Loading ToolBench
Secure MCP implementation for Squads multisig management on Solana blockchain
Server has 20 tools with consistent naming (verb_noun pattern) and descriptions present for all. However, schemas are incomplete: many tools lack visible input parameter type definitions in the source code provided. Parameter descriptions exist but are often generic or security-focused rather than operationally clear. Output schemas are not documented. Error handling is present but minimal, most errors return generic messages without recovery guidance. Security descriptions are strong (e.g., 'SECURITY: Double-check this address') but this inflates description length without improving LLM usability. Composition is good: tools are single-purpose and chainable (e.g., CREATE_PROPOSAL → APPROVE_PROPOSAL → EXECUTE). No secrets exposed as parameters.
Approve a proposal for a Squads multisig transaction. Member must have 'Voter' permissions. SECURITY: Always verify the proposal details and transaction index before approving. Use a secure device and follow the two-minute rule for approvals.
Evaluate a multisig's security against Squads best practices. SECURITY: Use this tool regularly to ensure your configuration remains safe as your team and requirements evolve.
Cancel a proposal for a Squads multisig transaction. Member must have 'Voter' permissions. SECURITY: Always verify the proposal details and transaction index before cancelling. Use a secure device and confirm the action with your team if possible.
Set the Solana connection by cluster name (devnet, testnet, mainnet) or a custom rpcEndpoint URL.
Create a config transaction for a Squads multisig. Supports actions: AddMember, RemoveMember, ChangeThreshold, SetTimeLock, AddSpendingLimit, RemoveSpendingLimit, SetRentCollector.
Missing input schemas for 8 tools (RESET_CONFIG, IMPORT_SQUADS_MULTISIG, REJECT_PROPOSAL, GET_MULTISIG_ACCOUNT, TRANSFER_SOL_FROM_VAULT, GET_PROPOSALS, GET_PROPOSAL, GET_ASSETS). Source code shows only tool name and description; no visible schema registration or parameter definitions.
No output schemas documented for any tool. LLMs cannot predict response structure, forcing them to guess at field names for downstream tool chaining. E.g., does GET_MULTISIG_ACCOUNT return 'multisig_address' or 'address'?
Generic error handling. approveProposal.ts returns 'Failed to approve proposal' with only e?.message appended. No guidance on retryability, user-fixable vs. fatal, or recovery steps. LLM cannot determine next action.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 61 | 2026-07-28+ | v2 |
Create a proposal for a Squads multisig transaction. Proposals are required for voting and execution. SECURITY: Always verify the transaction index and proposal details. Use a secure device to create proposals for critical actions.
Create a squads multisig account on Solana blockchain. Expects a name, list of owner addresses, threshold, and permissions. SECURITY: For critical treasuries or upgrades, use 6+ members, 4/6+ threshold, time locks, and avoid ALL permissions for any single user.
Execute a config transaction for a Squads multisig. Member must have 'Executor' permissions and the proposal must be approved. SECURITY: Always verify the transaction index and proposal details before executing. Wait at least 2 minutes after approval for critical actions.
Execute an approved vault transaction for a Squads multisig. Member must have 'Executor' permissions and the proposal must be approved. SECURITY: Always verify the transaction index and proposal details before executing. Wait at least 2 minutes after approval for critical actions.
To fund a multisig, we fund the multisig's vault. SECURITY: For large amounts, use a hardware wallet and verify the destination address. This is a development tool, not for production treasury management.
Retrieve assets held in a Squads multisig vault.
Retrieve details of a Squads multisig account.
Retrieve details of a specific proposal for a Squads multisig.
Retrieve all proposals for a Squads multisig.
Import an existing Squads multisig account by address.
Reject a proposal for a Squads multisig transaction. Member must have 'Voter' permissions.
Resets the config to default values.
Displays the current configuration, wallet balance, and active Squads multisig address.
Transfer SOL from a Squads multisig vault.
Import a wallet private key (bs58 or Uint8Array format) into the config.
Security warnings dominate descriptions (e.g., 'SECURITY: Double-check this address before approving'). While well-intentioned, these inflate description length and reduce clarity on WHAT the tool does vs. HOW to use it safely. Descriptions should lead with function, not warnings.
No confirmation or dry-run pattern for irreversible operations (CREATE_SQUADS_MULTISIG, EXECUTE_CONFIG_TRANSACTION, TRANSFER_SOL_FROM_VAULT). Agents can trigger destructive actions without a safety gate.