COTI MCP Server MCP Policy

version: "1"
description: "Policy for davibauer/coti-mcp"
# Set to "deny" to reject tool calls not listed below
default: "allow"

tools:
    # -- Financial Tools ----------------------------------------
    # transfer_native: Transfer native COTI tokens to another wallet. This is used for sending COTI tokens from your wallet to another address. Requires private key, recipient address, and amount in Wei as input. The AI assistant should track and pass the account private key from context. Returns the transaction hash upon successful transfer.
    transfer_native:
        rules:
          - action: deny
            on_deny: "Financial operation requires approval"
    # transfer_private_erc20: Transfer private ERC20 tokens on the COTI blockchain. This is used for sending private tokens from your wallet to another address. Requires token contract address, recipient address, and amount as input. Returns the transaction hash upon successful transfer.
    transfer_private_erc20:
        rules:
          - action: deny
            on_deny: "Financial operation requires approval"
    # transfer_private_erc721: Transfer a private ERC721 NFT token on the COTI blockchain. This is used for sending a private NFT from your wallet to another address. Requires token contract address, recipient address, and token ID as input. Returns the transaction hash upon successful transfer.
    transfer_private_erc721:
        rules:
          - action: deny
            on_deny: "Financial operation requires approval"

    # -- Execute Tools ----------------------------------------
    # compile_and_deploy_contract: Compiles Solidity source code and immediately deploys it to the COTI blockchain in a single operation. This tool avoids bytecode truncation issues that can occur when passing large bytecode strings between tools. Accepts full Solidity source code, compiles it, and deploys the result. Returns the contract address, transaction hash, and ABI (for future interactions). This is the recommended tool for most deployment scenarios.
    compile_and_deploy_contract:
        rules:
          - action: allow
            rate_limit: 10/hour
            validate:
              required_args: true
    # compile_contract: Compiles Solidity source code without deploying it to the blockchain. Returns bytecode, ABI, and compilation metadata (compiler version, EVM version, optimization settings). Useful for: - Testing that a contract compiles without errors - Getting the ABI for contract interaction - Analyzing bytecode size and structure - Preparing compilation metadata for later deployment or verification - Debugging compilation issues in isolation
    compile_contract:
        rules:
          - action: allow
            rate_limit: 10/hour
            validate:
              required_args: true
    # deploy_private_erc20_contract: Deploy a new standard private ERC20 token contract on the COTI blockchain. This creates a new private token with the specified name, symbol, and decimals. Returns the deployed contract address upon successful deployment.
    deploy_private_erc20_contract:
        rules:
          - action: allow
            rate_limit: 10/hour
            validate:
              required_args: true
    # deploy_private_erc721_contract: Deploy a new standard private ERC721 NFT contract on the COTI blockchain. This creates a new private NFT collection with the specified name and symbol. Returns the deployed contract address upon successful deployment.
    deploy_private_erc721_contract:
        rules:
          - action: allow
            rate_limit: 10/hour
            validate:
              required_args: true
    # deploy_private_message_contract: Deploys the PrivateMessage contract on the COTI blockchain. This contract allows sending encrypted messages to specific addresses. Only the intended recipient can decrypt a message using their own AES key. Returns the contract address and ABI needed for send_private_message and read_private_message.
    deploy_private_message_contract:
        rules:
          - action: allow
            rate_limit: 10/hour
            validate:
              required_args: true

    # -- Write Tools ----------------------------------------
    # approve_erc20_spender: Approve another address to spend tokens on behalf of the owner. This is used for allowing another address (like a contract) to transfer your tokens. Requires token contract address, spender address, and amount as input. Returns the transaction hash upon successful approval.
    approve_erc20_spender:
        rules:
          - action: allow
            rate_limit: 30/hour
    # approve_private_erc721: Approve an address to transfer a specific private ERC721 NFT token on the COTI blockchain. This allows the approved address to transfer the specified NFT on behalf of the owner. Requires token contract address, token ID, and spender address as input. Returns the transaction hash upon successful approval.
    approve_private_erc721:
        rules:
          - action: allow
            rate_limit: 30/hour
    # call_contract_function: Call any function on a smart contract on the COTI blockchain. Supports both read-only (view/pure) functions and state-changing (write) functions. Read-only functions return data without creating a transaction. State-changing functions create transactions and may require gas_limit. Returns the function result in a human-readable format.
    call_contract_function:
        rules:
          - action: allow
            rate_limit: 30/hour
    # create_account: Create a new COTI account with a randomly generated private key and AES key. Returns the new account details for the AI assistant to track in conversation context. The AI should remember these credentials for use in subsequent operations.
    create_account:
        rules:
          - action: allow
            rate_limit: 30/hour
    # generate_aes_key: Generate or recover an AES key for a COTI account. Requires the account to be funded. The AI assistant should track the returned AES key for use in private transactions.
    generate_aes_key:
        rules:
          - action: allow
            rate_limit: 30/hour
    # import_account_from_private_key: Import a COTI account using only a private key. The public key will be derived automatically, and the AES key placeholder will be set (fund the account to generate a real AES key).
    import_account_from_private_key:
        rules:
          - action: allow
            rate_limit: 30/hour
    # send_private_message: Send an encrypted message to a specific recipient address on a deployed PrivateMessage contract. The message is encrypted using COTI MPC so only the recipient can decrypt it with their own AES key. Requires the contract address and ABI returned by deploy_private_message_contract.
    send_private_message:
        rules:
          - action: allow
            rate_limit: 30/hour
    # set_private_erc721_approval_for_all: Approve or revoke an operator to transfer all private ERC721 NFT tokens on the COTI blockchain. This allows the operator to transfer any NFT owned by the caller in this collection. Requires token contract address, operator address, and approval status as input. Returns the transaction hash upon successful approval setting.
    set_private_erc721_approval_for_all:
        rules:
          - action: allow
            rate_limit: 30/hour
    # switch_network: Switch between COTI testnet and mainnet networks. The AI assistant should remember this network selection and pass it to subsequent blockchain operations. Returns the new network to be tracked by the AI.
    switch_network:
        rules:
          - action: allow
            rate_limit: 30/hour

    # -- Read Tools ----------------------------------------
    # decode_event_data: Decode event data from a transaction log based on the event signature. This helps interpret the raw data in transaction logs by matching the event signature to known event types and decoding the parameters. Requires event signature, topics, and data from a transaction log.
    decode_event_data:
        rules:
          - action: allow
            rate_limit: 60/minute
    # decrypt_message: Decrypt a message that was encrypted using encrypt_message. Requires the same AES key used to encrypt, the ciphertext, and the random factor (r) — both as hex strings.
    decrypt_message:
        rules:
          - action: allow
            rate_limit: 60/minute
    # decrypt_value: Decrypt a value using a COTI AES key. The AI assistant should pass the private key from context. Returns the decrypted value.
    decrypt_value:
        rules:
          - action: allow
            rate_limit: 60/minute
    # encrypt_message: Encrypt a plain text message using a COTI AES key. Unlike encrypt_value, this does not require a contract address or function selector. Returns the ciphertext and a random factor (r) both as hex strings, which are needed to decrypt the message later.
    encrypt_message:
        rules:
          - action: allow
            rate_limit: 60/minute
    # encrypt_value: Encrypt a value using a COTI AES key. This is used for encrypting values to be sent to another address for private transactions. The AI assistant should pass the private key from context. Returns the encrypted value.
    encrypt_value:
        rules:
          - action: allow
            rate_limit: 60/minute
    # get_current_network: Get the currently configured COTI network (testnet or mainnet). The AI assistant should track and pass the current network context. If no network is provided, defaults to testnet.
    get_current_network:
        rules:
          - action: allow
            rate_limit: 60/minute
    # get_current_rpc: Get the RPC URL for the specified COTI network (testnet or mainnet). Returns the RPC endpoint currently being used for blockchain interactions.
    get_current_rpc:
        rules:
          - action: allow
            rate_limit: 60/minute
    # get_native_balance: Get the native COTI token balance of a COTI blockchain account. This is used for checking the current balance of a COTI account. Returns the account balance in COTI tokens.
    get_native_balance:
        rules:
          - action: allow
            rate_limit: 60/minute
    # get_private_erc20_allowance: Check how many tokens a spender is allowed to use. This is used for checking the current allowance a spender has for an owner's tokens. Requires token contract address, owner address, and spender address as input. Returns the allowance amount.
    get_private_erc20_allowance:
        rules:
          - action: allow
            rate_limit: 60/minute
    # get_private_erc20_balance: Get the balance of a private ERC20 token on the COTI blockchain. This is used for checking the current balance of a private token for a COTI account. Requires a COTI account address and token contract address as input. Returns the decrypted token balance.
    get_private_erc20_balance:
        rules:
          - action: allow
            rate_limit: 60/minute
    # get_private_erc20_decimals: Get the number of decimals for a private ERC20 token on the COTI blockchain. This is used for checking the number of decimals in this token. Requires token contract address as input. Returns the number of decimals in this contract.
    get_private_erc20_decimals:
        rules:
          - action: allow
            rate_limit: 60/minute
    # get_private_erc20_total_supply: Get the total supply of tokens for a private ERC20 token on the COTI blockchain. This is used for checking how many tokens have been minted in this token. Requires token contract address as input. Returns the total number of tokens in this contract.
    get_private_erc20_total_supply:
        rules:
          - action: allow
            rate_limit: 60/minute
    # get_private_erc721_approved: Get the approved address for a private ERC721 NFT token on the COTI blockchain. This is used for checking which address is currently approved to transfer a specific NFT. Requires token contract address and token ID as input. Returns the address that is approved to transfer the specified NFT.
    get_private_erc721_approved:
        rules:
          - action: allow
            rate_limit: 60/minute
    # get_private_erc721_balance: Get the balance of a private ERC721 NFT collection on the COTI blockchain. This is used for checking how many NFTs an address owns in a collection. Requires token contract address and account address as input. Returns the number of NFTs owned by the specified address.
    get_private_erc721_balance:
        rules:
          - action: allow
            rate_limit: 60/minute
    # get_private_erc721_is_approved_for_all: Check if an operator is approved to transfer all private ERC721 NFT tokens on the COTI blockchain. This is used for checking if an operator has been granted approval to manage all NFTs owned by an address. Requires token contract address, owner address, and operator address as input. Returns whether the operator is approved for all NFTs.
    get_private_erc721_is_approved_for_all:
        rules:
          - action: allow
            rate_limit: 60/minute
    # get_private_erc721_token_owner: Get the owner address of a private ERC721 NFT token on the COTI blockchain. This is used for checking who currently owns a specific NFT. Requires token contract address and token ID as input. Returns the owner's address of the specified NFT.
    get_private_erc721_token_owner:
        rules:
          - action: allow
            rate_limit: 60/minute
    # get_private_erc721_token_uri: Get the tokenURI for a private ERC721 NFT token on the COTI blockchain. This is used for retrieving the metadata URI of a private NFT. Requires token contract address and token ID as input. Returns the decrypted tokenURI.
    get_private_erc721_token_uri:
        rules:
          - action: allow
            rate_limit: 60/minute
    # get_private_erc721_total_supply: Get the total supply of tokens for a private ERC721 NFT collection on the COTI blockchain. This is used for checking how many NFTs have been minted in a collection. Requires token contract address as input. Returns the total number of tokens in the collection.
    get_private_erc721_total_supply:
        rules:
          - action: allow
            rate_limit: 60/minute
    # get_private_message_count: Returns the number of private messages sent to you by a specific sender on a deployed PrivateMessage contract. Use this to know how many messages are available before calling read_private_message.
    get_private_message_count:
        rules:
          - action: allow
            rate_limit: 60/minute
    # get_private_message_senders: Returns the list of all wallet addresses that have sent you at least one private message on a deployed PrivateMessage contract. Use this to discover who has messaged you, then call read_private_message for each sender.
    get_private_message_senders:
        rules:
          - action: allow
            rate_limit: 60/minute
    # get_transaction_logs: Get the logs from a transaction on the COTI blockchain. This is used for retrieving event logs emitted during transaction execution. Requires a transaction hash as input. Returns detailed information about the transaction logs including event names, topics, and data.
    get_transaction_logs:
        rules:
          - action: allow
            rate_limit: 60/minute
    # get_transaction_status: Get the status of a transaction on the COTI blockchain. This is used for checking if a transaction has been confirmed, pending, or failed. Requires a transaction hash as input. Returns detailed information about the transaction status.
    get_transaction_status:
        rules:
          - action: allow
            rate_limit: 60/minute
    # mint_private_erc20_token: Mint additional private ERC20 tokens on the COTI blockchain. This adds new tokens to the specified recipient address. Returns the transaction hash upon successful minting.
    mint_private_erc20_token:
        rules:
          - action: allow
            rate_limit: 60/minute
    # mint_private_erc721_token: Mint a new private ERC721 NFT token on the COTI blockchain. This creates a new NFT in the specified collection with the provided token URI. Returns the transaction hash and token ID upon successful minting.
    mint_private_erc721_token:
        rules:
          - action: allow
            rate_limit: 60/minute
    # read_private_message: Read and decrypt a private message sent to you on a deployed PrivateMessage contract. The message is decrypted using your own AES key — no one else can read it. If message_index is not provided, the latest message is returned. Use get_private_message_count to find out how many messages you have from a sender.
    read_private_message:
        rules:
          - action: allow
            rate_limit: 60/minute
    # sign_message: Sign a message using a COTI private key. This creates a cryptographic signature that proves the message was signed by the owner of the private key. The AI assistant should pass the private key from context. Returns the signature.
    sign_message:
        rules:
          - action: allow
            rate_limit: 60/minute
    # verify_signature: Verify a message signature and recover the address that signed it. This is used to determine who signed a specific message. Requires the original message and the signature as input. Returns the address that created the signature.
    verify_signature:
        rules:
          - action: allow
            rate_limit: 60/minute