Accept a standing offer on an ENS name you own. Returns unsigned Seaport fulfillOrder() calldata.

When you submit this transaction, Seaport atomically:

• Pulls the offered WETH from the buyer's wallet

• Transfers the ENS name from your wallet to the buyer

• Pays the 1% marketplace fee from the WETH

You receive the offer amount minus the 1% fee. The buyer needs a live WETH balance + approval for Seaport/OpenSea conduit — if either is missing the tx will revert; you'll have signed but the chain won't execute.

Before accepting: you must have approved Seaport (or the OpenSea conduit, for cross-posted offers) on NameWrapper (wrapped name) or BaseRegistrar (unwrapped). Use approve_operator if needed. Use get_name_details to see the offer hash and confirm the highest offer.

Approve or revoke an operator for ENS contract interactions.

An approved operator can transfer ANY token owned by the approver on the specified contract. This is setApprovalForAll — it covers all tokens, not just one.

Contracts:

• base_registrar — ERC-721 tokens (unwrapped .eth names)

• name_wrapper — ERC-1155 tokens (wrapped names and subnames)

• ens_registry — ENS node ownership

Common use cases:

• Approve NameWrapper on BaseRegistrar before wrapping a name

• Approve a marketplace contract for trading

• Approve a management contract for batch operations

• Revoke a previously approved operator

Contract addresses:

• BaseRegistrar: 0x57f1887a8BF19b14fC0dF6Fd9B2acc9Af147eA85

• NameWrapper: 0xD4416b13d2b3a9aBae7AcD5D6C2BbDBE25686401

• ENS Registry: 0x00000000000C2E074eC69A0dFb2997BA6C7d2e1e

WARNING: Only approve addresses you trust. An approved operator can move ALL your names on that contract.

Bulk-list up to 10 ENS names for sale on NameWhisper in one signing flow.

Returns an array of unsigned Seaport OrderComponents payloads. The caller's wallet signs them all in one EIP-712 bulk signature (SIP-6), then POSTs each signature back to https://namewhisper.ai/api/orderbook/submit to store.

NW-native only — listings stay on NameWhisper. Cheaper UX than calling create_listing in a loop (one wallet popup vs N).

Per-name errors (invalid label, zero price) are collected in the 'errors' field instead of aborting the whole batch — partial success is normal.

Requires operator approval on the ENS token contract (NameWrapper or BaseRegistrar) — do this once per wallet via approve_operator.

Buy up to 20 NameWhisper-listed ENS names in a single Seaport transaction.

For each name, picks the cheapest active NW listing, validates it on-chain via Seaport.getOrderStatus, then encodes one fulfillAvailableAdvancedOrders call. NFTs go directly to your wallet.

Partial failures are safe: if an order went stale between discovery and execution, Seaport skips it and refunds excess ETH. The response lists which labels succeeded and which were dropped.

Cheaper per name than individual buys (gas is amortized). For a single name, use purchase_name.

NW-only: this tool ignores listings posted exclusively to Grails / OpenSea. If a name isn't listed on NameWhisper, you'll see it in the 'failed' array.

Register multiple ENS names in bulk — batched into just 2 transactions (commit + register) via Multicall3.

Much cheaper and faster than registering names one at a time. Supports up to 20 names per batch.

Flow: batchCommit (1 tx) → wait 60 seconds → batchRegister (1 tx with total ETH). Excess ETH is refunded.

Each name gets its own secret for front-running protection. All names must be available for registration.

After registration, use bulk_set_records to configure all names at once with addresses, text records, and content hashes.

Set ENS resolver records for multiple names in a single transaction — bulk record editing.

All record updates across all names are batched into one resolver.multicall() call. Much cheaper than setting records one name at a time.

Supports the same record types as set_ens_records: address records (ETH, BTC, SOL, etc.), text records (avatar, description, social handles, AI agent metadata), content hash (IPFS/IPNS), and ENSIP-25 agent-registration records.

You can set different records for each name (e.g., unique avatars) or the same records across all names (e.g., same ETH address).

Max 50 names per batch. The wallet signing the transaction must be the owner/manager of all included names.

Transfer multiple ENS names in a single transaction via Multicall3 — bulk send.

Much cheaper and faster than transferring names one at a time. Supports up to 20 names per batch.

Automatically detects whether each name is wrapped (NameWrapper/ERC-1155) or unwrapped (BaseRegistrar/ERC-721) and builds the correct transfer call for each.

All names can go to the same recipient or to different recipients — specify a toAddress per name.

Requirements:

• The fromAddress must currently own ALL names in the batch

• All addresses must be valid Ethereum addresses

• Names must be registered (not expired)

WARNING: This transfers FULL ownership of every name. Recipients gain complete control.

Resolver records (avatar, addresses, etc.) are NOT affected by transfer — they stay on each name.

After transfer, consider using bulk_set_records to update ETH address records on the transferred names.

Cancel an active ENS name listing by submitting Seaport's cancel() on-chain.

Returns the unsigned Seaport cancel() transaction calldata. Your wallet signs and submits; once mined, Seaport marks the order invalid and no marketplace (NW, Grails, OpenSea) can fulfill it anymore.

Only the original seller (the order's offerer) can cancel. If you cross-posted to OpenSea, you signed a second 'opensea' variant of the listing — pass BOTH order hashes as alsoCancel so a single tx kills both variants atomically.

For cancelling offers you've made as a buyer, use cancel_offer instead.

Cancel an active offer you made on an ENS name. Returns unsigned Seaport cancel() calldata.

Only the bidder (the order's offerer) can cancel. If the offer was cross-posted to OpenSea, you signed a second 'opensea' variant — pass BOTH order hashes as alsoCancel so one tx kills both.

Cancelling releases the WETH you'd committed to the offer — the buyer's wallet keeps its WETH balance free to bid elsewhere once the Seaport order is invalidated.

For cancelling your own listings, use cancel_listing.

Check availability of one or more ENS names. Returns status (AVAILABLE, REGISTERED, EXPIRED, or INVALID), owner address, and expiry date for each name. Validates ENS character rules. Accepts names with or without .eth suffix.

List an ENS name for sale on NameWhisper's marketplace via Seaport 1.6.

Returns an unsigned Seaport OrderComponents payload (plus EIP-712 domain/types) that the caller's wallet signs. After signing, POST the { orderComponents, signature, label, orderType: 'listing' } payload to https://namewhisper.ai/api/orderbook/submit (authenticated) to store the order.

Fee structure: 1% marketplace fee baked into the order as a Seaport consideration item (seller-paid, not added on top).

NW-native only — MCP listings stay on NameWhisper. If you want your listing on OpenSea too, list it separately through their interface.

Requires the wallet to have approved NameWrapper (for wrapped names) or BaseRegistrar (for unwrapped) as an operator first. Use approve_operator if needed.

Tip: Use get_valuation first to price competitively. Use get_name_details to confirm the name is unwrapped vs wrapped before listing.

Enumerate ENS-friendly labels for a finite real-world entity category (e.g. "NBA hall of fame players", "Pixar feature films", "F1 world champions") and report which are available vs registered.

USE THIS for queries like "find me NBA hall of famers", "available Pixar films", or "Beatles songs I can register". The labels are generated and spell-verified server-side — do NOT enumerate entity names yourself and pass them to check_availability, because models routinely misspell long-tail names (scottiepippin vs scottiepippen) or invent entities that don't exist.

DO NOT use for vibes/themes ("luxury watch names") or ENS-native categories ("10k club", "3-letter words") — use search_ens_names for those. For a single name, use check_availability.

Returns entries grouped by status; each carries the proper name (e.g. "Scottie Pippen") alongside the ENS label (scottiepippen.eth) so you can show the human-readable name in your reply.

Extend the expiry of an ENS subname in the NameWrapper.

Subnames have their own expiry that cannot exceed the parent name's expiry. This tool extends a subname's expiry.

Who can call this:

• The parent name owner (always)

• The subname owner (only if CAN_EXTEND_EXPIRY fuse is burned on the subname)

Use cases:

• Extending subnames you've issued to users

• Self-extending your own subname (if CAN_EXTEND_EXPIRY is set)

• Keeping organizational subnames active

Scan the ENS marketplace for alpha — names listed below their comparable-sales valuation. Returns ranked opportunities with discount percentage, estimated value range, confidence rating, and comparable data. The autonomous agent's edge: find mispriced names before anyone else. Pair with get_valuation for deep analysis, then purchase_name to execute.

Use this instead of search_ens_names + repeated get_valuation when the user asks for "best value", "best buy", "cheapest good name", "undervalued", "bargains", or any ranked-by-value query across multiple listings. find_alpha does the search + valuation + ranking in a single call. Supports filters (minLength, maxLength, maxPriceEth, tags) so narrow queries like "4-letter names under 1 ETH, best value" are one call, not six.

Check if an ENS name or wallet is a registered AI agent. Returns ENSIP-25 agent-registration verification (text record bindings between ENS names and on-chain agent registries), AI metadata from text records, and ERC-8004 reputation data when available.

ENSIP-25 verification is live: reads agent-registration text records from the name's resolver to confirm the ENS name ↔ registry binding.

ERC-8004 reputation queries (scores, reviews, validations) use the live mainnet contracts deployed January 29, 2026.

Returns the authenticated identity of the calling agent. If you connected with ERC-8128 signed requests, this resolves your wallet address to your ENS name, agent metadata, and portfolio summary. Call this first to confirm your identity is recognized.

Requires ERC-8128 authentication (signed HTTP requests). See GET /mcp/auth for setup details.

List ENS names by lifecycle window — THE tool for "which names are in premium / on Dutch auction", "names in grace period", "what's expiring soon / about to drop". Statuses:

• premium: 90-111 days past expiry, registerable NOW at a decaying premium. Each result includes premiumUsd (decay-curve estimate) and, when the on-chain read landed, premiumEth + firstYearEth (live rentPrice).

• grace: 0-90 days past expiry. NOT registerable — only renewable.

• active: registered, expiring within days (they will drop into grace, then premium). Grace/premium results are validated against on-chain state, so renewed or already-released names are filtered out — statuses here are reliable, unlike the coarse EXPIRED flag in search results. Supports length/charType/category/dictionary filters. Use search_ens_names for pattern/price/theme queries instead.

Get recent ENS marketplace activity — sales, new listings, offers, mints, transfers, renewals, and burns. Filter by event type. Returns event details including name, price (in ETH), buyer/seller addresses, and timestamp. Sorted by most recent first.

Get full details for a specific ENS name including owner, expiry, creation date, tags, active listings (with prices in ETH and USD), active offers, ENSIP-25 agent identity bindings, and ENSIP-26 agent context records. creationDate is always populated — for Vickrey-era names (isVickreyEra=true) it reflects the true first-creation date from the 2017-2019 legacy auction contract; for all other names it reflects the on-chain registration date. Always mention creationDate when answering questions about when a name was created or registered.

Check what primary ENS name is set for a wallet address (reverse resolution).

Returns the ENS name that this address resolves to, or null if no primary name is set.

This verifies both directions:

• Reverse: address → name (the reverse record)

• Forward: name → address (confirms the name actually points back to this wallet)

If either direction is missing, the primary name won't resolve. Use this to:

• Verify a primary name was set correctly after set_primary_name

• Check if a wallet has any primary name configured

• Debug why a primary name isn't showing up (missing ETH address record)

Find ENS names semantically similar to a given name using vector embeddings across 3.5M+ names. Returns similar names with similarity scores and live marketplace data (price, owner, expiry). Great for discovering related names for portfolio building or brand exploration.

Get usage statistics for this MCP server session. Returns tool call counts, success rates, and average latency.

Get a confidence-rated valuation for an ENS name based on comparable sales, entity recognition (Wikipedia/Wikidata), search interest, word frequency, and fame-scaled pricing. Returns estimated value range, background context on the name (person/place/brand/concept), comparable sales data, and a narrative explaining the valuation methodology. Essential for pricing decisions.

Get all ENS names owned by a wallet address. Returns each name with label, tags, expiry, registration date, and active listing/offer prices. Useful for portfolio analysis and wallet profiling.

Place an offer (bid) on a registered ENS name on NameWhisper via Seaport 1.6.

Returns an unsigned Seaport OrderComponents payload (plus EIP-712 domain/types) that the caller's wallet signs. The buyer offers WETH and receives the name on acceptance. After signing, the offer is stored in NameWhisper's orderbook so the owner sees it and can accept, counter, or decline.

Offers settle in WETH: the maker needs wrapped ETH and an approval for Seaport to spend it (the NameWhisper UI handles this approval at signing time). Fee structure: 1% marketplace fee baked into the order as a Seaport consideration item.

NW-native only — offers are not cross-posted to other marketplaces.

Tip: Use get_valuation first to understand fair market value before making an offer.

One-shot management report for an ENS name. This is the ONLY tool you need to answer "management report", "full overview", "health check", "status check", "what should I do about X", or "tell me what to do with X" queries. Prefer this over calling get_name_details + get_valuation separately — this tool is purpose-built for status/recommendation queries and returns the full picture in one call.

Returns:

• Registration status (active, expiring soon, grace period, premium auction, expired, available)

• Exact expiry date and days remaining

• Whether the name is wrapped (NameWrapper) or unwrapped (BaseRegistrar)

• Current owner address

• On-chain renewal pricing

• Ranked recommended actions based on current status (renew now, migrate to wrapper, etc.)

Distinct from get_name_details (which returns owner/listings/offers without a recommendation engine). Use this for "what should I do" queries; use get_name_details only if you need marketplace data (active listings, offers) which this tool does not include.

Manage fuses on a wrapped ENS name. Fuses are permission bits that can be permanently burned to restrict what can be done with a name.

Three modes:

1. read — Check which fuses are currently burned on a name

2. burn_owner_fuses — Burn fuses on a name you own (CANNOT_UNWRAP must be burned first)

3. burn_child_fuses — As a parent, burn fuses on a subname (e.g. burn PARENT_CANNOT_CONTROL on sub.parent.eth)

Owner-controlled fuses:

• CANNOT_UNWRAP — prevents unwrapping (MUST be burned first before any other fuse)

• CANNOT_BURN_FUSES — prevents burning additional fuses

• CANNOT_TRANSFER — prevents transfers

• CANNOT_SET_RESOLVER — prevents resolver changes

• CANNOT_SET_TTL — prevents TTL changes

• CANNOT_CREATE_SUBDOMAIN — prevents creating new subnames

• CANNOT_APPROVE — prevents approving operators

Parent-controlled fuses (for subnames):

• PARENT_CANNOT_CONTROL — parent permanently gives up control over the subname

• CAN_EXTEND_EXPIRY — allows the subname owner to extend their own expiry

WARNING: All fuse burning is IRREVERSIBLE. Fuses expire when the name expires.

Bulk create subnames under a parent ENS name. Designed for agent fleet deployment — create identities like agent001.company.eth, agent002.company.eth, etc. Each subname can have its own owner and records (addresses, text records). Uses the ENS NameWrapper for subname creation.

Returns complete transaction recipes (contract address, encoded calldata, gas estimates) for each subname. Your wallet signs and broadcasts the transactions. Subnames are free to create — only gas costs apply.

Provision a complete ENS identity for an AI agent in one call. Describe your agent's purpose and budget — get back recommended available names, a multi-step registration recipe (commit → register → set agent records), and ready-to-sign transaction data.

The registration recipe includes agent identity records (ENSIP-25: ai.agent, ai.purpose, ai.capabilities + ENSIP-26: agent-context) as a mandatory final step — these records make the agent discoverable in the ENS Agents directory. ENSIP-25 agent-registration binding is included when an agentRegistry is provided.

IMPORTANT: The calling AI MUST execute all steps in the recipe, including the final set_ens_records step. Agent identity is not complete until the text records are on-chain.

Example: "DeFi trading bot, 0.05 ETH budget" → names like swiftswap.eth with full registration + identity setup instructions.

Purchase an ENS name — either buy a listed name from a marketplace or register an available name directly on-chain.

For AVAILABLE names: Returns a complete registration recipe with contract address, ABI, step-by-step instructions, and a pre-generated secret. Your wallet signs and submits the transactions (commit → wait 60s → register).

For LISTED names: Searches all marketplaces (OpenSea, Grails) for the best price. If there are MULTIPLE active listings, returns CHOOSE_LISTING status with all options — present these to the user and ask which one they want. When the user chooses, call this tool again with the chosen orderHash to get the buy transaction.

The tool auto-detects whether the name is available or listed. You can override with the 'action' parameter.

Reclaim ENS Registry ownership of a .eth name.

This syncs the ENS Registry owner to match the BaseRegistrar token owner. Used when:

• A name was transferred via direct safeTransferFrom (bypassed ENS routing)

• ENS Registry ownership is out of sync with token ownership

• Recovery after a contract migration or edge case

The caller must own the BaseRegistrar ERC-721 token for the name. After reclaiming, you may also need to set the resolver if it was cleared.

Register an ENS name as an ERC-8004 agent identity on Ethereum mainnet. Returns a ready-to-sign transaction.

Default route ("adapter") binds the agent to the name itself (ERC-8217 via Adapter8004): whoever holds the name controls the agent, OpenSea shows the agent identity on the name's page, and the agent transfers with the name when sold. Alternative "direct" route mints the agent NFT to your wallet instead, independent of the name.

The agentURI defaults to a NameWhisper-hosted registration file generated live from the name's ENS records (agent-context, agent-endpoint) — set those records with set_ens_records and the file updates automatically.

IMPORTANT: after the transaction confirms, read the new agentId from the receipt (topic 1 of the Registered/AgentBound event) and call set_ens_records with the agentRegistration shorthand to write the ENSIP-25 binding. The identity is not verifiable until that record is on-chain. Verify with get_agent_reputation. If the name already has a bound agent, the tool returns ALREADY_REGISTERED with the existing agentId instead of building a duplicate.

Renew an ENS name or batch of names. Returns the transaction data needed to extend registration.

Unlike registration, renewal is simple — just one transaction with payment. No commit/reveal needed.

Accepts ANY duration — days, weeks, months, years. There is no minimum renewal period on ENS. Examples: 7 days (1 week), 28 days (1 month), 365 days (1 year).

Anyone can renew any name (you don't need to be the owner). This is useful for:

• Extending your own names before expiry

• Gifting renewal to a friend's name

• Protecting valuable names from expiring

Returns exact on-chain pricing from the ETHRegistrarController with a 5% buffer (excess is refunded).

For batch renewals (multiple names), all names are bundled into a SINGLE Multicall3 transaction.

Search the AI agent directory — find registered agents by name, capability, protocol support, or reputation. Powered by the live ERC-8004 registry via 8004scan (110,000+ agents indexed across 50+ chains).

Returns agent identity, owner wallet/ENS, reputation scores, supported protocols (MCP/A2A/OASF), verification status, and links to 8004scan profiles.

Examples:

• "trading agents on Base" → search for trading agents filtered to Base chain

• "MCP agents" → find agents that support the Model Context Protocol

• "high reputation agents" → set minReputation to find top-scored agents

Search ENS names using natural language. Supports all query types:

• Filtered search: "4-letter words under 0.1 ETH"

• Concept search: "ocean themed names" (semantic similarity across 3.5M names)

• Creative search: "names for a coffee brand" (AI-generated suggestions)

• Collection search: "crypto terms expiring soon"

• Activity: "what sold recently?"

• Availability check: "is coffee.eth taken?"

• Bulk check: "check apple.eth, banana.eth, cherry.eth" Returns structured results with name, price, owner, tags, and availability info.

Search the ENS knowledge base — governance proposals, protocol documentation, developer insights, blog posts, forum discussions, and Farcaster casts from key ENS figures (Vitalik, Nick Johnson, etc.). Covers ENS governance and DAO proposals, protocol details (ENSv2, resolvers, subnames), community sentiment, historical decisions, and what specific people have said about a topic. Powered by semantic search over curated ENS sources.

Do NOT use this for name valuations, market data, or availability checks — use the other tools for those.

Set ENS resolver records for a name you own. Returns encoded transaction calldata ready to sign and broadcast.

Supports address records (ETH, BTC, SOL, etc.), text records (avatar, description, url, social handles, AI agent metadata), content hash (IPFS/IPNS), ENSIP-25 agent-registration records, and ENSIP-26 agent context and endpoint discovery.

Multiple records are batched into a single multicall transaction to save gas.

Common text record keys: avatar, description, url, email, com.twitter, com.github, com.discord, ai.agent, ai.purpose, ai.capabilities, ai.category.

ENSIP-25 support: Pass agentRegistration with registryAddress and agentId to automatically set the standardized agent-registration text record. This creates a verifiable on-chain binding between your ENS name and your agent identity in an ERC-8004 registry.

ENSIP-26 support: Pass agentContext to set the agent-context text record (free-form agent description). Pass agentEndpoints with protocol URLs (mcp, a2a, oasf, web) to set agent-endpoint[protocol] discovery records.

The returned transaction can be signed and submitted directly using any wallet framework (Coinbase AgentKit, ethers.js, etc.).

Set the primary ENS name (reverse resolution) for a wallet address.

This controls what name is displayed when someone looks up your Ethereum address. For example, instead of seeing "0x1234...abcd", they'd see "myname.eth".

Requirements:

• You must own or control the ENS name

• The name's ETH address record must point to your wallet

• Only the wallet owner can set their own primary name

If the ETH address record doesn't match, use set_ens_records first to update it.

Only one primary name per address — setting a new one replaces the previous.

Change the resolver contract for an ENS name.

The resolver is where a name's records live (ETH address, text records, content hash, etc.). Changing the resolver points the name at a different contract.

Common use cases:

• Migrating to the latest ENS Public Resolver

• Pointing to a custom resolver (e.g. for off-chain/CCIP-read resolution)

• Fixing a name that has no resolver set

Pass "public" as the resolver address to use the ENS Public Resolver (0x231b0Ee14048e9dCcD1d247744d114a4EB5E8E63).

WARNING: Records on the old resolver won't be visible after switching. Set up records on the new resolver first, or use the ENS Public Resolver which most names already use.

Floor-sweep: buy the CHEAPEST N listed ENS names in a category/collection (or matching a filter) in ONE Seaport transaction.

Use this when the user wants "the cheapest N", "sweep the floor", or "buy up to X ETH of" a cohort — rather than naming specific names (that's batch_purchase).

Pick the cohort with 'category' (a collection slug like "999-club") and/or 'q'/'charType'/'minLength'/'maxLength'. Bound the sweep with 'count' (how many) and/or 'maxBudgetEth' (total spend), plus an optional 'maxPriceEth' per-name cap. It selects cheapest-first across NameWhisper, OpenSea, and Grails, then packs them into one transaction (capped at 20 names — run again to continue). NFTs are delivered directly to the buyer; Seaport skips any order that sold since discovery and refunds the excess. The response reports what was swept (with marketplace + price), the total, and how many matched but fell outside the bound.

Transfer ownership of an ENS name to another wallet address.

Automatically detects whether the name is wrapped (NameWrapper/ERC-1155) or unwrapped (BaseRegistrar/ERC-721) and builds the correct transaction.

Requirements:

• The fromAddress must currently own the name

• Both addresses must be valid Ethereum addresses

• The name must be registered (not expired)

WARNING: This transfers FULL ownership. The recipient gains complete control including the ability to transfer, set records, or let the name expire.

Resolver records (avatar, addresses, etc.) are NOT affected by transfer — they stay on the name.

Unwrap a .eth name from the ENS NameWrapper back to BaseRegistrar.

This converts the name from an ERC-1155 token back to an ERC-721 token. All fuses are cleared upon unwrapping.

Will fail if the CANNOT_UNWRAP fuse has been burned — that restriction is permanent.

Use cases:

• Reverting a wrapped name to standard ERC-721 for compatibility

• Regaining full control after wrapping without burning CANNOT_UNWRAP

• Moving a name to a platform that only supports ERC-721

Check if an ENS sale is a wash trade. Provide either a tx_hash to look up a pre-computed score, or provide label + buyer + seller + price_eth for live on-demand analysis. Returns a wash confidence score (0-1), a label (clean/suspicious/likely_wash), detected signals, and a human-readable summary.

Wrap an unwrapped .eth name into the ENS NameWrapper contract.

Wrapping converts the name from an ERC-721 token (BaseRegistrar) to an ERC-1155 token (NameWrapper). This enables:

• Fuse permissions (restrict what can be done with the name)

• Protected subnames (subnames with guaranteed permissions)

• ERC-1155 compatibility for marketplaces and protocols

Returns a two-step transaction recipe: approve + wrap.

Available fuses (all IRREVERSIBLE once burned):

• CANNOT_UNWRAP — prevents unwrapping back to BaseRegistrar

• CANNOT_BURN_FUSES — prevents burning additional fuses

• CANNOT_TRANSFER — prevents transfers

• CANNOT_SET_RESOLVER — prevents resolver changes

• CANNOT_SET_TTL — prevents TTL changes

• CANNOT_CREATE_SUBDOMAIN — prevents new subnames

• CANNOT_APPROVE — prevents approving operators

CANNOT_UNWRAP must be burned before any other fuses can be burned.