Skip to main content
Glama

Get SIWE auth challenge

get_auth_challenge

Get a Sign-In-With-Ethereum challenge message for a wallet, required before any deposit/withdrawal/config-update tool. The returned message must be signed with personal_sign (EIP-191) by the wallet's own signer, then passed to submit_auth_verify. Does NOT itself authenticate anything — it only issues the message to sign. Repeated calls for the same walletAddress within a short window (a few minutes) return the SAME message rather than a fresh one — the backend only keeps one pending challenge per wallet at a time, and generating a new one would invalidate whatever an earlier caller is about to sign, so this is deliberate, not a caching bug. chain does not affect which cached message you get back. Rate limited to 10 calls/minute per caller, no more than one call every 6s.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
chainNoChain name, e.g. BASE, ETHEREUM, POLYGON. Defaults to ETHEREUM if omitted. Cosmetic only — shown as the 'Chain ID:' line in the SIWE message text, does not need to match the chain passed to submit_auth_verify.
walletAddressYesEVM wallet address (0x-prefixed, 40 hex chars). Any casing is accepted — it is normalized to its EIP-55 checksum before being forwarded upstream.

Schema Changelog

Changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. First observed

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds substantial behavioral context beyond the annotations, including the deliberate caching behavior for repeated walletAddress calls, the one-pending-challenge-per-wallet invalidation effect, the cosmetic nature of chain, and the rate limits. This is exactly the kind of non-obvious runtime behavior an agent needs to avoid misinterpreting repeated same-message responses as a bug.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but every sentence carries essential information: purpose, prerequisite role, signing flow, non-authentication clarification, idempotent caching semantics, chain behavior, and rate limits. It is front-loaded with the core purpose and then layers critical caveats without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's central role in an authentication precondition flow, the description covers all invocations-critical facts: what to do with the returned message, how to proceed next, the caching behavior that could otherwise confuse agents, rate limiting, and parameter nuances. The lack of an output schema is mitigated because the description clearly references the returned message and its intended use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema already documents both parameters. The description adds meaningful extra nuance: chain is cosmetic and need not match the chain passed to submit_auth_verify, and walletAddress casing is normalized to EIP-55. This goes beyond the baseline schema descriptions and helps the agent use the parameters correctly.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the specific action: obtaining a Sign-In-With-Ethereum challenge message for a wallet. It also differentiates itself from submit_auth_verify by explicitly noting that this tool does NOT authenticate and only issues the message to sign, making its role unmistakable among the sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit when-to-use guidance: it is required before any deposit/withdrawal/config-update tool. It also explains the exact follow-up flow—sign the message with personal_sign and pass it to submit_auth_verify—and clarifies that the tool itself does not perform authentication, so an agent knows not to treat it as the final auth step.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A4.5/5.0
Disambiguation5/5

Every tool maps to a distinct resource or lifecycle stage: get_config vs get_default_config, get_balances vs get_bridge_balances, and prepare_* vs submit_* vs status pollers are all clearly separated. Cross-references explicitly tell agents which tool NOT to use, eliminating ambiguity.

Naming Consistency5/5

All tools use snake_case with a consistent verb_noun pattern: get_* for reads, list_pools for catalog lookup, prepare_* for unsigned payloads, and submit_* for signed writes. There are no mixed conventions or vague verbs.

Tool Count4/5

19 tools is above the typical 3-15 range, but the count is justified by the protocol's surface area: auth, config, deposits, withdrawals, balances, pools, rewards, and metadata each earn their place. It is slightly heavy but not bloated.

Completeness4/5

The set covers the main lifecycle well: auth, config read/default/prepare/submit, deposit and withdrawal prepare/submit/status, balances, pools, rewards, costs, and token metadata. Minor gaps exist, such as no pre-flight check for in-progress rebalances (causing 409s) and no reward claim broadcast, but these are workarroundable via documented retry behavior and externally broadcastable claim transactions.

Resources