checkout/payment forms' and 'NEVER display, log, or return.' Also names alternative for viewing cards: 'show only the masked_pan from get_card_details.'

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_card_balanceA

Get the current balance and status of a virtual card. Only cards created by this agent (same client_id) are accessible. Returns available_balance, card_currency, status, and updated_at.

ParametersJSON Schema
NameRequiredDescriptionDefault
card_idYesCard ID, e.g. 'c_123'

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries full disclosure burden. It successfully documents the access control policy (same client_id restriction) and compensates for the missing output schema by listing specific return fields (available_balance, card_currency, status, updated_at). Minor gap: no error behavior described.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences total, front-loaded with purpose, followed by access constraints, then return value documentation. No filler or redundant content; every clause provides necessary information not available in structured fields.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter read tool, the description adequately compensates for missing annotations and output schema by disclosing return structure and access restrictions. Would benefit from brief mention of error behavior (e.g., card not found) to be fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Input schema has 100% description coverage (card_id with example format 'c_123'). Since the schema fully documents the parameter, the baseline score of 3 applies; the description does not need to add redundant parameter details.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description opens with specific verb 'Get' and clearly identifies the resource (current balance and status of a virtual card). It implicitly distinguishes from sibling batch_card_balances (single vs. multiple cards) and get_card_details (specific balance/status focus vs. general details).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides clear access constraint ('Only cards created by this agent (same client_id) are accessible') which establishes when the tool is applicable. However, it does not explicitly name alternatives like batch_card_balances for bulk operations or differentiate from get_card_details.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_card_detailsA

Get full card details including masked PAN, expiry, balance, cardholder info, billing address, risk controls, and encrypted sensitive data. Returns: masked_pan, expiry, balance, status, first_name, last_name, delivery_address, tx_limit, allowed_mcc, blocked_mcc, encrypted_sensitive_data. The encrypted_sensitive_data field contains PAN and CVV encrypted with AES-256-GCM. To decrypt, use the decrypt_card_data tool with the encrypted_sensitive_data object. Only cards created by this agent (same client_id) are accessible. IMPORTANT: Never display the decrypted PAN or CVV to the user. Use them only for filling checkout forms.

ParametersJSON Schema
NameRequiredDescriptionDefault
card_idYesCard ID, e.g. 'c_123'

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full disclosure burden: it explains AES-256-GCM encryption, access control boundaries (same client_id only), security constraints (never display sensitive data), and the two-step retrieval/decryption workflow.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with specific action and resource list; each subsequent sentence adds critical behavioral, security, or workflow information. The return field list is justified given no output schema exists.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Comprehensive coverage of return values (compensating for missing output schema), encryption method, decryption prerequisites, access controls, and security protocols appropriate for sensitive financial data handling.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with clear card_id description. The description adds value by constraining valid inputs ('Only cards created by this agent are accessible'), providing semantic context about authorization not present in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description explicitly states 'Get full card details' and lists specific resources (masked PAN, expiry, balance, etc.), clearly distinguishing this from sibling tools like get_card_balance (single field) and list_cards (summary view).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly references sibling tool decrypt_card_data for decryption workflow ('To decrypt, use the decrypt_card_data tool'), states access constraints ('Only cards created by this agent'), and provides critical security exclusions ('Never display the decrypted PAN or CVV').

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_walletA

Get the wallet details for the current API key. Each API key has exactly one wallet — shared across all agents using the same API key. Returns available_balance, frozen_balance, low_balance_threshold, currency (USD), and status. Use this to check if there is sufficient balance before creating cards (Mode A) or refilling (Mode A).

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It discloses critical behavioral traits: the singleton nature ('Each API key has exactly one wallet'), sharing semantics ('shared across all agents'), and compensates for the missing output schema by enumerating return fields (available_balance, frozen_balance, status, etc.). It lacks rate limits or error conditions, but covers the essential behavioral contract.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four sentences, zero waste: (1) Purpose declaration, (2) Singleton/sharing behavior, (3) Return value specification (compensating for missing output schema), (4) Usage guidelines. Information is front-loaded and every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple getter with no output schema, the description is appropriately complete. It enumerates the five specific fields returned, explains the wallet ownership model, and provides usage context. Without annotations or output schema, it successfully compensates to provide sufficient context for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0 parameters (100% coverage of empty set). Per scoring rules, 0 params = baseline 4. The description correctly avoids inventing parameter documentation where none exist, maintaining appropriate silence on inputs.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'Get the wallet details for the current API key' — a specific verb (Get) + resource (wallet details) + scope (current API key). It clearly distinguishes itself from siblings like get_wallet_recharge_addresses (which gets addresses, not balance/status) and get_card_balance (card-level vs wallet-level).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit when-to-use guidance: 'Use this to check if there is sufficient balance before creating cards (Mode A) or refilling (Mode A).' This establishes the prerequisite check pattern relative to sibling operations like create_card_order and refill_card, though it could explicitly name those tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_wallet_recharge_addressesA

Get the on-chain deposit addresses for a wallet. Send USDC to one of these addresses to top up the wallet balance. Each address is specific to a chain (e.g. BASE) and token (e.g. USDC). For Mode B (x402) card creation/refill, the system automatically selects the acquiring address — you do not need to call this manually.

ParametersJSON Schema
NameRequiredDescriptionDefault
wallet_idYesWallet ID returned by get_wallet, e.g. 'w_123'

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It successfully explains address scoping (chain/token specificity like BASE/USDC) and the auto-selection behavior for Mode B. However, it lacks details on address persistence (static vs. generated per call), error handling for invalid wallet_ids, or rate limiting.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four well-structured sentences: purpose (1), usage instruction (2), address characteristics (3), and exclusion guideline (4). Every sentence conveys unique information without redundancy, properly front-loading the core action.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter tool without output schema, the description is complete. It explains the return value concept (deposit addresses), the domain context (USDC, topping up), and differentiates from automatic workflows, providing sufficient context for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% description coverage (wallet_id is fully documented with type and example). The description adds no explicit parameter discussion, which is appropriate given the schema's completeness, meeting the baseline expectation for high-coverage schemas.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb-resource pair ('Get the on-chain deposit addresses for a wallet') and distinguishes itself from siblings by explicitly referencing Mode B (x402) workflows, clarifying this tool is for manual deposit address retrieval rather than automatic card operations.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Excellent guidance provided: it states when to use ('Send USDC to one of these addresses to top up the wallet balance') and explicitly when NOT to use ('For Mode B (x402) card creation/refill... you do not need to call this manually'), directly contrasting with sibling tools like get_x402_payee_address and clawallex_refill.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_x402_payee_addressA

Get the system receiving address for x402 on-chain payments.

When to use: MUST call this before Mode B Refill to obtain payee_address for payment_requirements.payTo. Not needed for Mode B card creation — the 402 quote response already includes payee_address.

Common chain + token combinations: BASE + USDC, ETH + USDC. If this returns 404: the payee address for this chain/token is not initialized — try a different chain or contact support.

ParametersJSON Schema
NameRequiredDescriptionDefault
chain_codeYesChain code, e.g. 'ETH', 'BASE'
token_codeYesToken code, e.g. 'USDC'

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden and successfully discloses error behavior ('If this returns 404... not initialized') and recovery actions ('try a different chain or contact support'). It also notes common valid input combinations. It lacks explicit read-only designation or return format details, but covers the critical failure modes.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four tightly structured sentences with zero redundancy: purpose statement, mandatory usage condition, exclusion condition, and input/error guidance. Information is front-loaded and every sentence earns its place by providing distinct operational guidance.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple 2-parameter lookup tool without output schema, the description comprehensively covers purpose, workflow integration (Mode B Refill vs creation), valid input patterns, and error handling. It could briefly describe the expected address format return value, but the tool name and context provide sufficient inference for agent usage.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, establishing a baseline of 3. The description adds valuable semantic context by listing common valid pairings ('BASE + USDC, ETH + USDC') and embedding the parameters within the workflow context ('obtain payee_address for payment_requirements.payTo'), enhancing understanding beyond raw schema definitions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the specific action (Get) and resource (system receiving address for x402 on-chain payments). It distinguishes itself from sibling card/wallet tools by specifying 'x402' and 'payee_address', making its unique purpose immediately identifiable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit when-to-use ('MUST call this before Mode B Refill') and when-not-to-use ('Not needed for Mode B card creation') guidance. It names the specific alternative workflow (402 quote response) and contextual parameters (payment_requirements.payTo), leaving no ambiguity about tool selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_cardsA

List virtual cards created by this agent (scoped to the server's client_id). Cards created by other agents using the same API key are not visible. Returns: card_id, mode_code (100=Mode A, 200=Mode B), card_type (flash/stream), status, masked PAN, balance, and expiry. Tip: check mode_code to determine refill path — Mode A uses wallet balance, Mode B uses x402 on-chain.

ParametersJSON Schema
NameRequiredDescriptionDefault
pageNoPage number, starting from 1 (default 1)
page_sizeNoResults per page, max 100 (default 20)

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden and succeeds: it discloses scoping rules (client_id isolation), visibility boundaries, and return value structure (card_id, mode_code mappings, card_type values). It also explains business logic implications (refill paths). Could explicitly note the read-only nature.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four well-structured sentences: purpose/scoping, visibility constraint, return values, and operational tip. Every sentence adds distinct value. Front-loaded with the core action, no redundant fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Compensates effectively for the missing output schema by documenting return fields (card_id, mode_code meanings, card_type values, etc.) and their business logic. Given the 100% input schema coverage and moderate complexity, the description is complete, though rate limits or pagination totals could enhance it further.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% description coverage for both pagination parameters (page, page_size), establishing a baseline of 3. The description does not add parameter-specific semantics, but none are needed given the schema's completeness and the description's focus on return values and behavioral context.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource ('List virtual cards'), clearly defines the scope ('created by this agent', 'scoped to the server's client_id'), and distinguishes from sibling retrieval tools like get_card_details by emphasizing the list nature and visibility constraints.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides actionable usage guidance through the tip about checking mode_code to determine refill paths (Mode A vs Mode B). The visibility constraint note ('Cards created by other agents...are not visible') clarifies expected results. Lacks explicit comparison to sibling tools like get_card_details.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_transactionsA

List card transactions for this agent (scoped to the server's client_id). Transactions from other agents using the same API key are not visible. All filter parameters are optional — omit all to list recent transactions across all cards.

ParametersJSON Schema
NameRequiredDescriptionDefault
card_tx_idNoFilter by platform transaction ID (e.g. 'ctx_123')
issuer_tx_idNoFilter by issuer transaction ID
card_idNoFilter by card ID (e.g. 'c_123') to get transactions for one card
pageNoPage number, starting from 1 (default 1)
page_sizeNoResults per page, max 100 (default 20)

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries full disclosure burden. Explains visibility scope (client_id isolation) and default ordering ('recent transactions'), but omits rate limits, error behaviors, and side effects. Adequate but not comprehensive behavioral disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two efficient sentences with zero waste. Front-loaded with the core action, follows with scope constraints, then usage pattern. Every clause earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With 100% schema coverage and no output schema, description adequately covers the listing behavior, pagination implications, and scoping rules. Missing explicit return value description (since no output schema exists), but 'List card transactions' implies the return type sufficiently for invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so parameters are fully self-documenting. Description adds confirmation of optionality ('All filter parameters are optional') and connects the 'omit all' case to the default behavior, adding slight semantic value beyond the schema baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Opens with specific verb 'List' and resource 'card transactions', clearly distinguishing from sibling 'list_cards'. Adds scope qualification '(scoped to the server's client_id)' that clarifies ownership boundary.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides clear context on visibility constraints ('Transactions from other agents...are not visible') and filter usage ('All filter parameters are optional — omit all to list recent transactions'). Lacks explicit naming of when to use vs siblings like get_card_details, but the scoping guidance effectively constrains usage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

refill_cardA

Advanced: refill a stream card with full control over payment mode. Maps directly to POST /payment/cards/:card_id/refill. Refill mode follows the card's creation mode (cannot switch mid-life).

Mode A: client_request_id as idempotency key. Mode B: no 402 challenge — caller signs the EIP-3009 authorization independently. Step 1: call get_x402_payee_address to get payee_address for payment_requirements.payTo. Step 2: sign EIP-3009 transferWithAuthorization using your own wallet/signing library. Step 3: submit with x402_reference_id as idempotency key + payment_payload (signature + wallet address) + payment_requirements.

Only cards created by this agent (same client_id) can be refilled.

ParametersJSON Schema
NameRequiredDescriptionDefault
card_idYesStream card ID to refill, e.g. 'c_123'
amountYesRefill amount in USD, decimal string e.g. '30.0000'
client_request_idNoUUID idempotency key — REQUIRED for Mode A. Omitting on a Mode A card will cause the server to reject the request. Reuse the same UUID to retry safely without double-charging.
x402_reference_idNox402 reference ID. Card creation Stage 1: optional (server generates if omitted). Stage 2: use value from 402 response. Refill Mode B: required, serves as idempotency key.
x402_versionNox402 version (Mode B Stage 2, required)
payment_payloadNox402 payment payload (Mode B Stage 2, required)
payment_requirementsNox402 payment requirements (Mode B Stage 2, required)
payer_addressNoPayer wallet address (optional, final value from verify)

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries full burden. Discloses key behaviors: idempotency via UUID reuse 'to retry safely without double-charging', rejection condition 'Omitting on a Mode A card will cause the server to reject', and state constraint that modes cannot be switched mid-life. Minor gap: does not describe success response format or explicit side effects (e.g., balance update timing).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Excellent structure with zero waste. Front-loaded with 'Advanced: refill...' statement. Clear visual separation of Mode A vs Mode B using headers and numbered steps. Every sentence conveys critical workflow, constraint, or API mapping information. Appropriate length for complexity (8 parameters, 2 distinct modes).

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Very complete for complex tool with nested objects and multi-stage workflow. Covers prerequisites (get_x402_payee_address), authorization requirements (EIP-3009 signing), and ownership constraints (same client_id). Minor gap: no output schema exists and description does not specify return value structure or success indicators, though API endpoint mapping provides partial context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema has 100% coverage (baseline 3). Description adds significant orchestration context: maps parameters to modes (Mode A: client_request_id; Mode B: x402_* fields), provides 3-step workflow for Mode B explaining parameter relationships ('payment_payload (signature + wallet address)'), and clarifies that x402_reference_id serves as idempotency key in Mode B despite different parameter name.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description uses specific verb 'refill' with resource 'stream card' and explicitly maps to API endpoint 'POST /payment/cards/:card_id/refill'. The 'Advanced:' prefix and detailed mode differentiation (A vs B) clearly distinguish this from sibling tool 'clawallex_refill'. The constraint 'Only cards created by this agent' further clarifies scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit when-to-use guidance: 'Refill mode follows the card's creation mode (cannot switch mid-life)'. Details Mode A (client_request_id) vs Mode B (EIP-3009 signing) workflows. References sibling tool 'get_x402_payee_address' as prerequisite for Mode B. Explains idempotency retry behavior for safe usage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

update_cardA

Update card risk controls: per-transaction limit and MCC whitelist/blacklist. At least one field must be provided. Changes take effect after issuer confirms.

ParametersJSON Schema
NameRequiredDescriptionDefault
card_idYesCard ID to update
client_request_idYesUUID idempotency key
tx_limitNoPer-transaction limit in USD (e.g. '200.0000')
allowed_mccNoMCC whitelist, comma-separated (e.g. '5734,5815')
blocked_mccNoMCC blacklist, comma-separated (e.g. '7995')

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It successfully discloses the delayed effect ('Changes take effect after issuer confirms'), but omits other key behaviors such as idempotency semantics (despite the client_request_id parameter), partial vs. full update semantics, or error handling when issuer confirmation fails.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is optimally concise with two efficient sentences. The first establishes purpose and scope; the second provides operational constraints and behavioral expectations. Every clause conveys necessary information without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the lack of annotations and output schema, the description provides minimum viable coverage for a financial mutation tool. It identifies the async confirmation behavior but should explicitly confirm this performs partial updates (PATCH semantics) and describe the idempotency behavior implied by client_request_id.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

While the schema has 100% coverage (baseline 3), the description adds valuable cross-parameter semantics: the constraint 'At least one field must be provided' clarifies that despite only card_id and client_request_id being marked required, the caller must provide at least one of tx_limit, allowed_mcc, or blocked_mcc.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the specific action ('Update') and domain ('card risk controls'), distinguishing it from siblings like refill_card (balance) or create_card_order (issuance). It explicitly identifies the configurable resources: 'per-transaction limit and MCC whitelist/blacklist.'

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides the critical operational constraint 'At least one field must be provided,' preventing empty update calls. However, it lacks explicit guidance on when to use this tool versus alternatives (e.g., when to whitelist vs. blacklist) or prerequisites like required permissions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

whoamiA

Query the current API Key binding status — read-only, does NOT modify any state. Returns: • client_id_bound=true → this API Key is already bound to a specific client_id. • client_id_bound=false → this API Key is not yet bound; call bootstrap to bind. Example response (bound): { "user_id": "u_123", "api_key_id": "ak_123", "status": 100, "bound_client_id": "ca_abc123", "client_id_bound": true } Example response (unbound): { "user_id": "u_123", "api_key_id": "ak_123", "status": 100, "bound_client_id": "", "client_id_bound": false }

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It explicitly declares the read-only nature, then provides exhaustive documentation of return values including field semantics (what the boolean means) and complete JSON examples for both possible response states (bound vs unbound).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core purpose and read-only guarantee. While the JSON examples are lengthy, they are necessary compensation for the missing output schema and structured formatting prevents clutter. Only minor verbosity in the example spacing prevents a 5.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given zero parameters and no output schema, the description achieves completeness by documenting the exact response structure and providing concrete examples of both possible return states. It fully prepares the agent to interpret results without needing additional schema information.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has zero parameters, which per the evaluation rules establishes a baseline score of 4. No parameter documentation is required or present.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Query') with a clear resource ('API Key binding status'). It explicitly distinguishes itself from the sibling 'bootstrap' tool by stating when to use that alternative ('call bootstrap to bind'), clearly defining its scope as read-only status checking.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit conditional guidance: if 'client_id_bound=false' then 'call bootstrap to bind'. It clearly states the tool is read-only and 'does NOT modify any state', helping the agent distinguish this query tool from mutation alternatives in the sibling list.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 18 tool updatesv1.0.7
    • First observedbatch_card_balances
    • First observedbootstrap
    • First observedclawallex_pay
    • First observedclawallex_refill
    • First observedclawallex_setup
    • First observedclawallex_subscribe
    • First observedcreate_card_order
    • First observeddecrypt_card_data
    • First observedget_card_balance
    • First observedget_card_details
    • First observedget_wallet
    • First observedget_wallet_recharge_addresses
    • First observedget_x402_payee_address
    • First observedlist_cards
    • First observedlist_transactions
    • First observedrefill_card
    • First observedupdate_card
    • First observedwhoami

TDQS

A3.8/5.0
Disambiguation3/5

Several tools have overlapping purposes, such as clawallex_pay/create_card_order (both create cards) and clawallex_refill/refill_card (both refill cards). However, the descriptions clearly distinguish them as 'simple' vs 'advanced' workflows, which helps agents select appropriately.

Naming Consistency3/5

Most tools use snake_case with verb_noun patterns (e.g., get_card_balance, create_card_order), but four tools use a clawallex_ prefix (clawallex_pay, clawallex_refill, etc.) while their advanced counterparts do not (create_card_order, refill_card). Additionally, bootstrap and whoami break the verb_noun convention.

Tool Count4/5

With 18 tools, the set is slightly heavy but reasonable for the complex domain covering wallet management, flash/stream card lifecycles, x402 on-chain payments, and risk controls. The count reflects necessary separation between Mode A (wallet) and Mode B (self-custody) flows, though the convenience/advanced tool pairs add some bloat.

Completeness4/5

The surface covers the full card lifecycle: creation (flash and stream), retrieval, balance checks, refilling, transaction history, and risk control updates. Minor gaps exist: there is no tool to cancel/close a card or delete/archive it, forcing agents to rely on expiration or MCC blocking to stop usage.

Maintenance

ActivityInactive
ResponsivenessNo issues

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • A
    license
    B
    quality
    D
    maintenance
    Payment & Transaction Tools that allow AI agents to send, receive, and request payments
    11
    32
    2
    Apache 2.0
  • -
    license
    Not graded
    quality
    D
    maintenance
    Enables AI agents to manage and use prepaid virtual Visa cards with hard budget limits for secure online transactions. It provides tools for creating cards, checking balances, and retrieving payment credentials with human-in-the-loop approvals.
    1
    -

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/clawallex/clawallex-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server