# send_transaction Forward an already-prepared transaction to the Ledger device for user signing. Routes on the handle's origin: EVM handles (prepare_aave_*, prepare_compound_*, prepare_swap, prepare_native_send, ...) go through Ledger Live via WalletConnect; TRON handles (prepare_tron_*) go through the directly-connected Ledger over USB HID and are broadcast via TronGrid. In both cases the user must review and physically approve the tx on the Ledger screen; this call blocks until the user signs or rejects. EVM handles REQUIRE a prior preview_send(handle) call in the same session — send_transaction reads the pinned nonce + fees + gas stashed on the handle and will throw a clear error if the pin is missing. The split exists so the LEDGER BLIND-SIGN HASH is surfaced to the user BEFORE the blocking device prompt. You MUST pass confirmed: true — the agent is affirming that the user has seen and acknowledged the decoded preview AND the LEDGER BLIND-SIGN HASH emitted by preview_send. EVM handles ADDITIONALLY require passing previewToken (the opaque string returned in preview_send's top-level JSON response) and userDecision: "send" (set after the user has replied "send" to the EXTRA CHECKS menu emitted by preview_send's agent-task block). Together these prove the agent actually surfaced the preview-time gate to the user instead of collapsing preview_send + send_transaction into one silent step — missing/mismatched values cause a clear-error refusal. TRON handles ignore both args. For TRON handles, pair_ledger_tron must have been called at least once per session (so the TRON app has been opened on the device) and the Ledger must still be plugged in with the TRON app open at send time; preview_send is skipped (TRON has its own clear-sign UX on-device). Agent View of the PolicyLayer registry record for `send_transaction`. HTML page: https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/send-transaction ## Facts - Tool: `send_transaction` - Server: VaultPilot MCP (`vaultpilot-mcp`) — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp.md - Install: `npx -y vaultpilot-mcp` - Homepage: https://github.com/szhygulin/vaultpilot-mcp - Risk category: Financial (Critical risk) - Registry record: grade F, identity unverified - Server rate-limited: no - Parameters: 5 (2 required) - Recommended policy verdict: Approval-gated ## Parameters | Parameter | Type | Required | Description | | --- | --- | --- | --- | | `handle` | string | yes | Opaque handle returned by a prepare_* tool in the `handle` field of the UnsignedTx. Raw calldata is NOT accepted — the handle is the only way to name a tx for s | | `confirmed` | boolean | yes | Must be literally `true`. The agent is affirming that the user has seen and acknowledged the decoded preview returned by the preceding prepare_* call. This is a | | `previewToken` | string | no | Required for EVM and Solana (ignored for TRON — TRON has no preview step). Opaque token returned by the preceding `preview_send` (EVM) or `preview_solana_send` | | `userDecision` | string | no | Required on every chain (EVM / Solana / TRON). The agent sets this to the literal "send" AFTER presenting the CHECKS PERFORMED block (EVM / Solana) or the VERIF | | `acknowledgeRetryRiskAfterAmbiguousFailure` | boolean | no | Required ONLY when re-calling send_transaction on an EVM handle whose previous attempt returned a `WalletConnectRequestTimeoutError` (no_broadcast / consumed_un | Parameters from the server's own tool schema. ## Example call (MCP tools/call, JSON-RPC 2.0) ```json { "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "send_transaction", "arguments": { "handle": "", "confirmed": false } } } ``` ## Why send_transaction is rated Critical This tool submits signed blockchain transactions across multiple chains (EVM, TRON) including DeFi operations (Aave, Compound, swaps) and native sends. It moves crypto assets and commits financial obligations on-chain. Once broadcast, transactions are irreversible, making misuse catastrophic. The tool spans Financial (moving funds) and Destructive (irreversible), but Financial is the most severe applicable category. From the tool's own definition: "'Forward an already-prepared transaction to the Ledger device for user signing', 'EVM handles (prepare_aave_*, prepare_compound_*, prepare_swap, prepare_native_send, ...) go through Ledger Live via WalletConnect', 'TRON handles ... are broadcast via TronGrid'" ## Use case AI agents use send_transaction to commit financial operations through VaultPilot MCP, usually the final step of a payment, billing, or trading workflow. A call moves real money. ## Recommended policy (PolicyLayer) Verdict: **Approval-gated**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches VaultPilot MCP: ```json { "version": "1", "default": "deny", "tools": { "send_transaction": { "deny_if": [ { "conditions": [], "on_deny": "Requires human approval." } ] } } } ``` ## Other tools on VaultPilot MCP (188) - `prepare_btc_lifi_swap` — Destructive — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-btc-lifi-swap.md - `prepare_btc_rbf_bump` — Destructive — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-btc-rbf-bump.md - `prepare_jito_stake` — Destructive — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-jito-stake.md - `prepare_marginfi_init` — Destructive — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-marginfi-init.md - `prepare_solana_nonce_close` — Destructive — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-solana-nonce-close.md - `prepare_sunswap_swap` — Destructive — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-sunswap-swap.md - `prepare_uniswap_v3_burn` — Destructive — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-uniswap-v3-burn.md - `prepare_uniswap_v3_mint` — Destructive — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-uniswap-v3-mint.md - `remove_contact` — Destructive — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/remove-contact.md - `unregister_btc_multisig_wallet` — Destructive — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/unregister-btc-multisig-wallet.md - `combine_btc_psbts` — Execute — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/combine-btc-psbts.md - `pair_ledger_btc` — Execute — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/pair-ledger-btc.md - `prepare_aave_repay` — Execute — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-aave-repay.md - `prepare_btc_multisig_send` — Execute — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-btc-multisig-send.md - `prepare_compound_repay` — Execute — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-compound-repay.md - `prepare_compound_supply` — Execute — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-compound-supply.md - `prepare_curve_swap` — Execute — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-curve-swap.md - `prepare_custom_call` — Execute — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-custom-call.md - `prepare_kamino_init_user` — Execute — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-kamino-init-user.md - `prepare_kamino_supply` — Execute — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-kamino-supply.md - `prepare_lido_unstake` — Execute — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-lido-unstake.md - `prepare_lido_unwrap` — Execute — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-lido-unwrap.md - `prepare_lido_wrap` — Execute — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-lido-wrap.md - `prepare_native_stake_deactivate` — Execute — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-native-stake-deactivate.md - `prepare_native_stake_delegate` — Execute — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-native-stake-delegate.md - `prepare_rocketpool_unstake` — Execute — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-rocketpool-unstake.md - `prepare_safe_tx_execute` — Execute — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-safe-tx-execute.md - `prepare_solana_lifi_swap` — Execute — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-solana-lifi-swap.md - `prepare_solana_nonce_init` — Execute — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-solana-nonce-init.md - `prepare_solana_swap` — Execute — https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp/prepare-solana-swap.md - …and 158 more: https://policylayer.com/tools/io-github-szhygulin-vaultpilot-mcp.md ## For agents This record is a snapshot. Live verdicts and the full registry: - Check every server in your MCP config at once: `npx -y policylayer stack` - Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md) - Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events` --- Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=io-github-szhygulin-vaultpilot-mcp · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/io-github-szhygulin-vaultpilot-mcp