Treasury and risk controls for agent wallets: policies, quotes, prediction-market orders.
Inferido de los transportes que declara este listado (streamable-http). Que un cliente no aparezca aquí no significa que se haya descartado: simplemente Forge no puede confirmarlo.
La verificación confirma la identidad del publicador (la propiedad del repo), no la seguridad del código. El análisis de seguridad cubre los CVE conocidos y los scripts de instalación sospechosos.
Leído de un handshake MCP real initialize → tools/list contra el endpoint declarado. No se invocó ninguna herramienta: tools/list es la llamada de introspección de solo lectura que el protocolo define para esto. Refleja lo que el servidor anunciaba en ese momento; un endpoint alojado no está fijado a ninguna versión y puede cambiar sin avisar.
https://mcp.cofferline.com47 herramientas · 310 msget_quotesLive venue quote comparison for a token conversion (CoW + ParaSwap on Base). Free, no auth.Live venue quote comparison for a token conversion (CoW + ParaSwap on Base). Free, no auth.
| Parámetro | Tipo | Descripción |
|---|---|---|
| sell_token* | string | ERC-20 address being sold |
| buy_token* | string | ERC-20 address being bought |
| sell_amount* | string | sell amount in base units, decimal string |
| chain_id | number | 8453 (Base) |
get_benchmarksMeasured execution benchmarks: median savings vs arrival quote by USD size bucket, from real completed intents only. Free, no auth.Measured execution benchmarks: median savings vs arrival quote by USD size bucket, from real completed intents only. Free, no auth.
No se publicó ningún esquema de entrada para esta herramienta.
screen_addressOFAC SDN counterparty screening for an address. Free, no auth.OFAC SDN counterparty screening for an address. Free, no auth.
| Parámetro | Tipo | Descripción |
|---|---|---|
| address* | string | EVM address to screen |
list_tokensTokens the platform accepts on an intent, per chain — what create_intent will admit. Free, no auth.Tokens the platform accepts on an intent, per chain — what create_intent will admit. Free, no auth.
| Parámetro | Tipo | Descripción |
|---|---|---|
| chain_id | number | limit to one chain; omit for every supported chain |
list_feedbackEvery feature request ever submitted, public and unauthenticated. Free.Every feature request ever submitted, public and unauthenticated. Free.
| Parámetro | Tipo | Descripción |
|---|---|---|
| limit | number | max results |
submit_feedbackSubmit a feature request ($1 anti-spam fee, charged to the prepaid balance when funded). Auth required. Payment flow: call once without x_payment — a 402 reply lists the exact EIP-3009 requirements (amount, USDC asset, recipient, EIP-712 domain). Sign a transferWithAuthorization for them outside MC…Submit a feature request ($1 anti-spam fee, charged to the prepaid balance when funded). Auth required. Payment flow: call once without x_payment — a 402 reply lists the exact EIP-3009 requirements (amount, USDC asset, recipient, EIP-712 domain). Sign a transferWithAuthorization for them outside MC…
| Parámetro | Tipo | Descripción |
|---|---|---|
| title* | string | short title, 8-120 chars |
| body* | string | the request, 20-4000 chars |
| x_payment | string | base64 X-PAYMENT value from a previously answered 402 (see description) |
start_siwe_loginStart wallet sign-in: returns a single-use SIWE message. Sign it with the wallet outside MCP (this server cannot sign), then call complete_siwe_login. Free, no auth.Start wallet sign-in: returns a single-use SIWE message. Sign it with the wallet outside MCP (this server cannot sign), then call complete_siwe_login. Free, no auth.
| Parámetro | Tipo | Descripción |
|---|---|---|
| address* | string | wallet address to authenticate |
| chain_id | number | 8453 |
complete_siwe_loginFinish wallet sign-in: exchanges the signed SIWE message for a cl_sess_… session token — use it as the Authorization bearer on every authenticated tool. Free, no auth.Finish wallet sign-in: exchanges the signed SIWE message for a cl_sess_… session token — use it as the Authorization bearer on every authenticated tool. Free, no auth.
| Parámetro | Tipo | Descripción |
|---|---|---|
| message* | string | the exact SIWE message from start_siwe_login |
| signature* | string | the wallet's signature over the message, 0x… |
get_meIdentify the authenticated account: address, kind, scopes. Auth required.Identify the authenticated account: address, kind, scopes. Auth required.
No se publicó ningún esquema de entrada para esta herramienta.
export_accountExport all of this account's data in one document. Auth required.Export all of this account's data in one document. Auth required.
No se publicó ningún esquema de entrada para esta herramienta.
offboard_accountClose this account for good: revokes every credential, scrubs personal data, retires the account. Irreversible; confirm_wallet_address must be the account's own wallet address, typed exactly. Auth required.Close this account for good: revokes every credential, scrubs personal data, retires the account. Irreversible; confirm_wallet_address must be the account's own wallet address, typed exactly. Auth required.
| Parámetro | Tipo | Descripción |
|---|---|---|
| confirm_wallet_address* | string | the account's wallet address, typed to confirm |
| reason | string | optional reason, recorded |
put_policyCreate or update the wallet's treasury policy (immutable versioning; PUT creates the next version). Auth required. Body must match /schemas/policy-v1.json — only version, wallet and chain_id are required; omitted fields take the platform defaults published in the manifest and are stored into the do…Create or update the wallet's treasury policy (immutable versioning; PUT creates the next version). Auth required. Body must match /schemas/policy-v1.json — only version, wallet and chain_id are required; omitted fields take the platform defaults published in the manifest and are stored into the do…
| Parámetro | Tipo | Descripción |
|---|---|---|
| policy* | object | PolicyV1 document; {"version":1,"wallet":"0x…","chain_id":8453} is a complete one |
get_policyList policy versions, newest first (the first entry is active). Auth required.List policy versions, newest first (the first entry is active). Auth required.
| Parámetro | Tipo | Descripción |
|---|---|---|
| wallet | string | optional wallet filter |
| limit | number | max results |
check_spendPre-flight policy check: would this spend be allowed under the wallet's policy right now? Auth required.Pre-flight policy check: would this spend be allowed under the wallet's policy right now? Auth required.
| Parámetro | Tipo | Descripción |
|---|---|---|
| wallet* | string | wallet address |
| amount_usd* | string | spend amount in USD, decimal string |
| token* | string | token symbol, e.g. USDC |
| counterparty | string | optional counterparty address to screen |
check_pm_orderPre-flight policy check for a prediction-market order: would this cost be allowed right now? Auth required.Pre-flight policy check for a prediction-market order: would this cost be allowed right now? Auth required.
| Parámetro | Tipo | Descripción |
|---|---|---|
| wallet* | string | wallet address |
| condition_id* | string | market/condition identifier |
| cost_usd* | string | order cost in USD, decimal string |
| state | object | optional current exposure: {market_exposure_usd, realized_loss_today_usd, total_open_exposure_usd} as decimal strings |
poll_eventsPoll typed treasury events with a monotonic cursor (intent lifecycle, budget thresholds, reconciliation, security alerts). Auth required.Poll typed treasury events with a monotonic cursor (intent lifecycle, budget thresholds, reconciliation, security alerts). Auth required.
| Parámetro | Tipo | Descripción |
|---|---|---|
| wallet | string | optional wallet filter |
| cursor | number | resume after this event id |
| limit | number | max results |
| type | string | optional event-type filter, e.g. intent.filled |
get_statementDeterministic monthly statement derived from the append-only ledger — same period, same bytes. Auth required.Deterministic monthly statement derived from the append-only ledger — same period, same bytes. Auth required.
| Parámetro | Tipo | Descripción |
|---|---|---|
| wallet* | string | wallet address |
| period* | string | calendar month, YYYY-MM |
| format | string | 'json' (default) or 'csv' |
create_intentCreate a conversion or gas_topup intent; the executor pipeline plans and fills it under policy. Auth required.Create a conversion or gas_topup intent; the executor pipeline plans and fills it under policy. Auth required.
| Parámetro | Tipo | Descripción |
|---|---|---|
| wallet* | string | wallet address |
| kind* | string | — |
| sell_token* | string | ERC-20 address being sold |
| buy_token* | string | ERC-20 address being bought |
| sell_amount* | string | base units, decimal string |
| max_slippage_bps | number | optional per-intent slippage cap |
| venues | array | optional venue override |
get_intentFetch an intent, including fills and the post-trade report once filled. Auth required.Fetch an intent, including fills and the post-trade report once filled. Auth required.
| Parámetro | Tipo | Descripción |
|---|---|---|
| id* | string | intent id (uuid) |
list_intentsList intents, newest first. Auth required.List intents, newest first. Auth required.
| Parámetro | Tipo | Descripción |
|---|---|---|
| wallet | string | optional wallet filter |
| limit | number | max results |
| offset | number | skip this many |
cancel_intentCancel a planned intent (a few-second window before execution claims it). Auth required.Cancel a planned intent (a few-second window before execution claims it). Auth required.
| Parámetro | Tipo | Descripción |
|---|---|---|
| id* | string | intent id (uuid) |
prepare_delegationPrepare a scoped session-key grant for a Kernel smart account: exact call allowlist, expiry, optional rate limit. Returns the ONE EIP-712 digest the account owner signs outside MCP (this server cannot sign) — then call confirm_delegation with the signature. Auth required.Prepare a scoped session-key grant for a Kernel smart account: exact call allowlist, expiry, optional rate limit. Returns the ONE EIP-712 digest the account owner signs outside MCP (this server cannot sign) — then call confirm_delegation with the signature. Auth required.
| Parámetro | Tipo | Descripción |
|---|---|---|
| account* | string | the Kernel smart account granting scope |
| chain_id* | number | 8453 (Base) or 84532 (Base Sepolia) |
| calls* | array | allowed calls: each {target: contract address, selector: 0x + 4 bytes, value_limit: max native value in wei as decimal string} |
| valid_after | number | optional start, unix seconds |
| valid_until* | number | expiry, unix seconds |
| rate_limit | object | optional {count, interval_secs}: max delegated calls per interval |
confirm_delegationActivate a prepared delegation by supplying the owner's signature over its enable digest. Auth required.Activate a prepared delegation by supplying the owner's signature over its enable digest. Auth required.
| Parámetro | Tipo | Descripción |
|---|---|---|
| id* | string | delegation id (uuid) |
| enable_sig* | string | owner's 65-byte signature over the digest, 0x… |
| owner | string | optional owner address, when it differs from the caller |
renew_delegationRenew an active delegation: same scope, fresh expiry, no authority gap. Returns a NEW digest to sign and confirm exactly like prepare_delegation. Auth required.Renew an active delegation: same scope, fresh expiry, no authority gap. Returns a NEW digest to sign and confirm exactly like prepare_delegation. Auth required.
| Parámetro | Tipo | Descripción |
|---|---|---|
| id* | string | delegation id (uuid) |
| valid_until | number | optional new expiry, unix seconds; defaults to the original duration |
revoke_delegationRevoke a delegation. The reply includes calldata the owner can send on-chain for hard finality. Auth required.Revoke a delegation. The reply includes calldata the owner can send on-chain for hard finality. Auth required.
| Parámetro | Tipo | Descripción |
|---|---|---|
| id* | string | delegation id (uuid) |
get_delegationFetch one delegation. Auth required.Fetch one delegation. Auth required.
| Parámetro | Tipo | Descripción |
|---|---|---|
| id* | string | delegation id (uuid) |
list_delegationsList delegations, newest first. Auth required.List delegations, newest first. Auth required.
| Parámetro | Tipo | Descripción |
|---|---|---|
| account | string | optional smart-account filter |
| limit | number | max results |
panicEmergency stop, one call: suspends the account, revokes every API key, session, delegation and venue credential, and returns all unwind calldata for the owner. Auth required.Emergency stop, one call: suspends the account, revokes every API key, session, delegation and venue credential, and returns all unwind calldata for the owner. Auth required.
| Parámetro | Tipo | Descripción |
|---|---|---|
| reason | string | optional reason, recorded |
get_balancePrepaid fee balance: settled credits minus fee debits. Auth required.Prepaid fee balance: settled credits minus fee debits. Auth required.
No se publicó ningún esquema de entrada para esta herramienta.
topup_balanceTop up the prepaid balance with USDC. Auth required. Payment flow: call once without x_payment — a 402 reply lists the exact EIP-3009 requirements (amount, USDC asset, recipient, EIP-712 domain). Sign a transferWithAuthorization for them outside MCP (this server cannot sign), then call again with x…Top up the prepaid balance with USDC. Auth required. Payment flow: call once without x_payment — a 402 reply lists the exact EIP-3009 requirements (amount, USDC asset, recipient, EIP-712 domain). Sign a transferWithAuthorization for them outside MCP (this server cannot sign), then call again with x…
| Parámetro | Tipo | Descripción |
|---|---|---|
| amount_usd* | string | top-up amount in USD, decimal string |
| x_payment | string | base64 X-PAYMENT value from a previously answered 402 (see description) |
set_auto_topupConfigure auto-topup: when the prepaid balance falls below threshold_usd, the platform settles one of the pre-signed EIP-3009 authorizations you supply (signed outside MCP — this server cannot sign). Auth required.Configure auto-topup: when the prepaid balance falls below threshold_usd, the platform settles one of the pre-signed EIP-3009 authorizations you supply (signed outside MCP — this server cannot sign). Auth required.
| Parámetro | Tipo | Descripción |
|---|---|---|
| threshold_usd* | string | refill when balance drops below this, USD decimal string |
| max_per_month | number | cap on automatic top-ups per month (default 10) |
| authorizations* | array | pre-signed transferWithAuthorization payloads: each {from, to, value, valid_after, valid_before, nonce, signature} |
get_auto_topupThe auto-topup rule and how many pre-signed authorizations remain. Auth required.The auto-topup rule and how many pre-signed authorizations remain. Auth required.
No se publicó ningún esquema de entrada para esta herramienta.
remove_auto_topupprivilegiadaRemove the auto-topup rule and its unused authorizations. Auth required.Remove the auto-topup rule and its unused authorizations. Auth required.
No se publicó ningún esquema de entrada para esta herramienta.
store_pm_credentialStore a prediction-market venue credential (verified live against the venue, sealed at rest, material never returned). Polymarket, either shape: signer_private_key + maker (derives API creds), or api_key + secret + passphrase + maker + signer. Auth required.Store a prediction-market venue credential (verified live against the venue, sealed at rest, material never returned). Polymarket, either shape: signer_private_key + maker (derives API creds), or api_key + secret + passphrase + maker + signer. Auth required.
| Parámetro | Tipo | Descripción |
|---|---|---|
| venue | string | prediction-market venue (default polymarket) |
| label | string | optional display label |
| signer_private_key | string | Polymarket: signer EOA private key, 0x… |
| maker | string | Polymarket: funder (maker) address |
| signer | string | Polymarket: signer address (explicit-creds shape) |
| api_key | string | Polymarket: CLOB API key (explicit-creds shape) |
| secret | string | Polymarket: CLOB API secret (explicit-creds shape) |
| passphrase | string | Polymarket: CLOB API passphrase (explicit-creds shape) |
| signature_type | number | Polymarket: 0 EOA, 1 Magic/email, 2 browser proxy (default 1) |
list_pm_credentialsList stored venue credentials — metadata only, never material. Auth required.List stored venue credentials — metadata only, never material. Auth required.
No se publicó ningún esquema de entrada para esta herramienta.
revoke_pm_credentialRevoke a venue credential; its sealed ciphertext is destroyed. Auth required.Revoke a venue credential; its sealed ciphertext is destroyed. Auth required.
| Parámetro | Tipo | Descripción |
|---|---|---|
| id* | string | credential id (uuid) |
get_pm_signer_rotationCalldata to swap the Polymarket funder Safe's owner to a new EOA — the owner executes it outside MCP (this server cannot sign). Auth required.Calldata to swap the Polymarket funder Safe's owner to a new EOA — the owner executes it outside MCP (this server cannot sign). Auth required.
| Parámetro | Tipo | Descripción |
|---|---|---|
| id* | string | credential id (uuid) |
| new_owner* | string | the replacement owner address |
create_pm_orderPlace a prediction-market limit order under policy, signed server-side with the stored credential. Polymarket: condition_id, token_id, action, price_usd (e.g. '0.55'), size_shares. Auth required.Place a prediction-market limit order under policy, signed server-side with the stored credential. Polymarket: condition_id, token_id, action, price_usd (e.g. '0.55'), size_shares. Auth required.
| Parámetro | Tipo | Descripción |
|---|---|---|
| venue | string | prediction-market venue (default polymarket) |
| wallet* | string | treasury wallet whose policy governs the order |
| credential_id* | string | stored credential id (uuid) |
| action* | string | — |
| condition_id | string | Polymarket: market condition id |
| token_id | string | Polymarket: outcome token id, decimal string |
| price_usd | string | Polymarket: limit price, '0.xx' |
| size_shares | string | Polymarket: share count, decimal string |
| client_order_id | string | optional idempotency uuid |
| state | object | optional current exposure: {market_exposure_usd, realized_loss_today_usd, total_open_exposure_usd} as decimal strings |
list_pm_ordersThe credential's resting orders straight from the venue — recover state after a disconnect. Auth required.The credential's resting orders straight from the venue — recover state after a disconnect. Auth required.
| Parámetro | Tipo | Descripción |
|---|---|---|
| credential_id* | string | stored credential id (uuid) |
| market | string | optional market filter |
cancel_pm_orderCancel one resting prediction-market order. Auth required.Cancel one resting prediction-market order. Auth required.
| Parámetro | Tipo | Descripción |
|---|---|---|
| venue | string | prediction-market venue (default polymarket) |
| order_id* | string | the venue's order id |
| credential_id* | string | stored credential id (uuid) |
cancel_all_pm_ordersCancel every resting order for the credential, optionally within one market. Auth required.Cancel every resting order for the credential, optionally within one market. Auth required.
| Parámetro | Tipo | Descripción |
|---|---|---|
| credential_id* | string | stored credential id (uuid) |
| market | string | optional market filter |
prepare_pm_orderPrepare a client-signed Polymarket order: policy-checked, then returns the exact EIP-712 payload to sign outside MCP (this server cannot sign) plus a prepare_id — submit both via submit_pm_order. Auth required.Prepare a client-signed Polymarket order: policy-checked, then returns the exact EIP-712 payload to sign outside MCP (this server cannot sign) plus a prepare_id — submit both via submit_pm_order. Auth required.
| Parámetro | Tipo | Descripción |
|---|---|---|
| venue* | string | — |
| wallet* | string | treasury wallet whose policy governs the order |
| credential_id* | string | stored credential id (uuid) |
| condition_id* | string | market condition id |
| token_id* | string | outcome token id, decimal string |
| action* | string | — |
| price_usd* | string | limit price, '0.xx' |
| size_shares* | string | share count, decimal string |
| client_order_id | string | optional idempotency uuid |
| state | object | optional current exposure: {market_exposure_usd, realized_loss_today_usd, total_open_exposure_usd} as decimal strings |
submit_pm_orderSubmit a prepared Polymarket order with the maker's EIP-712 signature from prepare_pm_order. Auth required.Submit a prepared Polymarket order with the maker's EIP-712 signature from prepare_pm_order. Auth required.
| Parámetro | Tipo | Descripción |
|---|---|---|
| prepare_id* | string | prepare id (uuid) from prepare_pm_order |
| signature* | string | the maker's 65-byte EIP-712 signature, 0x… |
get_pm_onboardingPolymarket trade-readiness for an address: live approval status plus the calldata for anything missing (executed outside MCP — this server cannot sign). Auth required.Polymarket trade-readiness for an address: live approval status plus the calldata for anything missing (executed outside MCP — this server cannot sign). Auth required.
| Parámetro | Tipo | Descripción |
|---|---|---|
| address* | string | the trading address to check |
resolve_pm_funderResolve an owner EOA to its Polymarket funder Safe candidates. Auth required.Resolve an owner EOA to its Polymarket funder Safe candidates. Auth required.
| Parámetro | Tipo | Descripción |
|---|---|---|
| owner* | string | owner EOA address |
sync_pm_fillsPull the venue's fills for a credential into the wallet's ledger. Idempotent — safe to repeat. Auth required.Pull the venue's fills for a credential into the wallet's ledger. Idempotent — safe to repeat. Auth required.
| Parámetro | Tipo | Descripción |
|---|---|---|
| wallet* | string | treasury wallet whose books receive the fills |
| credential_id* | string | stored credential id (uuid) |
wrap_pm_usdcWrap the funder Safe's USDC.e into Polymarket's pUSD, platform-relayed so the user pays no gas. Omit amount_base_units to wrap the full balance. Auth required.Wrap the funder Safe's USDC.e into Polymarket's pUSD, platform-relayed so the user pays no gas. Omit amount_base_units to wrap the full balance. Auth required.
| Parámetro | Tipo | Descripción |
|---|---|---|
| credential_id* | string | stored credential id (uuid) |
| amount_base_units | string | optional amount in base units, decimal string |
47 de 47 herramientas publicaron una descripción.
Los nombres y descripciones de las herramientas los escribe el publicador y se muestran literalmente como texto inerte. Son las cadenas que un cliente MCP pasa al modelo, así que Forge las analiza en busca de patrones de inyección de prompts — cualquier hallazgo aparece junto al análisis de seguridad de arriba. «Privilegiada» es una coincidencia de palabra clave en el nombre de la herramienta, no una auditoría de lo que hace: un nombre inofensivo puede hacer cualquier cosa.
Treasury and risk controls for agent wallets: policies, quotes, prediction-market orders.
+ 7 más observadas en esta entrada.
Los nombres enlazados abren el índice de Forge con todas las entradas que se observó que exponen esa herramienta. Ver todas las herramientas indexadas.
Esta entrada no publica ningún paquete de npm, así que Forge no tiene un árbol de dependencias para ella. Es una carencia de cobertura, no una afirmación de que no tenga dependencias.