Signer MCP vs Trust Tools

T

get_verified_price

Read a Uniswap V3 token price from The Graph and return it ONLY if four checks pass: the indexer signed the exact bytes that arrived, that signer resolves on chain to an indexer with stake, the reading is a usable price (a verified signature over a GraphQL error or a zero is not a price), and the price's own age is measured apart from the subgraph head's age — a head can be fresh while the price it carries is a year old. On refusal no price is returned and the answer names both the check that stopped it (`stage`) and that check's own reason (`cause`): `price_absent_or_zero`, `graphql_errors` and `price_stale` are three different problems with three different fixes. Costs one cent in USDC on Base per query and needs X402_PRIVATE_KEY set; without that key it refuses `no_payer_key` and spends nothing. Name the token by `token_address` when you can: a ticker is not a key, and this subgraph holds several tokens called WETH. With neither address nor ticker it returns the most recently priced tokens, filtered to those that actually carry a price. Runs OUTSIDE the enclave.

list_venues

List the venues this Signer can sign trades for. Returns the venue id, asset class (perp / spot / margin), and auth scheme (hmac / eip712 / ed25519). Read-only static manifest — does NOT need the Signer gateway to be reachable. Call this first to discover what's signable.

get_attestation

Fetch the Signer enclave's AWS Nitro attestation document with a FRESH NONCE and verify it locally, with no dependencies and no trust in this tool's own summary. Five named checks are returned and any of them can fail: the document decodes as a COSE_Sign1 (document_readable), the nonce inside it is the one just sent (nonce_echoed), its root certificate is the pinned AWS Nitro root (root_pinned), the certificate chain leads to that root (chain_verified), and the hardware signature covers these exact bytes (signature_verified). PCR0/PCR1/PCR2 are read out of the SIGNED bytes, not from a field beside them. WHAT THIS DOES NOT ESTABLISH: that PCR0 corresponds to the published source — rebuild the image from the public clone and compare, or query the on-chain PCR0 registry; and nothing about any past signature, since an attestation speaks about the code that answered this request. If any check is false, treat the document as no evidence rather than weak evidence.