Critical-risk tools in Spraay X402 Mcp
33 of the 183 tools in Spraay X402 Mcp are classified as critical risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at critical risk
-
spraay_cron_cancelDestructiveCancel a scheduled job by ID. Stops future executions. Data persists in Supabase. Costs $0.001 USDC.
-
spraay_robots_deregisterDestructiveRemove Robot (RTP). Free to call. Pass the request payload as a JSON string via the body argument.
-
spraay_webhook_deleteDestructiveDelete a registered webhook by ID. Removes it permanently from Supabase. Costs $0.001 USDC.
-
spraay_agent_wallet_provisionFinancialProvision agent wallet. Costs $0.05 USDC per call. Provide the listed fields as typed arguments.
-
spraay_agent_wallet_revoke_keyFinancialRevoke session key. Costs $0.02 USDC per call. Provide the listed fields as typed arguments.
-
spraay_agent_wallet_session_keyFinancialAdd session key. Costs $0.02 USDC per call. Provide the listed fields as typed arguments.
-
spraay_auth_sessionFinancialCreate an authenticated session with scoped permissions and configurable TTL. Returns a session token (spr_...) for use in Authorization headers. Data persists in Supabase. Cost...
-
spraay_batch_executeFinancialExecute a batch payment to up to 200 recipients in a single Base transaction via the Spraay protocol. Supports any ERC-20 token or native ETH. Returns unsigned transaction data ...
-
spraay_bittensor_embeddingsFinancialBittensor embeddings. Costs $0.005 USDC per call. Provide the listed fields as typed arguments.
-
spraay_bittensor_images_generationsFinancialBittensor image gen. Costs $0.05 USDC per call. Provide the listed fields as typed arguments.
-
spraay_compute_batchFinancialBatch compute — submit up to 50 jobs in a single x402 payment with 10% discount. Mix any types: text-inference, image-generation, tts, stt, embeddings, video-generation. Costs $...
-
spraay_compute_futures_depositFinancialDeposit USDC to open a prepaid compute credit account. Costs $0.01 USDC per call. Provide the listed fields as typed arguments.
-
spraay_compute_futures_executeFinancialRun a compute job and deduct cost from the prepaid balance. Costs $0.001 USDC per call. Provide the listed fields as typed arguments.
-
spraay_compute_futures_refundFinancialRefund unused compute credit balance to the original depositor. Costs $0.01 USDC per call. Provide the listed fields as typed arguments.
-
spraay_compute_image_generationFinancialGenerate images via Spraay Compute. FLUX Schnell, FLUX Dev, SDXL via Replicate. Text to image. Costs $0.02-$0.08 USDC.
-
spraay_compute_ttsFinancialText-to-speech via Spraay Compute. Convert text to natural-sounding audio. Replicate TTS models. Costs $0.03-$0.05 USDC.
-
spraay_cron_createFinancialCreate a scheduled job for recurring payments, DCA strategies, reminders, or any gateway action. Supports standard 5-part cron expressions. Data persists in Supabase. Costs $0.0...
-
spraay_escrow_cancelFinancialCancel an escrow. Depositor can cancel unfunded escrows; depositor or arbiter can cancel funded ones. Data persists in Supabase. Costs $0.002 USDC.
-
spraay_escrow_createFinancialCreate a conditional escrow with optional milestones, arbiter, and expiry on Base. Funds are held until release conditions are met. Data persists in Supabase. Returns escrow ID ...
-
spraay_escrow_fundFinancialMark an escrow as funded. Changes status from
-
spraay_escrow_releaseFinancialRelease escrow funds to the beneficiary. Returns an unsigned ERC-20 transfer transaction for the depositor to sign. Only depositor or arbiter can release. Data persists in Supab...
-
spraay_invoice_createFinancialCreate a payment invoice with a pre-encoded ERC-20 transfer transaction. Supports USDC, USDT, DAI, EURC, WETH on Base. Data persists in Supabase. Returns invoice ID, payment ins...
-
spraay_notify_smsFinancialSend an SMS notification for payment alerts (simulated — Twilio integration coming). Requires E.164 phone format. Costs $0.005 USDC.
-
spraay_payroll_executeFinancialExecute a payroll batch payment via Spraay V2 contract on Base. Pay up to 200 employees in a single transaction with any stablecoin. Returns unsigned transaction data. Costs $0....
-
spraay_sctp_invoiceFinancialSubmit invoice. Costs $0.02 USDC per call. Provide the listed fields as typed arguments.
-
spraay_sctp_payFinancialExecute supplier payment. Costs $0.10 USDC per call. Provide the listed fields as typed arguments.
-
spraay_sctp_poFinancialCreate purchase order. Costs $0.02 USDC per call. Provide the listed fields as typed arguments.
-
spraay_solana_jupiter_swap_txFinancialJupiter swap transaction. Costs $0.01 USDC per call. Provide the listed fields as typed arguments.
-
spraay_stellar_batchFinancialStellar batch payments. Costs $0.02 USDC per call. Provide the listed fields as typed arguments.
-
spraay_storage_pinFinancialPin content to IPFS via Pinata for permanent decentralized storage. Returns CID (content identifier) for retrieval. Supports text, JSON, and base64 data. Costs $0.005 USDC.
-
spraay_swap_executeFinancialExecute a token swap via Uniswap V3 on Base. Returns unsigned transaction data for the caller to sign and broadcast. Get a quote first with spraay_swap_quote. Costs $0.01 USDC.
-
spraay_xmtp_sendFinancialSend an encrypted XMTP message to any Ethereum address on the XMTP production network. Messages are end-to-end encrypted. Costs $0.003 USDC.
-
spraay_xrp_batchFinancialXRP batch payments. Costs $0.02 USDC per call. Provide the listed fields as typed arguments.
Attacks that target this class
Critical-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.