# q402_yield_withdraw WRITE - MOVES FUNDS. Withdraws the Agent Wallet Agent View of the PolicyLayer registry record for `q402_yield_withdraw`. HTML page: https://policylayer.com/tools/io-github-bitgett-q402-mcp/q402-yield-withdraw ## Facts - Tool: `q402_yield_withdraw` - Server: Q402 Mcp (`@quackai/q402-mcp`) — https://policylayer.com/tools/io-github-bitgett-q402-mcp.md - Install: `npx -y @quackai/q402-mcp` - Homepage: https://github.com/bitgett/q402-mcp - Risk category: Financial (Critical risk) - Registry record: grade F, identity unverified - Server rate-limited: no - Parameters: 0 - Recommended policy verdict: Approval-gated ## Example call (MCP tools/call, JSON-RPC 2.0) ```json { "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "q402_yield_withdraw", "arguments": {} } } ``` ## Why q402_yield_withdraw is rated Critical This tool directly moves cryptocurrency funds out of an agent wallet. Even though the action is technically reversible (funds could theoretically be re-deposited), it commits a financial obligation and transfers monetary value, making it Financial in category. Severity is critical because misuse by a compromised or malicious agent could drain wallet balances across multiple EVM chains without recovery guarantees. From the tool's own definition: "Tool description explicitly states 'WRITE - MOVES FUNDS. Withdraws the Agent Wallet' and the server context indicates it handles 'gasless payments on 10 EVM chains'. The verb 'withdraws' combined with 'moves funds' indicates direct transfer of financial value." ## Use case AI agents use q402_yield_withdraw to commit financial operations through Q402 Mcp, usually the final step of a payment, billing, or trading workflow. A call moves real money. ## Recommended policy (PolicyLayer) Verdict: **Approval-gated**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Q402 Mcp: ```json { "version": "1", "default": "deny", "tools": { "q402_yield_withdraw": { "deny_if": [ { "conditions": [], "on_deny": "Requires human approval." } ] } } } ``` ## Other tools on Q402 Mcp (40) - `q402_clear_delegation` — Destructive — https://policylayer.com/tools/io-github-bitgett-q402-mcp/q402-clear-delegation.md - `q402_redstone_trigger_cancel` — Destructive — https://policylayer.com/tools/io-github-bitgett-q402-mcp/q402-redstone-trigger-cancel.md - `q402_bridge_send` — Financial — https://policylayer.com/tools/io-github-bitgett-q402-mcp/q402-bridge-send.md - `q402_escrow_create` — Financial — https://policylayer.com/tools/io-github-bitgett-q402-mcp/q402-escrow-create.md - `q402_escrow_dispute` — Financial — https://policylayer.com/tools/io-github-bitgett-q402-mcp/q402-escrow-dispute.md - `q402_escrow_lock` — Financial — https://policylayer.com/tools/io-github-bitgett-q402-mcp/q402-escrow-lock.md - `q402_escrow_refund` — Financial — https://policylayer.com/tools/io-github-bitgett-q402-mcp/q402-escrow-refund.md - `q402_escrow_release` — Financial — https://policylayer.com/tools/io-github-bitgett-q402-mcp/q402-escrow-release.md - `q402_oft_send` — Financial — https://policylayer.com/tools/io-github-bitgett-q402-mcp/q402-oft-send.md - `q402_pay` — Financial — https://policylayer.com/tools/io-github-bitgett-q402-mcp/q402-pay.md - `q402_recurring_cancel` — Financial — https://policylayer.com/tools/io-github-bitgett-q402-mcp/q402-recurring-cancel.md - `q402_recurring_resume` — Financial — https://policylayer.com/tools/io-github-bitgett-q402-mcp/q402-recurring-resume.md - `q402_redstone_trigger_create` — Financial — https://policylayer.com/tools/io-github-bitgett-q402-mcp/q402-redstone-trigger-create.md - `q402_request_pay` — Financial — https://policylayer.com/tools/io-github-bitgett-q402-mcp/q402-request-pay.md - `q402_stake` — Financial — https://policylayer.com/tools/io-github-bitgett-q402-mcp/q402-stake.md - `q402_unstake` — Financial — https://policylayer.com/tools/io-github-bitgett-q402-mcp/q402-unstake.md - `q402_yield_deposit` — Financial — https://policylayer.com/tools/io-github-bitgett-q402-mcp/q402-yield-deposit.md - `q402_agent_spend_report` — Read — https://policylayer.com/tools/io-github-bitgett-q402-mcp/q402-agent-spend-report.md - `q402_agentic_info` — Read — https://policylayer.com/tools/io-github-bitgett-q402-mcp/q402-agentic-info.md - `q402_balance` — Read — https://policylayer.com/tools/io-github-bitgett-q402-mcp/q402-balance.md - `q402_bridge_gas_tank` — Read — https://policylayer.com/tools/io-github-bitgett-q402-mcp/q402-bridge-gas-tank.md - `q402_bridge_history` — Read — https://policylayer.com/tools/io-github-bitgett-q402-mcp/q402-bridge-history.md - `q402_bridge_quote` — Read — https://policylayer.com/tools/io-github-bitgett-q402-mcp/q402-bridge-quote.md - `q402_doctor` — Read — https://policylayer.com/tools/io-github-bitgett-q402-mcp/q402-doctor.md - `q402_escrow_status` — Read — https://policylayer.com/tools/io-github-bitgett-q402-mcp/q402-escrow-status.md - `q402_memory_summary` — Read — https://policylayer.com/tools/io-github-bitgett-q402-mcp/q402-memory-summary.md - `q402_oft_history` — Read — https://policylayer.com/tools/io-github-bitgett-q402-mcp/q402-oft-history.md - `q402_oft_quote` — Read — https://policylayer.com/tools/io-github-bitgett-q402-mcp/q402-oft-quote.md - `q402_quote` — Read — https://policylayer.com/tools/io-github-bitgett-q402-mcp/q402-quote.md - `q402_receipt` — Read — https://policylayer.com/tools/io-github-bitgett-q402-mcp/q402-receipt.md - …and 10 more: https://policylayer.com/tools/io-github-bitgett-q402-mcp.md ## For agents This record is a snapshot. Live verdicts and the full registry: - Check every server in your MCP config at once: `npx -y policylayer stack` - Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md) - Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events` --- Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=io-github-bitgett-q402-mcp · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/io-github-bitgett-q402-mcp