"Otto" matching MCP tools:

• otto_delegation_capA

  Otto IntelB

  Legacy Model B cap confirmation. New { phase: "reserve" } requests are retired and refused before any claim or reservation is written. { phase: "confirm", accessToken, mintKey } remains available for a permission already minted against a prior reservation: the server re-reads CDP and confirms only the exact still-current claim and reserved expiry. A mismatch or Stop overlap remains unconfirmed; a fresh explicit Stop handles the current grant. Without a confirmed per-user cap, delegated sends refuse. This tool does not issue new permissions. Server-to-server only: the caller presents Otto's delegation secret in the `x-otto-delegation-auth` request header (never in arguments); a call without it is refused before anything is read. The listed input schema is intentionally permissive — the strict schema is validated after the caller is authenticated.

  ConnectorNo auth

• gtm_update_playA

  GTM OttoA

  Change a play's own knobs — name, goal, voice — its two switches, and the ACCOUNT's pacing (daily action cap, working hours: shared by every play on the LinkedIn account, not per play). `paused: true` is the human's stop button (nothing runs, nothing is sent); `paused: false` resumes. `status: 'active'` LAUNCHES a draft; `status: 'draft'` takes it back off the road. Seat rule, enforced server-side: no live LinkedIn seat ⇒ neither launch nor resume makes it active — it stays/falls back to draft and the note says so. Launching or resuming kicks the play's due lanes at once. Only launch, resume or raise the cap when the human asked for it in this conversation: an active play spends the month's lead quota and acts from the human's own LinkedIn account. Does not touch the autonomy ladder.

  Connector

  Destructive

  No auth

• gtm_configure_sourceA

  GTM OttoA

  Write a lane's settings — upload an account list, set the Post-discovery intent and anchors, change the job keywords, move a gate. MERGE semantics: only the fields you send change. Lists (companies, postUrls, competitors) REPLACE by default; pass listMode 'append' to add to what is there (deduped, case-insensitive). Caps: 100 companies, 25 posts, 25 anchors — what did not fit comes back in `truncated`. Unknown fields are refused. Saving creates the lane's row if it never had one (OFF, because configuring is not switching on), makes the lane due again immediately and resets its retry backoff; on account_list it also forgets the cached misses so unfound companies are looked up again. Pass `on: true` to switch it on in the same call — refused, with nothing saved, if the lane would still have nothing to run on. Nothing runs inside this call: an ON lane on an ACTIVE play runs on the next tick (≤5 min); otherwise use gtm_run_source. Read gtm_sources_reference for each field's meaning.

  Connector

  Destructive

  No auth

• hood_sector_rotationA

  Otto Data — Robinhood ChainA

  Sector rotation context for Hood tokenized stocks (API-only tracker refreshed every 3h): market regime (risk_on|risk_off|mixed), an 11-SPDR sector score/label/flow board and a per-ticker join — sector score (0-100), label (inflow|interest|neutral|outflow_leaning|outflow), flow trend, theme matches + live basis. Answers where money is rotating and whether your token's sector is in inflow or outflow. tickers: CSV filter (empty = full Hood universe).

  ConnectorNo auth

• otto_delegation_fenceA

  Otto IntelB

  Idempotent ensure-by-digest of the ONE CDP project-scope policy that fences every delegated send, then a read-back. Writes only when no project policy exists (creates it) or when the existing one is Otto's own lineage with stale rules (updates it in place). REFUSES BY NAME if a different project-scope policy is installed — it is never overwritten or deleted. Never downgrades a newer fence. An OPS action: at most one ensure runs project-wide at a time, never during a rolling deploy, never from the dApp (the mint gate reads fence.present from otto_delegation_status). Arguments: {}. Output: the policy id, versioned name, rules digest and the per-swap cap; the tool fails unless the fence reads back present under the written id. Server-to-server only: the caller presents Otto's delegation secret in the `x-otto-delegation-auth` request header (never in arguments); a call without it is refused before anything is read. The listed input schema is intentionally permissive — the strict schema is validated after the caller is authenticated.

  ConnectorNo auth

• otto_delegation_statusA

  Otto IntelB

  Read back, for the end user identified by a CDP access token, their CDP accounts, whether the Model-B fence is present, and whether an active delegation reads back (with its expiry and the per-swap cap recorded for it). Arguments: { accessToken } — the server resolves the user from the token; a client-sent user id is refused. delegation.per_swap_cap_usd is the number THIS user chose at mint time; it is ABSENT when no cap is recorded for the grant, which means the delegated send will refuse it — say so rather than showing the shared ceiling. fence.per_swap_cap_usd is that shared ceiling and is never a per-user number. Output is bound to that user; nothing about any other user is returned. Server-to-server only: the caller presents Otto's delegation secret in the `x-otto-delegation-auth` request header (never in arguments); a call without it is refused before anything is read. The listed input schema is intentionally permissive — the strict schema is validated after the caller is authenticated.

  ConnectorNo auth

• otto_delegation_revokeA

  Otto IntelB

  Revoke the end user's delegation from Otto's side and confirm by read-back that it no longer exists; from then on this server submits nothing for that user (fail-closed, even if the read-back had failed). Arguments: EITHER { accessToken } (the user path — the server resolves the user from the token) OR { userId, support_reason } (the support path, for an operator holding the server secret; the reason is logged, the token never is). Server-to-server only: the caller presents Otto's delegation secret in the `x-otto-delegation-auth` request header (never in arguments); a call without it is refused before anything is read. The listed input schema is intentionally permissive — the strict schema is validated after the caller is authenticated.

  Connector

  Destructive

  No auth

• otto_delegation_operationsA

  Otto IntelB

  Read the durable Base delegated-operation journal for the end user resolved from { accessToken }. Optional artifactId selects one exact own-user operation; without it, the result includes a bounded recent terminal history and every unresolved operation regardless of age. The global unresolved flag is fail-closed: it is true when the store is unavailable, journal coverage is not rollout-ready, or any operation has a prepared/submitted/unknown outcome. Stored serialized transactions and CDP idempotency keys are never returned, and this tool never submits or retries anything. Server-to-server only: the caller also presents Otto's delegation secret in the x-otto-delegation-auth request header; no userId argument is accepted.

  ConnectorNo auth

• gtm_sources_referenceA

  GTM OttoA

  THE REFERENCE for configuring sourcing lanes — read it before your first gtm_configure_source / gtm_set_source / gtm_run_source call. Every lane (people_search, competitor_posts a.k.a. Post discovery, job_offers, account_list, and the retired post_engagers), every config field with its meaning, default and cap, the fit/intent/post gates, what makes a lane runnable, how the 5-minute tick and the 24h cadence work, what a preview costs versus a run, and what this surface deliberately will not do. No backend call; safe to call any time.

  ConnectorNo auth

• partner_swap_quoteA

  Otto Data — Robinhood ChainA

  Get an UNSIGNED Rialto swap quote for an approved partner. YOU sign and broadcast the returned transaction yourself, with your own wallet's private key, on your own infrastructure — Otto never sees or holds your key and never submits anything on your behalf. api_key: the otto_pn_ key Otto's admin issued you directly. sell_token/buy_token: Hood token contract addresses (0x...). sell_amount: human units of sell_token (e.g. "25" USDG, not wei). taker: the wallet address that will actually sign and hold the position. Returns the raw Rialto quote including tx.to, tx.data, tx.value and min_buy_amount — everything needed to build and sign the transaction. After broadcasting, call partner_report_fill so the trade shows up in Otto's records.

  ConnectorNo auth

• otto_x_recipesA

  Otto IntelB

  Return Otto X's live X Layer recipe menu — each recipe's path, price, and the X Layer (eip155:196) payment requirement decoded from its unpaid 402 challenge: token asset, issuer name/version, payTo, and a copy-paste curl. Settles in USD₮0 / USD Coin / Global Dollar on X Layer via the PAYMENT-SIGNATURE header. Always free and read-only; never signs or pays and does not consume the free intelligence call.

  ConnectorNo auth

• otto_delegation_fence_statusA

  Otto IntelB

  PUBLIC and read-only, no header: reports whether the Model B project policy still fences existing delegated sends, its name and rules digest, the shared cap ceiling, and mint_enabled for new Model B trade setup. New trade-permission creation is retired, so mint_enabled is false on the serving retirement build. Existing status, revoke and exits remain available. No user, grant, address or policy contents are exposed. Arguments: {}.

  ConnectorNo auth

• otto_news_recapsA

  Otto IntelB

  Read a concise crypto market recap with ranked stories, source links where available, analysis window and freshness. A cached result can use the hosted free allowance; a cold or unavailable read returns a payment challenge without generating a recap for free. Stale-but-servable cached results retain their upstream freshness and degraded indicators. Market context only; not a recommendation. Hosted access: the first eligible cached intelligence result is free; otherwise calls cost $0.003 USDC through x402.

  ConnectorNo auth

• gtm_run_sourceA

  GTM OttoA

  'Run once now' — run ONE lane immediately through the same code the sourcing tick runs, with force: an OFF lane still runs (that is what run-once means while configuring), a DRAFT play still runs (how you try a lane before launch), a PAUSED play does not. REAL: provider calls are made, leads are inserted, the play's daily budget and the org's monthly lead quota are spent. Only call it when the human asked for a run in this conversation; to look without spending, use gtm_preview_source. Returns the run's funnel (scanned / dropped / droppedIntent / added / duplicates / capped), the unmapped ICP facets, and `skipped` + `reason` when it could not run (no_seat, needs_config, icp_empty, daily_cap, lead_quota, no_results, provider_error).

  Connector

  Destructive

  No auth

• gtm_forget_harvested_postsA

  GTM OttoA

  The tuning escape hatch for the post lanes. A post lane remembers every post it already paid to harvest so it never buys the same engagers twice — which makes it impossible to TUNE: change the intent or a gate, run, and the answer is 'no new posts since last time'. This clears that memory so the next run (or gtm_run_source) judges today's posts against the new settings. It COSTS: every forgotten post is a fresh engager fetch. Call it only after a deliberate settings change the human wants re-tested. Only competitor_posts and post_engagers have this memory.

  Connector

  Destructive

  No auth

• gtm_connect_linkedinA

  GTM OttoA

  The link a human opens to connect (or reconnect) their LinkedIn account to a play — the one cockpit step the play cannot run without. Hand the URL to the human, tell them to say when it is done, then call gtm_linkedin_status: the seat reads `classic` or `sales_navigator` once bound. The link expires in 15 minutes; call again for a fresh one. Nothing is sent, nothing is read from their account by this call.

  ConnectorNo auth

• get_funding_ratesA

  SingIt x402A

  Funding rates for one symbol across exchanges, with open interest, long/short ratio, large positions and liquidations, from Otto AI. Use to compare venues or gauge positioning; use get_hyperliquid_market for one Hyperliquid contract. Paid per call from your key's SingIt limits in USDC; Base accounts only for now.

  ConnectorNo auth

• funding_carry_signalsA

  Otto Data — Robinhood ChainA

  Deterministic funding-carry candidates joining perp funding (Arcus/Lighter) with perp-vs-spot basis. Per ticker: funding rate + annualized funding_apr_pct, perp-vs-Chainlink gap (bps) and a label — carry_long_spot_short_perp (hold Hood spot, short the perp, collect positive funding), carry_short_spot_long_perp (inverse) or no_carry — plus the standard risk flags. min_abs_bps filters on |perp_vs_chainlink_bps|. Signals are NOT orders.

  ConnectorNo auth

• execute_onchain_swapA

  Otto Data — Robinhood ChainA

  Execute a REAL on-chain swap on Robinhood Chain via the Rialto router, signed by Otto's server-side trading wallet. side=buy spends `usd_amount` USDG to buy the ticker's Hood token; side=sell sells `qty` tokens back to USDG. The server enforces hard guardrails independently of the caller: USDG<->allowlisted-token pairs only, per-trade and daily USD caps, and a slippage cap. On success the matching order_filled/position_closed event (payload mode=onchain, with tx_hash) is written automatically — the position book, performance stats and trade chart update without a separate report_agent_status call. key: the operator's OTTO_AGENT_KEY. agent: gap-trader | narrative-trader. Returns tx_hash, fill qty/price/usd and pnl_bps (sells with a known entry).

  Connector

  Destructive

  No auth

• competition_paper_tradeA

  Otto Data — Robinhood ChainA

  Place a PAPER fill in Otto's trading competition on behalf of the key's owner. No real funds move — the fill is priced server-side at the latest Chainlink price (callers can never supply a price). api_key: the personal otto_pk_ key issued when the wallet joined at ottodata.app/competition. side: buy | sell. qty: token quantity (shares). Include a short `reason` — it shows up in the owner's trade history. Rules enforced server-side: $10,000 starting budget, long-only, max $2,000 notional per trade, max 10 open positions, max 40 trades/day. On a rule violation the response is {"error": "..."} — read it and adjust instead of retrying blindly.

  ConnectorNo auth

• otto_prepare_bridgeA

  Otto IntelB

  Prepare, decode, and verify an unsigned cross-chain native-USDC bridge construction aid for the caller-owned EOA or Safe, over the enumerated v1 Circle-CCTP route set (Ethereum, Polygon, Base, Arbitrum, Avalanche); any other chain, token, or bridge route is refused by name. The envelope's valid_until bounds freshness and is committed to the artifact digest; the signer account nonce is the on-chain replay boundary, and this tool cannot guarantee single execution. Returns ordered allowance-reset, approval, and call steps on the source chain only; never signs or submits. Every envelope from this server is valid for 300 seconds from construction (valid_until); a stale envelope is refused by the verifier — request a fresh one.

  ConnectorNo auth