Skip to content

QuickBuild agent tools (x402)

by quickbuild.quynguyenbac.workers.dev · remote · no sign-in to list tools · v1.0.0 · published by dev.workers.quynguyenbac.quickbuild

Screenshot, TTS, image gen, translate, summarize, URL-to-Markdown, site audit. Pay per call (x402).

Final · 2Changes · 13

18 tools: 2 do something that can't be undone, 13 change things and 3 only read.

Scanned Oct 21, 2026

5 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http agent-tools https://quickbuild.quynguyenbac.workers.dev/mcp

Findings

Matches of fixed checks, with the text they matched.

5 warn
  • The server marks "translate" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The input addresses people (input.to): what it sends cannot be taken back.

    What this check looks for
  • The server marks "generate_image" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The name "generate_image" says "generate": a word for a change.

    What this check looks for
  • The input schema at properties.address.description contains a 42-character base64 string.

    Matched text

    inputSchema.properties.address.description: "...tional: defaults to 0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045 (vitalik.eth)."

    What this check looks for
  • The input schema at properties.address.description contains a 42-character base64 string.

    Matched text

    inputSchema.properties.address.description: "...l: defaults to USDC 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913."

    What this check looks for
  • The server marks "fx_rate" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The input addresses people (input.to): what it sends cannot be taken back.

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

18 tools

Can't be undone 2Claude Code: ask
  • fx_rate[PAID $0.002 USDC per call via x402 on Base; errors are free] Foreign-exchange rates from one base currency (`from`, default USD) to a list of currencies (`to`, comma-separated, or…1 finding

    Why it is in this group

    • The input addresses people (input.to): what it sends cannot be taken back.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "fx_rate" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The input addresses people (input.to): what it sends cannot be taken back.

      What this check looks for
    Description, as the server wrote it
    [PAID $0.002 USDC per call via x402 on Base; errors are free] Foreign-exchange rates from one base currency (`from`, default USD) to a list of currencies (`to`, comma-separated, or "all"; default 14 majors incl. EUR, GBP, JPY, CNY, INR, KRW, VND), with `amount` converted. Live mode uses Coinbase public exchange rates (updated about every minute, 160+ ISO 4217 currencies plus XAU/XAG), falling back to exchangerate-api daily rates. With `date=YYYY-MM-DD` it returns the ECB reference rates for that day (Frankfurter, ~30 major currencies, back to 1999-01-04). All params optional: with none it returns USD to 14 major currencies. Invalid codes = 400, never charged.

    Annotations the server declares

    • title: Fiat FX rates and conversion
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • translate[PAID $0.005 USDC per call via x402 on Base; errors are free] LLM translation (Meta Llama 4 Scout on Workers AI, M2M100 fallback).1 finding

    Why it is in this group

    • The input addresses people (input.to): what it sends cannot be taken back.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "translate" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The input addresses people (input.to): what it sends cannot be taken back.

      What this check looks for
    Description, as the server wrote it
    [PAID $0.005 USDC per call via x402 on Base; errors are free] LLM translation (Meta Llama 4 Scout on Workers AI, M2M100 fallback). Give `text`, or a `url` whose main content is extracted as Markdown and translated in blocks, preserving Markdown formatting, URLs and code blocks. Source language auto-detected (or set `from`). Up to 20,000 chars per call (default 8,000). All params optional: with none it translates a short Spanish sample to English. Languages: en,es,fr,de,it,pt,nl,ru,uk,pl,cs,ro,hu,el,bg,sv,da,no,fi,tr,ar,he,fa,hi,bn,ur,ta,zh,ja,ko,vi,th,id,ms,tl,sw.

    Annotations the server declares

    • title: Translate text or web page
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
Changes things 13Claude Code: ask
  • base_gas_price[PAID $0.001 USDC per call via x402 on Base; errors are free] Live gas snapshot for Base mainnet (chain 8453) read from public Base RPC: latest block number/time/utilization, base …No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    [PAID $0.001 USDC per call via x402 on Base; errors are free] Live gas snapshot for Base mainnet (chain 8453) read from public Base RPC: latest block number/time/utilization, base fee, eth_gasPrice, eth_maxPriorityFeePerGas, the last 10 blocks of base fees, slow/standard/fast EIP-1559 fee suggestions (10th/50th/90th percentile tips) in gwei and wei, and the estimated total cost (L2 execution + OP Stack L1 data-fee upper bound) of an ETH transfer, an ERC-20 transfer and a swap in ETH and USD (Chainlink ETH/USD on Base). No params. Cached 4 s. Errors are never charged.

    Annotations the server declares

    • title: Base gas price and tx cost
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • base_token_info[PAID $0.002 USDC per call via x402 on Base; errors are free] Inspect a token or any address on Base mainnet: contract vs EOA (incl.1 finding

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The input schema at properties.address.description contains a 42-character base64 string.

      Matched text

      inputSchema.properties.address.description: "...l: defaults to USDC 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913."

      What this check looks for
    Description, as the server wrote it
    [PAID $0.002 USDC per call via x402 on Base; errors are free] Inspect a token or any address on Base mainnet: contract vs EOA (incl. EIP-7702 delegation), bytecode size, ERC-20 name/symbol/decimals/totalSupply (raw and formatted; bytes32 symbols handled), proxy implementation (EIP-1967, beacon, ZeppelinOS/FiatToken), whether it is a well-known Base token (guards against spoofed symbols), and optionally the balance of `holder`. Read live from public Base RPC; metadata cached 1 h. All params optional: defaults to USDC on Base. Invalid input = 400, never charged.

    Annotations the server declares

    • title: Base ERC-20 token info
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • base_wallet_balances[PAID $0.002 USDC per call via x402 on Base; errors are free] Balances of one address on Base mainnet in a single call: native ETH, the well-known tokens USDC, USDT, USDbC, DAI, WE…1 finding

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The input schema at properties.address.description contains a 42-character base64 string.

      Matched text

      inputSchema.properties.address.description: "...tional: defaults to 0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045 (vitalik.eth)."

      What this check looks for
    Description, as the server wrote it
    [PAID $0.002 USDC per call via x402 on Base; errors are free] Balances of one address on Base mainnet in a single call: native ETH, the well-known tokens USDC, USDT, USDbC, DAI, WETH, cbETH, wstETH, AERO (non-zero only, or all with includeZero=true), plus up to 10 extra ERC-20 contracts you pass in `tokens` (symbol/name/decimals read on-chain). Also nonce, account type (EOA, EIP-7702 delegated EOA, or contract) and a USD total for ETH/WETH (Chainlink) and stablecoins. Read live from public Base RPC via Multicall3; cached 10 s. All params optional: defaults to a well-known public address. Invalid input = 400, never charged.

    Annotations the server declares

    • title: Base wallet balances (ETH + tokens)
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • crypto_price[PAID $0.001 USDC per call via x402 on Base; errors are free] Live crypto prices for up to 25 coins per call: pass tickers in `symbols` (BTC,ETH,SOL,AERO,...; common tickers built …No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    [PAID $0.001 USDC per call via x402 on Base; errors are free] Live crypto prices for up to 25 coins per call: pass tickers in `symbols` (BTC,ETH,SOL,AERO,...; common tickers built in, others resolved by CoinGecko search to the largest coin with that ticker), CoinGecko `ids`, or one token `address` + `chain` (base default; ethereum, arbitrum, optimism, polygon, bsc, avalanche, solana). Returns price, market cap, 24h volume and 24h % change in each `vs` currency (usd default; up to 5, e.g. usd,eur,btc) plus last-updated time. Data: CoinGecko public API, cached 30 s; falls back to Coinbase spot rates (price only) if CoinGecko is unavailable. All params optional: with none it returns BTC and ETH in USD. Unknown coins = 404, invalid input = 400, never charged.

    Annotations the server declares

    • title: Crypto prices (ticker, id or contract)
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • free_site_check[FREE, 10 calls/hour per IP] Quick check of one public website: homepage meta/OG/canonical, security headers, HTTPS, and up to 20 links tested for breakage.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    [FREE, 10 calls/hour per IP] Quick check of one public website: homepage meta/OG/canonical, security headers, HTTPS, and up to 20 links tested for breakage. For the deeper 3-page audit with leaked-key scan use website_audit (paid).

    Annotations the server declares

    • title: Free quick website check
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • generate_image[PAID $0.01 USDC per call via x402 on Base; errors are free] Generate an original 1024x1024 image from a text prompt with FLUX.1 [schnell] on Workers AI (about 2-5 s).1 finding

    Why it is in this group

    • The name "generate_image" says "generate": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "generate_image" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The name "generate_image" says "generate": a word for a change.

      What this check looks for
    Description, as the server wrote it
    [PAID $0.01 USDC per call via x402 on Base; errors are free] Generate an original 1024x1024 image from a text prompt with FLUX.1 [schnell] on Workers AI (about 2-5 s). Returns JSON with image_base64 + mimeType, or the raw image bytes with format=jpeg. Content policy: no sexual/nude, gore, hate, real or famous people, or ID documents/currency; such prompts get HTTP 400 and are not charged. All params optional: with no prompt a sample watercolor lighthouse is drawn.

    Annotations the server declares

    • title: Generate image (FLUX.1 schnell)
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • llm_chat[PAID $0.003 USDC per call via x402 on Base; errors are free] One-shot LLM completion on Cloudflare Workers AI with a minimal interface: give `prompt` (and optionally `system`, or …No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    [PAID $0.003 USDC per call via x402 on Base; errors are free] One-shot LLM completion on Cloudflare Workers AI with a minimal interface: give `prompt` (and optionally `system`, or OpenAI-style `messages`), get {text, model, finish_reason, usage}. Models: llama-3.1-8b (default), llama-3.2-3b, llama-3.2-1b, mistral-7b, granite-4.0-micro. max_tokens capped at 512, input up to 24000 chars, Llama Guard 3 safety check, 503 "capacity" when the daily budget is used up. Errors are never charged. All params optional: with none it answers a short sample question. For the OpenAI wire format use POST /v1/chat/completions.

    Annotations the server declares

    • title: LLM chat completion (Llama 3.1 8B default)
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • page_metadata[PAID $0.005 USDC per call via x402 on Base; errors are free] Fetch one public web page and return structured metadata: title, meta description, canonical, lang, robots, Open Graph…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    [PAID $0.005 USDC per call via x402 on Base; errors are free] Fetch one public web page and return structured metadata: title, meta description, canonical, lang, robots, Open Graph and Twitter card tags, favicon, RSS/Atom feeds, JSON-LD @types, and internal/external links (up to 100 each). Good for link previews, unfurling and quick site triage.

    Annotations the server declares

    • title: Page metadata / link preview
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • rerank_documents[PAID $0.002 USDC per call via x402 on Base; errors are free] Cohere/Jina-style rerank: POST {query, documents: string[] | {text}[], top_n, return_documents} and get {results: [{in…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    [PAID $0.002 USDC per call via x402 on Base; errors are free] Cohere/Jina-style rerank: POST {query, documents: string[] | {text}[], top_n, return_documents} and get {results: [{index, relevance_score, document?}]} sorted by relevance. Models (Cloudflare Workers AI): bge-reranker-base (cross-encoder, English/Chinese, scores 0..1); bge-m3 (multilingual similarity scoring) (default bge-reranker-base; other names map to it). Up to 100 documents, each scored on its first 4000 chars; one fixed price per call. Use after vector search to pick the best passages for an LLM. Errors are never charged. All params optional: with none it ranks a small sample.

    Annotations the server declares

    • title: Rerank documents for a query
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • text_embeddings[PAID $0.001 USDC per call via x402 on Base; errors are free] Drop-in OpenAI Embeddings endpoint: POST {input: string | string[], model, encoding_format: float|base64, dimensions} …No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    [PAID $0.001 USDC per call via x402 on Base; errors are free] Drop-in OpenAI Embeddings endpoint: POST {input: string | string[], model, encoding_format: float|base64, dimensions} and get {object: "list", data: [{embedding, index}], model, usage}. Models (Cloudflare Workers AI): bge-m3 (1024-d, multilingual (100+ languages), 8192-token context); bge-large-en-v1.5 (1024-d, English); bge-base-en-v1.5 (768-d, English); bge-small-en-v1.5 (384-d, English, fastest); embeddinggemma-300m (768-d, multilingual (Google EmbeddingGemma)). Any other model name (e.g. text-embedding-3-small) maps to bge-m3; the actual model is in the response. `dimensions` truncates and re-normalizes. Up to 100 inputs per call, 8000 chars each, 60000 chars total, one fixed price per call. For RAG, semantic search, clustering and dedupe. Errors are never charged. GET ?input= also works; with no params it embeds a sample sentence.

    Annotations the server declares

    • title: Text embeddings (bge-m3, OpenAI format)
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • text_to_speech[PAID $0.005 USDC per call via x402 on Base; errors are free] Turn text (up to 2000 chars) into spoken audio with MeloTTS on Cloudflare Workers AI, in English, Spanish, French, Chi…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    [PAID $0.005 USDC per call via x402 on Base; errors are free] Turn text (up to 2000 chars) into spoken audio with MeloTTS on Cloudflare Workers AI, in English, Spanish, French, Chinese, Japanese or Korean. Returns JSON with audio_base64 + mimeType (audio/wav, 44.1 kHz mono), or the raw audio bytes with format=wav. Good for voice replies, narration, accessibility and language practice. Text with sexual, hateful or violent content is refused (HTTP 400, not charged). All params optional: with none it speaks a short English sample. GET with query params or POST a JSON body.

    Annotations the server declares

    • title: Text to speech (WAV)
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • url_to_markdown[PAID $0.005 USDC per call via x402 on Base; errors are free] Fetch one public web page and return its main content (article/main/body, scripts/nav/footer stripped) as clean Markdo…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    [PAID $0.005 USDC per call via x402 on Base; errors are free] Fetch one public web page and return its main content (article/main/body, scripts/nav/footer stripped) as clean Markdown with absolute links, plus title and length. Up to 2 MB HTML, 10 s timeout; optional maxChars (default 50000, max 200000).

    Annotations the server declares

    • title: URL to Markdown
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • website_audit[PAID $0.05 USDC per call via x402 on Base; errors are free] Pre-launch website audit: up to 3 pages crawled, 30 links checked, meta/OG/canonical, security headers, HTTPS, 404 hand…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    [PAID $0.05 USDC per call via x402 on Base; errors are free] Pre-launch website audit: up to 3 pages crawled, 30 links checked, meta/OG/canonical, security headers, HTTPS, 404 handling, sitemap, and leaked-secret patterns in client JS (masked). Read-only.

    Annotations the server declares

    • title: Website pre-launch audit
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
Only reads 3Claude Code: allow
  • base_tx_status[PAID $0.002 USDC per call via x402 on Base; errors are free] Look up one transaction on Base mainnet by hash: status (success, failed or pending), block, timestamp, confirmations,…No findings

    Why it is in this group

    • The name "base_tx_status" says "status": a word for reading.
    Description, as the server wrote it
    [PAID $0.002 USDC per call via x402 on Base; errors are free] Look up one transaction on Base mainnet by hash: status (success, failed or pending), block, timestamp, confirmations, from/to, value, method id, gas used, effective gas price, fee split into L2 execution and L1 data fee (ETH and USD), contract created, and decoded ERC-20 Transfer events (token, symbol, from, to, amount; up to 20). Useful to confirm a payment landed. Read live from public Base RPC. All params optional: defaults to a confirmed USDC x402 payment. Unknown hash = 404, invalid hash = 400, never charged.

    Annotations the server declares

    • title: Base transaction status
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • screenshot_url[PAID $0.008 USDC per call via x402 on Base; errors are free] Render a public web page in a real headless Chrome (JavaScript executed, waits for network idle) and return a screensh…No findings

    Why it is in this group

    • The name "screenshot_url" says "screenshot": a word for reading.
    Description, as the server wrote it
    [PAID $0.008 USDC per call via x402 on Base; errors are free] Render a public web page in a real headless Chrome (JavaScript executed, waits for network idle) and return a screenshot: viewport (default 1280x800) or full page (up to 8000 px tall), PNG or JPEG, optional dark mode and extra wait. JSON with image_base64 + finalUrl/status/title, or raw image bytes with format=png|jpeg. Typically 2-6 s (up to ~25 s when busy). Use it for visual QA, link previews, archiving, checking what a page really shows, or feeding a vision model. Adult/malware domains (Cloudflare family DNS) and private addresses are refused. All params optional: with none it captures https://example.com. Errors are never charged.

    Annotations the server declares

    • title: Screenshot a URL (headless Chrome)
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • summarize[PAID $0.02 USDC per call via x402 on Base; errors are free] Fetch a public web page (or take raw text) and return a structured JSON brief made by Llama 3.3 70B: title, language, c…No findings

    Why it is in this group

    • The name "summarize" says "summarize": a word for reading.
    Description, as the server wrote it
    [PAID $0.02 USDC per call via x402 on Base; errors are free] Fetch a public web page (or take raw text) and return a structured JSON brief made by Llama 3.3 70B: title, language, contentType, summary, keyPoints, named entities with types, topic tags, concrete facts (prices, dates, versions, limits) as label/value pairs, sentiment and audience. Grounded in the page only, no invented facts. Reads up to 24,000 chars of main content (2 MB HTML, 10 s fetch timeout). All params optional: with none it summarizes https://example.com. GET with query params, or POST a JSON body for long text (up to 200,000 chars accepted, first 24,000 analyzed).

    Annotations the server declares

    • title: Summarize URL or text to JSON brief
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http agent-tools https://quickbuild.quynguyenbac.workers.dev/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__agent-tools__summarize",
      "mcp__agent-tools__screenshot_url",
      "mcp__agent-tools__base_tx_status"
    ],
    "ask": [
      "mcp__agent-tools__website_audit",
      "mcp__agent-tools__page_metadata",
      "mcp__agent-tools__url_to_markdown",
      "mcp__agent-tools__translate",
      "mcp__agent-tools__generate_image",
      "mcp__agent-tools__text_to_speech",
      "mcp__agent-tools__base_gas_price",
      "mcp__agent-tools__base_wallet_balances",
      "mcp__agent-tools__base_token_info",
      "mcp__agent-tools__llm_chat",
      "mcp__agent-tools__text_embeddings",
      "mcp__agent-tools__rerank_documents",
      "mcp__agent-tools__crypto_price",
      "mcp__agent-tools__fx_rate",
      "mcp__agent-tools__free_site_check"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as agent-tools. Review it before you use it.