Critical-risk tools in Algorand MCP
22 of the 177 tools in Algorand MCP are classified as critical risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at critical risk
-
api_ultrade_market_cancel_orderDestructiveCancel open order
-
api_ultrade_wallet_revoke_keyDestructiveRevoke a trading key
-
make_app_delete_txnDestructiveCreate an application delete transaction
-
make_asset_destroy_txnDestructiveCreate an asset destroy transaction
-
wallet_remove_accountDestructiveRemove an Algorand account from the wallet by nickname or index.
-
alpha_amend_orderFinancialEdit an existing unfilled Alpha Arcade order in-place (change price, quantity, or slippage). Faster than cancel + recreate.
-
alpha_cancel_orderFinancialCancel an open Alpha Arcade order. Requires escrowAppId and orderOwner. Refunds USDC/tokens and ~0.957 ALGO collateral.
-
alpha_claimFinancialClaim USDC from a resolved Alpha Arcade market by redeeming outcome tokens. Winning = 1:1 USDC.
-
alpha_create_limit_orderFinancialPlace a limit order on an Alpha Arcade prediction market. Price and quantity in microunits (500000 = $0.50, 1000000 = 1 share). Locks ~0.957 ALGO collateral. Returns escrowAppId...
-
alpha_create_market_orderFinancialPlace a market order with auto-matching on Alpha Arcade. Price, quantity, and slippage in microunits. Returns escrowAppId, matched quantity, and actual fill price.
-
alpha_merge_sharesFinancialMerge equal YES and NO outcome tokens back into USDC on Alpha Arcade. 1 YES + 1 NO = 1 USDC.
-
alpha_propose_matchFinancialPropose a match between an existing maker order and your wallet as taker on Alpha Arcade.
-
alpha_split_sharesFinancialSplit USDC into equal YES and NO outcome tokens on Alpha Arcade. 1 USDC (1000000 microunits) = 1 YES + 1 NO.
-
api_haystack_execute_swapFinancialExecute an optimized token swap via Haystack Router — gets the best route across multiple DEXes (Tinyman V2, Pact, Folks) and LST protocols, then signs and submits the atomic tr...
-
api_ultrade_market_cancel_ordersFinancialCancel multiple open orders
-
api_ultrade_market_create_orderFinancialCreate new order
-
api_ultrade_market_create_ordersFinancialCreate new orders
-
api_ultrade_wallet_withdrawFinancialWithdraw token
-
api_ultrade_wallet_withdraw_messageFinancialGenerate message from the withdrawal data
-
make_asset_transfer_txnFinancialCreate an asset transfer transaction
-
make_http_request_with_x402FinancialCall an x402-protected HTTP endpoint with automatic USDC/ALGO payment from the active wallet. If
-
make_payment_txnFinancialCreate a payment transaction
Attacks that target this class
Critical-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.