Skip to main content
Glama
kaditang

402sentinel-mcp

by kaditang

402sentinel-mcp

MCP tools that let your AI agent check an x402 counterparty's risk before it pays — and turn that risk into an enforceable wallet spending policy. Give it a payTo address, get back a 0–100 risk score + an allow / review / block decision, scored from on-chain settlement behaviour on Base (address age, facilitator-aware payer diversity, settlement maturity) + a delivery-outcome flywheel, with honest confidence/coverage.

Tools — vet the seller:

  • assess_counterparty ($0.002) — risk score + decision + a ready-to-apply recommended_policy

  • assess_counterparty_deep ($0.02) — same, scans more on-chain history

  • recommend_policy ($0.002) — decision + wallet-ready spending policy (caps, denylist, approval)

  • report_outcome (free) — after paying, report delivery to train the reliability flywheel

Tools — vet the payment itself (buyer-side):

  • firewall ($0.002) — should YOUR agent make THIS payment now? Catches fraudulent routing (payTo swapped vs the address you usually pay), drain velocity, overcharge, and injection-sourced instructions. agent_id + a wallet-ownership signature are attached automatically from your configured wallet — trusted routing history with no extra steps.

  • firewall_record (free) — seed your agent's payment history so the firewall has a behavioural baseline.

  • firewall_outcome (free) — after a verdict, report what actually happened (fraud / legit / …) so the firewall learns which signals are predictive and downweights noisy ones (safety signals stay deterministic).

Tools — vet the asset and the flow:

  • assess_rwa ($0.02) — RWA risk gate: score a tokenized asset (treasury/stock/credit) before buying it. Proxy-aware transfer-restriction scan + behavioral transfer simulation — catches permissioned securities an agent can buy but not transfer or redeem (trapped funds), live pause state, issuer identity + issuer sanctions.

  • compliance_check ($0.02) — pre-pay compliance screen: OFAC sanctions (hard block), counterparty due-diligence tier, structuring/smurfing detection, FATF Travel-Rule threshold (informational). Not legal advice.

  • verify_service ($0.02) — opt-in 402Sentinel Verified badge: submit your own payTo for a deep settlement-graph audit; pass → signed time-boxed credential + public allow-list. Failures stay private.

It's a thin client for the hosted service at https://402sentinel.com — the scoring model and facilitator-identification logic live server-side (closed); this package only forwards the request and pays for it, so it's open source.

Quickstart — gate a payment in 5 lines

Before your agent pays any x402 counterparty, ask the firewall; if it doesn't say allow, don't pay. No MCP needed — any standard x402 v2 client works:

import { x402Client, x402HTTPClient } from "@x402/core/client";
import { registerExactEvmScheme } from "@x402/evm/exact/client";
import { privateKeyToAccount } from "viem/accounts";

const client = new x402Client();
registerExactEvmScheme(client, { signer: privateKeyToAccount(process.env.AGENT_KEY) });
const http = new x402HTTPClient(client);

const body = JSON.stringify({
  payment: { payto_address: target, amount, resource_url },
  context: { source: "web_content", untrusted_text: pageYouActedOn },   // pass what you scraped
});
const url = "https://402sentinel.com/api/firewall";
const init = (h = {}) => ({ method: "POST", headers: { "Content-Type": "application/json", ...h }, body });
const r1 = await fetch(url, init());
const pr = http.getPaymentRequiredResponse((n) => r1.headers.get(n), await r1.json());
const payment = http.encodePaymentSignatureHeader(await http.createPaymentPayload(pr));
const data = await (await fetch(url, init(payment))).json();

if (data.decision !== "allow") throw new Error(`402Sentinel ${data.decision}: ${data.recommended_action}`);
// …safe to pay `target`.

That one $0.002 call catches fraudulent routing (payTo swapped vs the address you usually pay), prompt-injection payments (a payTo that appeared in untrusted_text), drains, overcharges, and sanctioned/illicit counterparties.

In an MCP framework (Claude, Cursor, …) instead, just add the server — your agent gets all 10 tools by name (see Configure below):

{ "mcpServers": { "402sentinel": { "command": "402sentinel-mcp", "env": { "CLIENT_PRIVATE_KEY": "0x…" } } } }

Related MCP server: Satoshkin AML/KYT MCP Server

Install

npm i -g @kaditang/402sentinel-mcp

Configure

Add to your MCP client (Claude Desktop, Cursor, etc.):

{
  "mcpServers": {
    "402sentinel": {
      "command": "402sentinel-mcp",
      "env": {
        "CLIENT_PRIVATE_KEY": "0x...  // a Base wallet holding USDC on-chain (no ETH/gas needed)"
      }
    }
  }
}

Paid calls cost from $0.002 (shallow) to $0.02 (deep), paid automatically in USDC via standard x402 (exact EIP-3009 on Base — the facilitator submits the transfer, so the buyer needs no gas) from the configured wallet. The free tools need no key.

Use

The agent calls it before authorizing a payment:

assess_counterparty({
  target: { payto_address: "0x..." },
  payment_context: { amount: 10, asset: "USDC" },
  policy: { block_at_score: 70, review_at_score: 40 }
})
→ { decision: "review", risk_score: 52, confidence: 0.41, coverage: {...},
    dimensions: [...], recommendation: "...",
    recommended_policy: { action: "limit", max_payment_usdc: 5, daily_cap_usdc: 15,
                          add_to_denylist: false, require_human_approval: true } }
  • block / deny → don't pay

  • review / limit → cap exposure / escrow (use recommended_policy for the caps)

  • allow → proceed

recommend_policy(...) returns just the decision + recommended_policy — apply max_payment_usdc / daily_cap_usdc / add_to_denylist directly to your agent wallet's spending limits. After paying, call report_outcome({ assessment_id, outcome }) to improve future scores.

Disclaimer

Algorithmic risk signal, informational only — not advice, not an endorsement, and not an accusation about any party. Scores are probabilistic estimates from limited public on-chain data and heuristics, and may misclassify. Do your own due diligence; don't rely on it as your sole basis to pay or refuse. See https://402sentinel.com/terms.

MIT.

Available Tools

10 tools
assess_counterpartyA

Assess the risk of an x402 counterparty (a payTo address) BEFORE paying. Returns a 0-100 risk_score, an allow/review/block decision, honest confidence/coverage, and a ready-to-apply recommended_policy (per-counterparty caps + approval/denylist), scored from on-chain settlement behaviour on Base + a delivery-outcome flywheel. Call before authorizing any x402 payment above your risk threshold. Costs $0.002 (paid automatically in USDC).

ParametersJSON Schema
NameRequiredDescriptionDefault
policyNo
targetYes
payment_contextNo

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must carry the safety/side-effect burden itself. It discloses a meaningful side effect (USDC cost of $0.002, auto-paid) and the data inputs (on-chain settlement behavior on Base + delivery-outcome flywheel). However, it does not say whether the call is read-only, whether it persists anything, or what happens if the payment fails or balance is insufficient.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences; the core purpose and timing are front-loaded, and the output list and cost are delivered without filler. Every clause adds operational value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a paid risk-assessment call with no output schema, the description covers the required timing, return fields, cost, and scoring provenance. The main gap is not clarifying how the returned 'recommended_policy' relates to the sibling recommend_policy tool or whether it is auto-applied.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description never mentions any of the three input params (target, policy, payment_context) and schema coverage is reported as 0%, so it does not compensate. Some nested schema descriptions exist, but the tool text itself adds no parameter-level meaning.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific action ('Assess the risk'), a concrete resource ('x402 counterparty / payTo address'), and a clear temporal guardrail ('BEFORE paying'). It differentiates itself by naming the returned risk decision/policy and on-chain data source, helping an agent distinguish it from siblings like report_outcome or assess_rwa.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly prescribes the trigger: call before authorizing any x402 payment above your risk threshold. It does not name alternatives or exclusion cases, so it stops short of a full 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

assess_counterparty_deepA

Like assess_counterparty but scans more on-chain settlement history for a higher-confidence read. Use for larger or higher-stakes payments. Costs $0.02 (paid automatically in USDC).

ParametersJSON Schema
NameRequiredDescriptionDefault
policyNo
targetYes
payment_contextNo

TDQS

A3.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden and does disclose an important behavioral trait: it costs $0.02 and is 'paid automatically in USDC.' It also explains that it performs a deeper scan of on-chain settlement history. It does not describe the return format or other side effects, but the cost and payment behavior are meaningful disclosures.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three short sentences with no filler. The key differentiator and usage condition are front-loaded, and the cost note is efficiently placed at the end.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description handles tool selection well, but it is incomplete for actual invocation: there is no output schema, no return-value description, and no parameter semantics. Given the nested parameters and financial context, an agent would still be guessing about how to configure policy or interpret the assessment result.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description provides zero parameter-level guidance, and schema description coverage is 0%. The agent receives no help understanding how to structure target, policy, or payment_context beyond raw schema property names. This is a significant gap for a tool with three nested objects.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'Like assess_counterparty but scans more on-chain settlement history for a higher-confidence read,' which clearly identifies the verb, resource, and the key differentiator from its sibling. The purpose is specific and immediately distinguishable from assess_counterparty.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states 'Use for larger or higher-stakes payments,' giving a clear condition for choosing this tool. It names the alternative assess_counterparty by comparison, though it does not explicitly say when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

assess_rwaA

RWA risk gate — score a TOKENIZED ASSET (tokenized treasury/stock/credit) BEFORE buying it. Detects PERMISSIONED securities an agent can buy but NOT transfer/redeem (= trapped funds): proxy-aware transfer-restriction scan (resolves the EIP-1967 implementation; ERC-1404/ERC-3643/allowlist/freeze/pause), a behavioral transfer simulation (on-chain revert = the gate is live), live pause state, token identity (symbol/name/supply), and issuer/admin identity + issuer OFAC screening. Returns risk_score 0-100 + allow/review/block + is_permissioned_security + honest not_checked gaps (backing/peg/holder concentration are off-chain). NOT investment advice. Costs $0.02 (paid automatically in USDC).

ParametersJSON Schema
NameRequiredDescriptionDefault
targetYes

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and is unusually explicit: it discloses proxy-aware EIP-1967 resolution, behavioral transfer simulation, pause-state check, issuer OFAC screening, and intentionally omitted checks. It also discloses the $0.02 USDC cost and that it is not investment advice.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded purpose, then mechanism, outputs, caveats, and cost in a logical order; every clause adds information. It is dense but not padded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema and no annotations, the description compensates by listing key return values (risk_score 0-100, allow/review/block, is_permissioned_security), known blind spots, and the mandatory cost side-effect. It is sufficient for an agent to decide whether to call this tool and what to expect.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description adds useful semantics by indicating the target is a token contract and that proxy/EIP-1967 implementations are handled. However, it never names the target parameter, maps to payto_address, or explains network selection, and the context reports 0% schema description coverage, so the description does not fully carry the parameter-documentation burden.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific action — score an RWA token before buying it — and clearly targets TOKENIZED ASSET, distinguishing it from sibling tools like assess_counterparty and compliance_check. The mention of tokenized treasuries/stocks/credits and permissioned securities leaves no ambiguity about the domain.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly tells the agent when to invoke it: BEFORE buying an RWA token. It does not, however, name alternatives or state when not to use it, so it stops short of full routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

compliance_checkA

Pre-pay COMPLIANCE screen for regulated-money x402 flows. Returns compliance_decision (pass/flag/block), diligence_tier, obligations, and checks: OFAC sanctions (hit = hard block), counterparty due-diligence tier from the on-chain risk engine, structuring/smurfing detection (many sub-threshold payments to one counterparty aggregating to a reportable sum in 24h — pass target.agent_id, e.g. your wallet, to enable it), and the FATF Travel-Rule threshold reported as informational. Screening support for compliance workflows — not legal advice. Costs $0.02 (paid automatically in USDC).

ParametersJSON Schema
NameRequiredDescriptionDefault
targetYes
payment_contextNo

TDQS

A4.3/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. It discloses the $0.02 USDC cost, hard-block behavior on OFAC hits, the need to pass target.agent_id to enable structuring detection, and that the FATF Travel-Rule threshold is informational. These details materially inform whether and how to call the tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but well-structured: it front-loads the tool's purpose, then lists return fields, key checks, important behavioral conditions, and cost. Every sentence contributes useful information, though the length is near the upper bound of ideal.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no output schema and no annotations, the description covers the return object, key behavioral semantics, triggering conditions, and cost. It does not enumerate sibling alternatives or explain every diligence/obligation value, but it provides enough for an agent to select and invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Context signals report 0% top-level schema description coverage. The description compensates for target.agent_id by explaining it enables structuring detection, but it does not add meaning for payment_context beyond the nested schema descriptions for asset and amount. Compensation is only partial.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States an exact verb, resource, and output: 'Pre-pay COMPLIANCE screen... Returns compliance_decision (pass/flag/block), diligence_tier, obligations, and checks'. This clearly distinguishes it from sibling assessment tools by focusing on compliance screening for regulated-money x402 flows.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Clear usage context is provided: 'Pre-pay', 'regulated-money x402 flows', and 'Screening support for compliance workflows' indicate when to invoke. It does not explicitly route away from siblings like assess_counterparty or firewall, but the intended pre-pay compliance scenario is specific enough.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

firewallA

Buyer-side payment firewall: should YOUR agent make THIS payment now? Where assess_counterparty vets the seller, this vets the payment instruction in the context of your agent's own history + provenance. Returns allow/hold/block + signals: routing_anomaly (payTo swapped vs the address you usually pay = fraudulent routing), velocity_anomaly (drain), amount_anomaly (overcharge), provenance_flag, counterparty_risk, injection_destination (if the payTo appears in the untrusted page/tool-output you're acting on, the destination was injected — pass it as context.untrusted_text), intent_mismatch (pass context.intended={payto,max_amount} so a mid-flight redirect is caught), new_counterparty_burst, recurring_flagged (poisoned-memory loop). STRONGLY recommended: pass untrusted_text + intended to catch prompt-injection payments. agent_id and a wallet-ownership signature are attached AUTOMATICALLY from your configured wallet — you don't pass agent_id, and your routing history is trusted with no extra steps. Costs $0.002. Seed history free with firewall_record.

ParametersJSON Schema
NameRequiredDescriptionDefault
policyNo
contextNo
paymentYes
agent_idNostable id for your agent — use your payer wallet address

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden and meets it: it discloses automatic attachment of agent_id and wallet-ownership signature, trusted routing history, cost, and the meaning of eight output signals including when hard blocks are triggered. This is substantive operational disclosure, not schema repetition.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but dense and logically ordered: purpose, output signals, recommended context arguments, automatic auth, cost. Every sentence carries information, though the signal list could be slightly tightened without losing clarity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is complex — nested objects, many signals, no output schema, no annotations — and the description supplies the critical operational context: decision categories, signal semantics, recommended parameters, and automatic identity handling. It stops short of describing the exact response shape and the behavior of all policy sub-parameters, but the core calling requirements are adequately covered.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is low (25%), and the description compensates well for the most safety-critical context fields by explaining untrusted_text and intended with concrete injection/redirect examples. It also warns that agent_id must not be passed, although the schema still lists it — a minor internal inconsistency. Optional policy sub-parameters such as block_on and velocity_cap_usdc receive no explanation in either schema or description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific decision task — vetting a payment instruction in the context of the agent's own history and provenance — and clearly distinguishes it from assess_counterparty, which vets the seller. The 'should YOUR agent make THIS payment now?' framing makes the resource and intent unmistakable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly positions this tool relative to assess_counterparty ('where assess_counterparty vets the seller, this vets the payment instruction'), giving an agent a basis for choosing between them. It also gives direct calling guidance: strongly recommend passing context.untrusted_text and context.intended to catch prompt-injection and mid-flight redirect payments.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

firewall_outcomeA

FREE. After a firewall verdict, report what actually happened so 402Sentinel learns which signals are predictive and downweights noisy ones (hard-block safety signals stay deterministic). Pass the assessment_id (fw_…) from a prior firewall call.

ParametersJSON Schema
NameRequiredDescriptionDefault
outcomeYesbad: fraud/confirmed_fraud/not_delivered/overcharged/drained/scam · good: delivered/legit/fine
assessment_idYesthe fw_… id from a prior firewall call

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It explains the learning effect (402Sentinel learns and downweights noisy signals), notes that hard-block safety signals stay deterministic, and includes the cost signal 'FREE'. This goes beyond a simple 'report outcome' and gives the agent useful behavioral context, though it does not cover error cases or response behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded with the action and cost signal ('FREE'). The learning explanation is concise yet informative, and the final sentence about the assessment_id is directly actionable. Every sentence earns its place with no wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple two-parameter tool with full schema coverage and no output schema, the description provides the essential workflow (post-firewall feedback) and the provenance requirement for assessment_id. It is missing an explicit comparison to the sibling 'report_outcome', which could cause an agent to pick the wrong tool, but overall the core context is sufficiently covered.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and the schema already documents both parameters, including the fw_… prefix for assessment_id and the grouping of outcome values into bad/good. The description adds no significant parameter-level detail beyond the schema; the reminder to pass the assessment_id is redundant with the schema's own description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action: reporting what actually happened after a firewall verdict, with a clear resource (the assessment_id from a prior firewall call). It effectively communicates the tool's role as a feedback mechanism. However, it does not explicitly differentiate itself from the sibling tool 'report_outcome', leaving some ambiguity about which outcome-reporting tool to choose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly indicates this tool is used after a firewall verdict and instructs the agent to pass the assessment_id from a prior firewall call, giving a direct usage context. It does not explicitly mention when not to use it or name alternatives, but the condition 'after a firewall verdict' is a clear usage guideline.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

firewall_recordA

FREE. Seed your agent's payment history so the firewall has a behavioural baseline (record past/known-good payments). agent_id and the wallet-ownership signature are attached automatically from your configured wallet, so the seeded history is trusted.

ParametersJSON Schema
NameRequiredDescriptionDefault
paymentYes
agent_idNouse your payer wallet address

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden and does add useful behavior: agent_id and wallet-ownership signature are attached automatically from the configured wallet, and seeded history is trusted. However, it does not disclose side effects, whether seeding is append-only/repeatable, or any response/error behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The core purpose and auto-attachment behavior are packed into two short sentences, with the purpose front-loaded after the initial 'FREE.' fragment. The 'FREE.' is minor noise, but the rest is efficient and readable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given a nested payment object, no output schema, and no annotations, the description is not enough to invoke correctly: it does not explain how to construct payment, what response to expect, or resolve the agent_id auto-attachment vs schema input ambiguity. An agent would need to inspect sibling usage or guess.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is only 50%, so the description needed to explain both top-level parameters and the nested payment object. It only speaks to agent_id, and even then creates ambiguity by saying it is attached automatically while the schema asks the agent to use its payer wallet address. The payment fields are left to their names.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with the verb 'Seed' and identifies the resource (agent's payment history) and the goal (firewall behavioural baseline), adding a parenthetical that it records past/known-good payments. This separates it from the sibling assess/report/recommend tools by naming a distinct setup role.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It clearly conveys when to use: when the agent needs to establish a baseline of past/known-good payments for the firewall, rather than to assess, recommend, or report. It does not name sibling tools or exclude cases, but the seeding context is enough to route an agent.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

recommend_policyA

Turn a counterparty's risk into an enforceable spending policy you can apply to your agent wallet. Returns an allow/limit/deny decision plus recommended_policy: max_payment_usdc (per-counterparty cap), daily_cap_usdc, add_to_denylist, require_human_approval. Costs $0.002 (paid automatically in USDC).

ParametersJSON Schema
NameRequiredDescriptionDefault
policyNo
targetYes
payment_contextNo

TDQS

A3.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full behavioral burden and does a good job: it discloses a notable side effect — a $0.002 charge paid automatically in USDC — and specifies the decision/return behavior (allow/limit/deny plus recommended policy fields). It does not mention external service dependencies or failure modes, which keeps it from a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, roughly 55 words, tightly ordered: core purpose first, return value second, cost last. No filler or repetition; every sentence adds information an agent needs (what it produces, and that invoking it costs money).

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is complex (three nested objects, eight nested properties) with no output schema and no annotations, so the description must carry return-value and behavior disclosure. It lists the recommended_policy fields but not their types or structure, and never explains how payment_context.amount influences the decision or whether a prior assessment (e.g., assess_counterparty) is a prerequisite.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Top-level parameter coverage is 0% per the signal, though nested properties (min_confidence, max_payment_usdc, payto_address, etc.) are already well documented in the schema with defaults and examples. The description adds some cross-reference value by labeling max_payment_usdc as a per-counterparty cap and revealing an output-only field (daily_cap_usdc), but it does not explain how the policy, target, or payment_context objects feed the recommendation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a clear purpose: converting counterparty risk into an enforceable spending policy for an agent wallet, and it enumerates the exact output fields (max_payment_usdc, daily_cap_usdc, add_to_denylist, require_human_approval). The verb is slightly figurative ('Turn...into'), and while the intent is clearly distinct from assessment siblings like assess_counterparty, it never explicitly names what it is not.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage context is implied rather than stated: the tool is for when you want to apply counterparty risk as a spending policy to an agent wallet. There is no explicit when-to-use vs. when-not-to-use guidance, and no alternatives are named despite close siblings like assess_counterparty and firewall that could also produce risk-based decisions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

report_outcomeB

FREE. After you pay a counterparty, report whether they delivered so 402Sentinel's settlement-reliability flywheel can learn. Pass the assessment_id returned by a prior assessment.

ParametersJSON Schema
NameRequiredDescriptionDefault
outcomeYes
tx_hashNosettlement tx hash (optional)
assessment_idYesassessment_id from a prior assess/policy call

TDQS

B3.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

There are no annotations, so the description carries full responsibility for behavior. It discloses that the report feeds a settlement-reliability flywheel, but doesn't say whether submission is idempotent, whether it mutates counterparty state, or what happens after reporting.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is short and front-loads the key trigger and purpose. The 'FREE.' prefix is slightly unusual but the rest of the text is economical.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple reporting tool with two required parameters and no output schema, the description gives enough context to call it correctly. However, it leaves uncertainty about submission constraints and return semantics.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 67%, and the description repeats the assessment_id relationship already implied by the schema. It adds no new meaning about outcome values or the optional tx_hash, so the baseline score applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the action (report whether a counterparty delivered) and the resource (a prior assessment). It doesn't name sibling alternatives, but the 'after you pay' trigger and 'report' framing makes it distinguishable from the assessment and policy tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It states when to use it: after paying a counterparty, and instructs the agent to pass an assessment_id from a prior assessment. It doesn't mention exclusions or alternatives, but the context is clear enough for selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

verify_serviceA

402Sentinel Verified (opt-in badge): submit YOUR OWN service's payTo for a deep settlement-graph audit (facilitator-aware, multi-hop, exchange-labelled). If it passes (organic, sufficient confidence), a signed time-boxed (30d) credential is issued and your service joins the public allow-list at /api/verified. Positive-only: failing audits are returned privately, never published. SLOW (deep on-chain scan, up to ~3 minutes). Costs $0.02 (paid automatically in USDC).

ParametersJSON Schema
NameRequiredDescriptionDefault
paytoYesYour service's receiving address
resource_urlNoYour x402 endpoint URL (optional)
claimed_buyersNoBuyers you claim to have (optional; checked against the graph)

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden. It discloses the positive-only policy, that failures are kept private, the 30-day time-box, the public listing outcome, the ~3-minute duration, and the $0.02 automatic cost. This is unusually thorough for an unannotated tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Every clause delivers actionable information: ownership requirement, audit nature, pass/fail behavior, validity period, allow-list endpoint, speed, and cost. The description is dense but each sentence earns its place, and the most important scoping information is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no output schema, the description covers the essential context: purpose, inputs, conditional outcomes, duration, cost, and publication behavior. It could specify what the agent should expect as a response object or error condition, but the core calling context is complete enough for correct selection and invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds meaning beyond the schema by clarifying that payto must be your own service's receiving address and that the audit is graph-based, which contextualizes how 'claimed_buyers' might be verified. It does not go into parameter-specific details, but the schema already handles those.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific action ('submit your own service's payTo for a deep settlement-graph audit') with clear outcomes: a signed 30-day credential and inclusion on the public allow-list. The emphatic 'YOUR OWN service' distinguishes it from sibling tools like assess_counterparty, which likely evaluate other parties.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description makes the intended use case explicit — use this to get your own service verified and allow-listed — and provides practical decision factors (positive-only, SLOW, costs $0.02). It does not name alternatives explicitly, but the ownership contrast with sibling names is implicit and sufficient.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 10 tool updatesv0.7.1
    • First observedassess_counterparty
    • First observedassess_counterparty_deep
    • First observedassess_rwa
    • First observedcompliance_check
    • First observedfirewall
    • First observedfirewall_outcome
    • First observedfirewall_record
    • First observedrecommend_policy
    • First observedreport_outcome
    • First observedverify_service

TDQS

A3.7/5.0

Scored across 10 tools

Disambiguation2/5

assess_counterparty and assess_counterparty_deep are near-identical except for depth and price, so the boundary is fuzzy. recommend_policy largely duplicates the recommended_policy already returned by assess_counterparty, and compliance_check reuses counterparty due-diligence signals, creating several overlapping tool purposes.

Naming Consistency3/5

All tools use snake_case, but the grammatical pattern is mixed: assess_counterparty, recommend_policy, report_outcome, and verify_service are verb-first, while firewall, compliance_check, firewall_record, and firewall_outcome are noun-first or noun compounds. The names remain readable and generally predictable, but the convention is inconsistent.

Tool Count5/5

Ten tools is well within the ideal range and appropriately maps to the server's risk-assessment purpose. Each major workflow—counterparty risk, payment firewall, compliance, RWA checks, feedback loops, and service verification—has representation without excessive bloat.

Completeness4/5

The tool set covers the core pre-payment lifecycle well: counterparty vetting, payment-instruction security, compliance screening, RWA assessment, and outcome feedback. Minor gaps exist around directly managing or retrieving generated policies and querying the verified-service list, but agents can work around these.

Maintenance

ActivityInactive
ResponsivenessNo issues

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers