Loading ToolBench
AgentShield MCP server — real-time smart contract security for AI agents. Verify contracts for honeypots, rug pulls, and risks via x402 micropayments.
AgentShield exposes 15 tools with complete input schemas and descriptions, but suffers from critical naming and composition issues. Tool names lack clear action verbs (verify_contract, scan_contract, deep_scan are near-synonyms; monitor_wallet, freeze_wallet, get_alerts overlap semantically). Parameter descriptions are present but often vague, 'payment' in verify_contract lacks format guidance; 'reason' in freeze_wallet is underspecified. No output schemas are documented, forcing LLMs to guess response structure. Error handling is absent, no guidance on retryability, user-fixable vs fatal errors, or recovery paths. Security concerns: API keys exposed as parameters (verify_batch, register_webhook, get_dashboard, etc.) violate secret-injection pattern. Irreversible operations (freeze_wallet) lack confirmation or dry-run support. Composition is poor: verify_contract, scan_contract, and deep_scan perform overlapping threat detection with no clear differentiation, agents will struggle to choose. Average tool score: 42/100.
Detect changes in a contract's ownership, proxy implementation, mint authority, taxes, or honeypot status since last check. Pro/Builder only.
Create a referral code. Both you and the redeemer get +500 free API calls.
Deep forensic analysis: ownership, permissions, exploit pattern matching, bytecode analysis, and risk breakdown. Goes deeper than verify or scan. 2 free/day, unlimited for Pro/Builder subscribers.
Emergency freeze all monitored wallets for a wallet address or agent. Stops all transaction signing until manually unfrozen. Requires API key (X-Agent-Key) or wallet ownership.
Get recent drain alerts and threat notifications for a wallet address.
View your API usage, billing, active webhooks, and alerts. Requires API key.
API keys exposed as tool parameters (verify_batch, register_webhook, get_dashboard, contract_diff, get_reputation, create_referral, redeem_referral). Credentials must use server-side secret injection; agent traces log all parameters, leaking secrets into logs and prompt history.
Three near-identical contract scanning tools (verify_contract, scan_contract, deep_scan) with overlapping functionality and no clear differentiation. LLMs cannot reliably choose between them. Violates single-responsibility principle.
No output schemas documented for any tool. LLMs cannot plan downstream calls or extract required fields (e.g., does verify_contract return a risk_score, threat_list, or boolean?). Blocks tool chaining.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 56 | 2026-07-28+ | v2 |
Get an agent's reputation score and tier (NEW, ACTIVE, VERIFIED, TRUSTED). Higher reputation = more benefits.
Get AgentShield platform statistics: contracts verified, wallets monitored, threats blocked.
Watch a wallet for drain threats. When balance drops beyond threshold in a single transaction, fires an alert to your callback URL and auto-freezes all linked agent wallets.
Redeem a referral code for +500 free API calls.
Register a webhook to receive alerts when a contract's ownership, proxy, or risk changes. Pro/Builder plan required.
Report a malicious contract to the community. Earns +50 bonus API calls. 3+ reports auto-flag the contract.
Full threat detection scan: honeypots, rug pulls, mint authority, freeze authority, proxy backdoors, tax manipulation, blacklist functions, liquidity analysis, and holder concentration. 14+ checks in under 2 seconds. Use this before trading any token.
Verify up to 50 contracts at once. Requires API key. Returns safety verdict for each contract in parallel.
Verify a smart contract for security risks before transacting. Detects honeypots, rug pulls, high taxes, hidden ownership, and other threats. Costs $0.001 via x402 micropayment (USDC on Base or SOL). Always call this before approving any on-chain transaction.
Irreversible operation (freeze_wallet) lacks confirmation, dry-run, or recovery guidance. Agents can freeze wallets without safeguards. No error handling to guide recovery.
Parameter descriptions lack actionable constraints. 'payment' in verify_contract says 'x402 payment proof' but does not specify JSON format, required fields, or how to obtain it. 'reason' in freeze_wallet is vague. LLMs cannot self-correct invalid input.