Report whether a WalletConnect session with Ledger Live is active (EVM chains) AND whether any TRON or Solana Ledger pairings are cached (USB HID — see pair_ledger_tron / pair_ledger_solana). Returns accounts: 0x…[] — the list of EVM wallet addresses the user has connected — and optionally tron: ...
AI agents call get_ledger_status to retrieve information from VaultPilot MCP without modifying anything — typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.
Even though get_ledger_status only reads data, uncontrolled read access leaks sensitive information and racks up API costs — an agent caught in a retry loop can make thousands of calls a minute without anyone noticing.
Attacks that exploit this kind of access
Report whether a WalletConnect session with Ledger Live is active (EVM chains) AND whether any TRON or Solana Ledger pairings are cached (USB HID — see pair_ledger_tron / pair_ledger_solana). Returns accounts: 0x…[] — the list of EVM wallet addresses the user has connected — and optionally tron: [{ address, path, appVersion, accountIndex }, …] and solana: [{ address, path, appVersion, accountIndex }, …] (one entry per paired non-EVM account, ordered by accountIndex) if the corresponding pair_ledger_* tool has been run at least once. Call this FIRST whenever the user refers to their wallet(s) by position or nickname instead of by address — e.g. "my wallet", "my TRON wallet", "the first address", "account 2", "second wallet", "second TRON account" — so you can resolve the reference to a concrete 0x… / T… before invoking any prepare_* / swap / send / portfolio tool that takes a wallet / tronAddress argument. Do NOT ask the user to paste an address if it's already in accounts or a tron[*].address here. SECURITY: the returned wallet/peerUrl (EVM) are self-reported by the paired WC app — any peer can claim to be 'Ledger Live' at wc.apps.ledger.com, so the wallet name and URL alone do NOT prove identity. The cryptographic discriminator is the WC session topic (also returned here). Before the FIRST send_transaction of a session, ask the user to open Ledger Live → Settings → Connected Apps (mobile: Manager → WalletConnect) and confirm a WalletConnect session exists whose topic ends with the last 8 chars of the topic field (surface those 8 chars in your prompt, e.g. "…a1b2c3d4"). If no matching session is listed there, a different peer is impersonating Ledger Live — do NOT proceed. The physical Ledger device's on-screen confirmation is still the final check on tx contents, but the topic cross-check is what binds the WC session to the user's real Ledger Live install. The tron array is read from the cache populated by pair_ledger_tron; send_transaction re-probes USB on every TRON sign, so the cache cannot be spoofed into approving a tx for the wrong account. If the response has peerUnreachable: true, the WalletConnect relay couldn't confirm Ledger Live is connected — the cached accounts are still fine for address resolution (read-only questions about balances / history / portfolio), but BEFORE any signing flow you MUST ask the user whether to re-pair via pair_ledger_live. The exact call-to-action text is in peerUnreachableGuidance; splice it verbatim into your reply rather than paraphrasing. Never auto-re-pair on a read-only request. It is categorised as a Read tool in the VaultPilot MCP MCP Server, which means it retrieves data without modifying state.
Register the VaultPilot MCP server in PolicyLayer and add a rule for get_ledger_status: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches VaultPilot MCP. Nothing to install.
get_ledger_status is a Read tool with low risk. Read-only tools are generally safe to allow by default.
Yes. Add a rate_limit block to the get_ledger_status rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.
Set action: deny in the PolicyLayer policy for get_ledger_status. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.
get_ledger_status is provided by the VaultPilot MCP server (vaultpilot-mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.