# prepare_swap Prepare an unsigned swap or bridge transaction via LiFi aggregator. Same-chain swaps use the best DEX route; cross-chain swaps use a bridge + DEX combo. Default is exact-in (amount = fromToken); set amountSide: "to" for exact-out (amount = target toToken output, e.g. "I want 100 USDC out"). Source chain is always EVM. Destination can be any EVM chain, Solana, or TRON. For non-EVM destinations pass toChain: "solana" / "tron" + an explicit toAddress in the destination chain's format; the user signs an EVM tx and the bridge protocol delivers tokens to the destination after confirmation. The destination-side decimals cross-check is dropped for non-EVM destinations (we can't read SPL/TRC-20 via EVM RPC); LiFi's reported decimals are the source of truth there. Exact-out is not supported for cross-chain-to-non-EVM. For Solana-source swaps and bridges use prepare_solana_lifi_swap. TRON-source LiFi is not yet wired. PROTOCOL ROUTING (issue #411): without exchanges / bridges, LiFi picks the best-output route across all aggregators. When the user explicitly names a DEX ("swap on 1inch", "use Sushi"), pass exchanges: ["1inch"] (or the named protocol) — without the filter LiFi may silently route via a different DEX. If no route satisfies the filter the call errors with a clear message; the agent can offer to retry without the filter. The unsigned tx's description includes "via " and notes whether the resolved tool matched the filter. DECODING DEFENSE: every cross-chain bridge calldata is parsed into its BridgeData tuple and the encoded destinationChainId + receiver are cross-checked against what the user requested — refuses on mismatch. Catches a compromised MCP that returns calldata routing to a different chain or recipient than the prepare receipt advertises. INTERMEDIATE-CHAIN BRIDGES: NEAR Intents (notably for ETH→TRON USDT routes) settles on NEAR and releases on the final chain via an off-chain relayer, so its on-chain destinationChainId is NEAR's pseudo-id (1885080386571452) rather than the user's requested chain. The defense allows this ONLY for an explicit hardcoded (bridge name, intermediate chain ID) pair held as a source-code constant — not loaded from env / config / LiFi response — so a compromised aggregator can't claim arbitrary chains as 'intermediate'. Receiver-side checks (non-EVM sentinel, etc.) still apply unchanged. The returned tx can be sent via send_transaction. Agent View of the PolicyLayer registry record for `prepare_swap`. HTML page: https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-swap ## Facts - Tool: `prepare_swap` - Server: VaultPilot MCP (`vaultpilot-mcp`) — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp.md - Install: `npx -y vaultpilot-mcp` - Homepage: https://github.com/szhygulin/vaultpilot-mcp - Risk category: Execute (High risk) - Registry record: grade F, identity unverified - Server rate-limited: no - Parameters: 12 (6 required) - Recommended policy verdict: Rate-limited ## Parameters | Parameter | Type | Required | Description | | --- | --- | --- | --- | | `order` | string | no | Route ranking criterion. RECOMMENDED (default) — LiFi's mix of price + safety. CHEAPEST — pick the route with the highest output amount; use this for "best rate | | `amount` | string | yes | Human-readable decimal amount, NOT raw wei/base units. Example: "1.5" for 1.5 USDC, "0.01" for 0.01 ETH. Interpreted as fromToken input by default; set `amountS | | `wallet` | string | yes | | | `bridges` | array | no | Restrict cross-chain routing to a specific set of bridge protocols. Common values: "across", "stargate", "hop", "cbridge", "amarok", "polygon", "arbitrum-bridge | | `toChain` | string | yes | | | `toToken` | object | yes | | | `exchanges` | array | no | Restrict LiFi routing to a specific set of DEX/exchange aggregators. Common values: "1inch", "sushiswap", "uniswap", "paraswap", "0x", "kyberswap", "odos", "ope | | `fromChain` | string | yes | | | `fromToken` | object | yes | | | `toAddress` | string | no | Destination wallet. OMIT for same-chain-type swaps (defaults to the source wallet — LiFi behavior). REQUIRED when `toChain` is `"solana"` or `"tron"` because th | | `amountSide` | string | no | Which side of the swap `amount` refers to. "from" (default) = exact-in: you spend exactly `amount` of fromToken and receive a variable output. "to" = exact-out: | | `slippageBps` | integer | no | Slippage tolerance in basis points (50 = 0.5%, 100 = 1%). Default ~50. Hard-capped at 500 (5%) — anything higher is almost always a sandwich-bait misconfigurati | Parameters from the server's own tool schema. ## Example call (MCP tools/call, JSON-RPC 2.0) ```json { "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "prepare_swap", "arguments": { "amount": "", "wallet": "", "toChain": "", "toToken": {}, "fromChain": "", "fromToken": {} } } } ``` ## Why prepare_swap is rated High This tool prepares and routes a swap/bridge transaction across chains. While labeled 'prepare' (suggesting it may not submit), it constructs a real financial transaction (token swap or cross-chain bridge) that, once signed, transfers crypto assets. In a self-custodial DeFi context with Ledger signing, this is a critical step in an asset-moving workflow. From the tool's own definition: "Prepare an unsigned swap or bridge transaction via LiFi aggregator. Same-chain swaps use the best DEX route; cross-chain swaps use a bridge + DEX combo." Risk signals: High parameter count (17 properties) · Bulk/mass operation — affects multiple targets ## Use case AI agents invoke prepare_swap to trigger actions in VaultPilot MCP. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call: builds kicked off, notifications sent, workflows started. ## Recommended policy (PolicyLayer) Verdict: **Rate-limited**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches VaultPilot MCP: ```json { "version": "1", "default": "deny", "tools": { "prepare_swap": { "limits": [ { "counter": "prepare_swap_rate", "window": "minute", "max": 10, "scope": "grant" } ] } } } ``` ## Other tools on VaultPilot MCP (188) - `prepare_btc_lifi_swap` — Destructive — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-btc-lifi-swap.md - `prepare_btc_rbf_bump` — Destructive — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-btc-rbf-bump.md - `prepare_jito_stake` — Destructive — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-jito-stake.md - `prepare_marginfi_init` — Destructive — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-marginfi-init.md - `prepare_solana_nonce_close` — Destructive — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-solana-nonce-close.md - `prepare_sunswap_swap` — Destructive — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-sunswap-swap.md - `prepare_uniswap_v3_burn` — Destructive — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-uniswap-v3-burn.md - `prepare_uniswap_v3_mint` — Destructive — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-uniswap-v3-mint.md - `remove_contact` — Destructive — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/remove-contact.md - `unregister_btc_multisig_wallet` — Destructive — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/unregister-btc-multisig-wallet.md - `combine_btc_psbts` — Execute — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/combine-btc-psbts.md - `pair_ledger_btc` — Execute — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/pair-ledger-btc.md - `prepare_aave_repay` — Execute — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-aave-repay.md - `prepare_btc_multisig_send` — Execute — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-btc-multisig-send.md - `prepare_compound_repay` — Execute — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-compound-repay.md - `prepare_compound_supply` — Execute — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-compound-supply.md - `prepare_curve_swap` — Execute — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-curve-swap.md - `prepare_custom_call` — Execute — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-custom-call.md - `prepare_kamino_init_user` — Execute — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-kamino-init-user.md - `prepare_kamino_supply` — Execute — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-kamino-supply.md - `prepare_lido_unstake` — Execute — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-lido-unstake.md - `prepare_lido_unwrap` — Execute — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-lido-unwrap.md - `prepare_lido_wrap` — Execute — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-lido-wrap.md - `prepare_native_stake_deactivate` — Execute — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-native-stake-deactivate.md - `prepare_native_stake_delegate` — Execute — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-native-stake-delegate.md - `prepare_rocketpool_unstake` — Execute — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-rocketpool-unstake.md - `prepare_safe_tx_execute` — Execute — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-safe-tx-execute.md - `prepare_solana_lifi_swap` — Execute — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-solana-lifi-swap.md - `prepare_solana_nonce_init` — Execute — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-solana-nonce-init.md - `prepare_solana_swap` — Execute — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-solana-swap.md - …and 158 more: https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp.md ## For agents This record is a snapshot. Live verdicts and the full registry: - Check every server in your MCP config at once: `npx -y policylayer stack` - Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md) - Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events` --- Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=io-github-szhygulin-vaultpilot-mcp · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/io-github-szhygulin-vaultpilot-mcp