q402_yield_withdraw

What q402_yield_withdraw does on Q402 Mcp

AI agents use q402_yield_withdraw to commit financial operations through Q402 Mcp, usually the final step of a payment, billing, or trading workflow. A call moves real money.

Why q402_yield_withdraw is rated Critical

This tool directly moves cryptocurrency funds out of an agent wallet. Even though the action is technically reversible (funds could theoretically be re-deposited), it commits a financial obligation and transfers monetary value, making it Financial in category. Severity is critical because misuse by a compromised or malicious agent could drain wallet balances across multiple EVM chains without recovery guarantees.

From the tool's definition Tool description explicitly states 'WRITE - MOVES FUNDS. Withdraws the Agent Wallet' and the server context indicates it handles 'gasless payments on 10 EVM chains'. The verb 'withdraws' combined with 'moves funds' indicates direct transfer of financial value.

The rule that runs q402_yield_withdraw safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Q402 Mcp, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For q402_yield_withdraw, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "q402_yield_withdraw": {
      "deny_if": [
        {
          "conditions": [],
          "on_deny": "Requires human approval."
        }
      ]
    }
  }
}

Questions about q402_yield_withdraw