Skip to main content
Glama

Verify SIWE signature and get a JWT

submit_auth_verify

Exchange a signed SIWE challenge message (from get_auth_challenge) for a JWT scoped to that wallet. The returned jwt must be passed explicitly as the jwt argument to submit_deposit/submit_withdrawal/submit_config for that same wallet — this server does not cache or store it. The JWT is only valid for the walletAddress that produced the signature; using it for a different wallet's write call will be rejected upstream. Reuse the same jwt for subsequent write calls to this wallet instead of re-authenticating every time — the response's expiresAt (decoded from the JWT's own exp claim) says how long it's good for. Rate limited to 5 calls/minute per caller, no more than one call every 12s.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
chainNoChain name, e.g. BASE, ETHEREUM, POLYGON. Defaults to ETHEREUM if omitted. For an EOA wallet this is irrelevant (signature recovery is chain-agnostic). For a smart-contract wallet, this MUST be the chain it has (or, if undeployed, would have via ERC-6492 counterfactual deployment) a valid signer on for this signature — it determines which chain's RPC is queried to validate it (ERC-1271/6492), and does not need to match the chain passed to get_auth_challenge.
signatureYespersonal_sign signature of the SIWE message from get_auth_challenge.
walletAddressYesEVM wallet address (0x-prefixed, 40 hex chars). Any casing is accepted — it is normalized to its EIP-55 checksum before being forwarded upstream.

Schema Changelog

Changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. First observed

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations only indicate non-read-only and non-destructive; the description carries the behavioral detail. It discloses that the server does not cache or store the JWT, that the JWT is wallet-scoped, that expiration comes from the JWT's exp claim, and that the endpoint is rate limited to 5 calls/minute with a 12s minimum interval. This goes well beyond the structured annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four dense sentences, each earning its place: the exchange purpose, downstream consumption requirement, wallet-scoping constraint, and rate-limiting constraint. The most operationally important details are front-loaded after a one-sentence purpose, with no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description still names the key return values (jwt and expiresAt) and explains how to consume and reuse them. It also covers relevant failure modes and rate limits, making the tool safely callable with just the provided description and schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already documents all three parameters at 100% coverage, including chain behavior, address normalization, and signature type. The description reinforces wallet scoping and signature origin but adds no new field-level semantics beyond the schema. A baseline 3 is appropriate because the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific exchange: a signed SIWE challenge message from get_auth_challenge is turned into a JWT scoped to a wallet. This clearly differentiates it from the sibling get_auth_challenge, which produces the challenge rather than consuming the signature.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly tells the agent to pass the returned jwt to submit_deposit/submit_withdrawal/submit_config, to reuse the same jwt, and that using it for a different wallet will be rejected upstream. It also states the rate limit, so an agent knows when calls may fail. This is direct, actionable usage guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A4.5/5.0
Disambiguation5/5

Every tool maps to a distinct resource or lifecycle stage: get_config vs get_default_config, get_balances vs get_bridge_balances, and prepare_* vs submit_* vs status pollers are all clearly separated. Cross-references explicitly tell agents which tool NOT to use, eliminating ambiguity.

Naming Consistency5/5

All tools use snake_case with a consistent verb_noun pattern: get_* for reads, list_pools for catalog lookup, prepare_* for unsigned payloads, and submit_* for signed writes. There are no mixed conventions or vague verbs.

Tool Count4/5

19 tools is above the typical 3-15 range, but the count is justified by the protocol's surface area: auth, config, deposits, withdrawals, balances, pools, rewards, and metadata each earn their place. It is slightly heavy but not bloated.

Completeness4/5

The set covers the main lifecycle well: auth, config read/default/prepare/submit, deposit and withdrawal prepare/submit/status, balances, pools, rewards, costs, and token metadata. Minor gaps exist, such as no pre-flight check for in-progress rebalances (causing 409s) and no reward claim broadcast, but these are workarroundable via documented retry behavior and externally broadcastable claim transactions.

Resources