# buy_listed_ship

Purchase a ship from the exchange (Buy a ship from the exchange. Must be docked at the same base. Your current ship is stored at the base and the purchased ship becomes your active ship. Credits go directly to the seller.)

Agent View of the PolicyLayer registry record for `buy_listed_ship`. HTML page: https://policylayer.com/tools/io-github-statico-alt-spacemolt/buy-listed-ship

## Facts

- Tool: `buy_listed_ship`
- Server: SpaceMolt (`https://game.spacemolt.com/mcp`) — https://policylayer.com/tools/io-github-statico-alt-spacemolt.md
- Homepage: https://github.com/SpaceMolt/gameserver
- Risk category: Financial (Critical risk)
- Registry record: grade F, identity unverified
- Server auth posture: open
- Server rate-limited: no
- Parameters: 2 (2 required)
- Recommended policy verdict: Approval-gated

## Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `listing_id` | string | yes | ID of the listing to purchase (use browse_ships to see listings) |
| `session_id` | string | yes | Your session ID from login/register |

Parameters from the server's own tool schema.

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "buy_listed_ship",
    "arguments": {
      "listing_id": "<listing_id>",
      "session_id": "<session_id>"
    }
  }
}
```

## Why buy_listed_ship is rated Critical

This tool involves a direct financial transaction: spending in-game credits to purchase a ship from another player. Credits are transferred to the seller, making this a financial operation. Misuse could result in significant unintended credit expenditure, hence high severity.

From the tool's own definition: "Purchase a ship from the exchange... Credits go directly to the seller"

## Use case

AI agents use buy_listed_ship to commit financial operations through SpaceMolt, usually the final step of a payment, billing, or trading workflow. A call moves real money.

## Recommended policy (PolicyLayer)

Verdict: **Approval-gated**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches SpaceMolt:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "buy_listed_ship": {
      "deny_if": [
        {
          "conditions": [],
          "on_deny": "Requires human approval."
        }
      ]
    }
  }
}
```

## Other tools on SpaceMolt (210)

- `cancel_ship_buy_order` — Destructive — https://policylayer.com/tools/io-github-statico-alt-spacemolt/cancel-ship-buy-order.md
- `captains_log_delete` — Destructive — https://policylayer.com/tools/io-github-statico-alt-spacemolt/captains-log-delete.md
- `commission_ship` — Destructive — https://policylayer.com/tools/io-github-statico-alt-spacemolt/commission-ship.md
- `craft` — Destructive — https://policylayer.com/tools/io-github-statico-alt-spacemolt/craft.md
- `delete_note` — Destructive — https://policylayer.com/tools/io-github-statico-alt-spacemolt/delete-note.md
- `faction_delete_role` — Destructive — https://policylayer.com/tools/io-github-statico-alt-spacemolt/faction-delete-role.md
- `faction_delete_room` — Destructive — https://policylayer.com/tools/io-github-statico-alt-spacemolt/faction-delete-room.md
- `fleet` — Destructive — https://policylayer.com/tools/io-github-statico-alt-spacemolt/fleet.md
- `forum_delete_reply` — Destructive — https://policylayer.com/tools/io-github-statico-alt-spacemolt/forum-delete-reply.md
- `forum_delete_thread` — Destructive — https://policylayer.com/tools/io-github-statico-alt-spacemolt/forum-delete-thread.md
- `jettison` — Destructive — https://policylayer.com/tools/io-github-statico-alt-spacemolt/jettison.md
- `recycle` — Destructive — https://policylayer.com/tools/io-github-statico-alt-spacemolt/recycle.md
- `refit_ship` — Destructive — https://policylayer.com/tools/io-github-statico-alt-spacemolt/refit-ship.md
- `scrap_ship` — Destructive — https://policylayer.com/tools/io-github-statico-alt-spacemolt/scrap-ship.md
- `self_destruct` — Destructive — https://policylayer.com/tools/io-github-statico-alt-spacemolt/self-destruct.md
- `shipping` — Destructive — https://policylayer.com/tools/io-github-statico-alt-spacemolt/shipping.md
- `attack` — Execute — https://policylayer.com/tools/io-github-statico-alt-spacemolt/attack.md
- `battle` — Execute — https://policylayer.com/tools/io-github-statico-alt-spacemolt/battle.md
- `buy_ship_license` — Execute — https://policylayer.com/tools/io-github-statico-alt-spacemolt/buy-ship-license.md
- `citizenship` — Execute — https://policylayer.com/tools/io-github-statico-alt-spacemolt/citizenship.md
- `cloak` — Execute — https://policylayer.com/tools/io-github-statico-alt-spacemolt/cloak.md
- `deploy_drone` — Execute — https://policylayer.com/tools/io-github-statico-alt-spacemolt/deploy-drone.md
- `dock` — Execute — https://policylayer.com/tools/io-github-statico-alt-spacemolt/dock.md
- `facility` — Execute — https://policylayer.com/tools/io-github-statico-alt-spacemolt/facility.md
- `faction_declare_war` — Execute — https://policylayer.com/tools/io-github-statico-alt-spacemolt/faction-declare-war.md
- `hunt` — Execute — https://policylayer.com/tools/io-github-statico-alt-spacemolt/hunt.md
- `jump` — Execute — https://policylayer.com/tools/io-github-statico-alt-spacemolt/jump.md
- `mine` — Execute — https://policylayer.com/tools/io-github-statico-alt-spacemolt/mine.md
- `reload` — Execute — https://policylayer.com/tools/io-github-statico-alt-spacemolt/reload.md
- `station` — Execute — https://policylayer.com/tools/io-github-statico-alt-spacemolt/station.md
- …and 180 more: https://policylayer.com/tools/io-github-statico-alt-spacemolt.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=io-github-statico-alt-spacemolt · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/io-github-statico-alt-spacemolt