# prepare_custom_call ESCAPE HATCH for arbitrary EVM contract calls — Timelock proposals, governance hooks, DAO ops, anything not covered by a protocol-specific prepare_*. BYPASSES the canonical-dispatch allowlist by design; the schema's acknowledgeNonProtocolTarget: true literal is the user's affirmative gate. ABI source: pass abi: [...] inline (preferred when you have the project's published artifact), OR omit it and the tool fetches via Etherscan V2 — refuses on unverified contracts with NO raw-bytecode fallback. Proxies are followed once to the implementation when Etherscan exposes the link; deeper proxy chains require an inline ABI. Pass fn as a name ("schedule") when unambiguous or as the full signature ("schedule(address,uint256,bytes,bytes32,bytes32,uint256)") to disambiguate overloads. args types are validated by viem's encoder at build time — uint256 expects a decimal string, address expects a 0x-prefixed lowercase hex, bytes/bytes32 expect 0x-prefixed hex, structs are objects with their named fields. value is RAW WEI (decimal string), not human-readable. The standard prepare-receipt + verification envelope (payloadHash, decoderUrl, humanDecode) applies; on-device verification is blind-sign by definition (no Ledger plugin decodes arbitrary calldata) — the swiss-knife decoder URL surfaced in chat is the user-side anchor. Use a protocol-specific prepare_* whenever one fits — this tool exists for the long tail. Agent View of the PolicyLayer registry record for `prepare_custom_call`. HTML page: https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-custom-call ## Facts - Tool: `prepare_custom_call` - Server: VaultPilot MCP (`vaultpilot-mcp`) — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp.md - Install: `npx -y vaultpilot-mcp` - Homepage: https://github.com/szhygulin/vaultpilot-mcp - Risk category: Execute (High risk) - Registry record: grade F, identity unverified - Server rate-limited: no - Parameters: 11 (4 required) - Recommended policy verdict: Rate-limited ## Parameters | Parameter | Type | Required | Description | | --- | --- | --- | --- | | `fn` | string | yes | Function name to call (e.g. "schedule"). Pass the FULL signature ("schedule(address,uint256,bytes,bytes32,bytes32,uint256)") to disambiguate when the ABI has ov | | `abi` | array | no | Inline ABI array. When omitted, the tool fetches it via Etherscan V2. Pass it to override the Etherscan ABI, to call a contract whose source isn't yet verified, | | `args` | array | no | Array of args matching the function's inputs in order. Decimal strings for uint256 (e.g. "1000000000000000000" for 1 ETH-as-wei), hex strings for bytes32/bytes, | | `chain` | string | no | | | `value` | string | no | Native-coin value in WEI (decimal string). Use "0" for non-payable functions. For payable functions, pass the wei amount (e.g. "1000000000000000000" for 1 ETH). | | `wallet` | string | yes | EVM wallet that will sign + broadcast the call. Must be paired via `pair_ledger_live`. | | `contract` | string | yes | Target contract address. Must be Etherscan-verified OR the `abi` arg must be passed inline. NOT canonical-dispatch-allowlist gated — this is the explicit escape | | `acknowledgeBurnApproval` | boolean | no | Override flag for the BURN_ADDRESS_UNLIMITED_APPROVAL refusal. Required only when `fn` is `approve` and the encoded call grants unlimited (2^256-1) allowance to | | `acknowledgeRawApproveBypass` | boolean | no | Override flag for the APPROVE_ROUTE_VIA_DEDICATED_TOOL refusal. By default any `approve(address,uint256)` calldata routed through this escape hatch refuses and | | `acknowledgeKnownExfilPattern` | boolean | no | Override flag for the CUSTOM_CALL_REFUSED selector classifier (issue #652). The classifier hard-refuses obvious ERC-20 value-exfil selectors routed through this | | `acknowledgeNonProtocolTarget` | boolean | yes | AFFIRMATIVE GATE — must be true. The tool BYPASSES the canonical-dispatch allowlist by design (used for arbitrary contract calls like Timelock proposals, govern | Parameters from the server's own tool schema. ## Example call (MCP tools/call, JSON-RPC 2.0) ```json { "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "prepare_custom_call", "arguments": { "fn": "", "wallet": "", "contract": "", "acknowledgeNonProtocolTarget": false } } } ``` ## Why prepare_custom_call is rated High This tool enables execution of arbitrary smart contract calls on EVM blockchains without protocol-specific safeguards. The description explicitly states it bypasses allowlists and operates as an escape hatch for unconstrained contract interactions. From the tool's own definition: "ESCAPE HATCH for arbitrary EVM contract calls — BYPASSES the canonical-dispatch allowlist by design; the schema's `acknowledgeNonProtocolTarget: true` literal is the user's affirmative gate." Risk signals: High parameter count (11 properties) ## Use case AI agents invoke prepare_custom_call to trigger actions in VaultPilot MCP. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call: builds kicked off, notifications sent, workflows started. ## Recommended policy (PolicyLayer) Verdict: **Rate-limited**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches VaultPilot MCP: ```json { "version": "1", "default": "deny", "tools": { "prepare_custom_call": { "limits": [ { "counter": "prepare_custom_call_rate", "window": "minute", "max": 10, "scope": "grant" } ] } } } ``` ## Other tools on VaultPilot MCP (188) - `prepare_btc_lifi_swap` — Destructive — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-btc-lifi-swap.md - `prepare_btc_rbf_bump` — Destructive — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-btc-rbf-bump.md - `prepare_jito_stake` — Destructive — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-jito-stake.md - `prepare_marginfi_init` — Destructive — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-marginfi-init.md - `prepare_solana_nonce_close` — Destructive — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-solana-nonce-close.md - `prepare_sunswap_swap` — Destructive — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-sunswap-swap.md - `prepare_uniswap_v3_burn` — Destructive — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-uniswap-v3-burn.md - `prepare_uniswap_v3_mint` — Destructive — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-uniswap-v3-mint.md - `remove_contact` — Destructive — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/remove-contact.md - `unregister_btc_multisig_wallet` — Destructive — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/unregister-btc-multisig-wallet.md - `combine_btc_psbts` — Execute — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/combine-btc-psbts.md - `pair_ledger_btc` — Execute — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/pair-ledger-btc.md - `prepare_aave_repay` — Execute — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-aave-repay.md - `prepare_btc_multisig_send` — Execute — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-btc-multisig-send.md - `prepare_compound_repay` — Execute — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-compound-repay.md - `prepare_compound_supply` — Execute — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-compound-supply.md - `prepare_curve_swap` — Execute — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-curve-swap.md - `prepare_kamino_init_user` — Execute — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-kamino-init-user.md - `prepare_kamino_supply` — Execute — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-kamino-supply.md - `prepare_lido_unstake` — Execute — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-lido-unstake.md - `prepare_lido_unwrap` — Execute — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-lido-unwrap.md - `prepare_lido_wrap` — Execute — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-lido-wrap.md - `prepare_native_stake_deactivate` — Execute — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-native-stake-deactivate.md - `prepare_native_stake_delegate` — Execute — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-native-stake-delegate.md - `prepare_rocketpool_unstake` — Execute — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-rocketpool-unstake.md - `prepare_safe_tx_execute` — Execute — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-safe-tx-execute.md - `prepare_solana_lifi_swap` — Execute — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-solana-lifi-swap.md - `prepare_solana_nonce_init` — Execute — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-solana-nonce-init.md - `prepare_solana_swap` — Execute — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-solana-swap.md - `prepare_swap` — Execute — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-swap.md - …and 158 more: https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp.md ## For agents This record is a snapshot. Live verdicts and the full registry: - Check every server in your MCP config at once: `npx -y policylayer stack` - Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md) - Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events` --- Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=io-github-szhygulin-vaultpilot-mcp · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/io-github-szhygulin-vaultpilot-mcp