Loading ToolBench
Give an AI agent a real Solana wallet without giving it your money. The agent gets a spending allowance the SPL Token program enforces on-chain, plus guardrails (per-tx cap, daily cap, recipient and host allowlists, expiry, kill switch), x402 payments, and a one-call on-chain deploy. Custody never leaves your wallet: you can revoke or withdraw at any moment, and the agent can never spend past the delegated ceiling.
Strong tool definitions with clear naming (verb_noun pattern), comprehensive descriptions (avg 180 chars), and complete JSON Schema with types and descriptions for all parameters. All 14 tools are explicitly registered with proper schemas. Error handling is sophisticated, guardrail refusals include detailed reasoning (checks, policy, spendable, spent_24h fields). However, output schemas are not formally documented in the tool definitions, and some parameter descriptions could be more prescriptive about constraints (e.g., format validation for Solana addresses, token amounts). Security is well-designed (secrets injected via env, no credentials in params), and composition is clean (each tool has one responsibility). Naming is consistently strong: create_agent_wallet, fund_agent_wallet, approve_agent_allowance, agent_pay, pay_x402, withdraw_from_vault, revoke_agent_wallet, agent_wallet_status, list_agent_wallets, spend_log, deploy_agent_onchain, export_agent_runtime, send_signed_transaction. All descriptions explain WHAT, WHEN, and consequences (e.g., 'This REPLACES the existing allowance, it does not add to it').
The agent sends tokens to a recipient address, subject to guardrails and on-chain allowance. Shows a summary first; requires confirm:true to broadcast.
Read the live on-chain state of an agent's vault: balance, remaining allowance, spendable amount, 24-hour spend total, and the owner's guardrail policy.
Set how much the agent may spend from the vault, enforced by the SPL Token program. This REPLACES the existing allowance, it does not add to it: passing "50" leaves the agent with exactly 50 regardless of what it had before. Use it to raise, lower, or refill an allowance. Requires confirm:true to broadcast.
Create a new agent wallet with a vault account and initial allowance, all in one transaction.
Deploy an agent to the three.ws cross-chain agent deployment feed. The agent's keypair, vault address, and policy are registered so the agent can be discovered and funded on other chains.
Export an agent's keypair and vault address in a format suitable for embedding in another agent framework or runtime.
Output schemas not formally documented in tool definitions. While error responses are well-structured (checks, policy, spendable, spent_24h), success response schemas are not declared. LLMs cannot reliably plan downstream tool calls without knowing what fields to expect.
Parameter constraints not fully specified in descriptions. Solana addresses, token amounts, and timestamps lack format/pattern guidance. E.g., 'mint' parameter says 'SPL token mint address' but does not specify base58 format or length. LLMs may pass invalid values.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 57 | 2026-07-28+ | v2 |
Top up an agent's vault with more tokens from the owner's account.
List all agent wallets in the local state file, with their live on-chain balances, allowances, and policy summaries.
The agent fetches an x402-protected resource, paying the server's asking price from the vault. Guardrails apply: per-tx cap, daily cap, host allowlist, confirm-above threshold. Shows the cost and resource details first; requires confirm:true to pay and fetch.
The owner revokes the agent's spending allowance in one instruction. The vault and its balance remain; the agent simply cannot move anything. Requires confirm:true to broadcast.
Broadcast a transaction that a browser wallet (Phantom, Solflare, Backpack, Ledger) has already signed. Used in the non-custodial owner lane: the owner signs in their wallet, then this tool broadcasts it.
Set the owner's guardrail policy for an agent: per-transaction cap, rolling daily cap, recipient allowlist, x402 host allowlist, expiry timestamp, pause flag, and confirm-above threshold.
Query the append-only spend ledger for an agent: every allowed and denied spend attempt, with timestamps, amounts, reasons, and guardrail checks.
The owner withdraws tokens from an agent's vault back to their own account. Works regardless of what the agent is doing. Requires confirm:true to broadcast.
No pagination support documented for list_agent_wallets and spend_log. If an agent has many wallets or a long spend history, results could exceed context limits. spend_log accepts 'limit' but no cursor/offset for continuation.
Confirmation pattern (confirm:true) is present but not consistently documented as a safety mechanism. Descriptions mention 'requires confirm:true to broadcast' but do not explain that LLMs should always call with confirm:false first to preview, then confirm:true after user approval.
Error recovery guidance is strong for guardrail refusals but missing for network/RPC failures. Tools calling Solana RPC may timeout or fail with 'connection refused', no guidance on retry strategy or fallback RPC endpoints.