# pm_buy

Buy outcome tokens on Polymarket prediction market

Agent View of the PolicyLayer registry record for `pm_buy`. HTML page: https://policylayer.com/tools/minhoyoo-iotrust-waiaas/pm-buy

## Facts

- Tool: `pm_buy`
- Server: Waiaas (`minhoyoo-iotrust/waiaas`) — https://policylayer.com/tools/minhoyoo-iotrust-waiaas.md
- Homepage: https://github.com/minhoyoo-iotrust/WAIaaS
- Risk category: Financial (Critical risk)
- Registry record: grade F, identity unverified
- Server rate-limited: no
- Parameters: 0
- Recommended policy verdict: Approval-gated

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "pm_buy",
    "arguments": {}
  }
}
```

## Why pm_buy is rated Critical

This tool executes a financial transaction by purchasing outcome tokens on a prediction market (Polymarket), committing real cryptocurrency funds. This directly involves financial obligations and asset transfers, making it Financial category. Severity is high because an AI agent could misuse this to spend significant funds on prediction market positions that may become worthless.

From the tool's own definition: "Buy outcome tokens on Polymarket prediction market"

## Use case

AI agents use pm_buy to commit financial operations through Waiaas, usually the final step of a payment, billing, or trading workflow. A call moves real money.

## Recommended policy (PolicyLayer)

Verdict: **Approval-gated**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Waiaas:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "pm_buy": {
      "deny_if": [
        {
          "conditions": [],
          "on_deny": "Requires human approval."
        }
      ]
    }
  }
}
```

## Other tools on Waiaas (125)

- `cancel_order` — Destructive — https://policylayer.com/tools/minhoyoo-iotrust-waiaas/cancel-order.md
- `hl_cancel_order` — Destructive — https://policylayer.com/tools/minhoyoo-iotrust-waiaas/hl-cancel-order.md
- `pm_cancel_all` — Destructive — https://policylayer.com/tools/minhoyoo-iotrust-waiaas/pm-cancel-all.md
- `pm_cancel_order` — Destructive — https://policylayer.com/tools/minhoyoo-iotrust-waiaas/pm-cancel-order.md
- `remove_liquidity` — Destructive — https://policylayer.com/tools/minhoyoo-iotrust-waiaas/remove-liquidity.md
- `build_userop` — Execute — https://policylayer.com/tools/minhoyoo-iotrust-waiaas/build-userop.md
- `call_contract` — Execute — https://policylayer.com/tools/minhoyoo-iotrust-waiaas/call-contract.md
- `encode_calldata` — Execute — https://policylayer.com/tools/minhoyoo-iotrust-waiaas/encode-calldata.md
- `execute` — Execute — https://policylayer.com/tools/minhoyoo-iotrust-waiaas/execute.md
- `hl_set_leverage` — Execute — https://policylayer.com/tools/minhoyoo-iotrust-waiaas/hl-set-leverage.md
- `hl_spot_cancel` — Execute — https://policylayer.com/tools/minhoyoo-iotrust-waiaas/hl-spot-cancel.md
- `request_validation` — Execute — https://policylayer.com/tools/minhoyoo-iotrust-waiaas/request-validation.md
- `sign_message` — Execute — https://policylayer.com/tools/minhoyoo-iotrust-waiaas/sign-message.md
- `sign_transaction` — Execute — https://policylayer.com/tools/minhoyoo-iotrust-waiaas/sign-transaction.md
- `sign_userop` — Execute — https://policylayer.com/tools/minhoyoo-iotrust-waiaas/sign-userop.md
- `simulate_transaction` — Execute — https://policylayer.com/tools/minhoyoo-iotrust-waiaas/simulate-transaction.md
- `aave_borrow` — Financial — https://policylayer.com/tools/minhoyoo-iotrust-waiaas/aave-borrow.md
- `aave_repay` — Financial — https://policylayer.com/tools/minhoyoo-iotrust-waiaas/aave-repay.md
- `aave_supply` — Financial — https://policylayer.com/tools/minhoyoo-iotrust-waiaas/aave-supply.md
- `aave_withdraw` — Financial — https://policylayer.com/tools/minhoyoo-iotrust-waiaas/aave-withdraw.md
- `bridge` — Financial — https://policylayer.com/tools/minhoyoo-iotrust-waiaas/bridge.md
- `buy_pt` — Financial — https://policylayer.com/tools/minhoyoo-iotrust-waiaas/buy-pt.md
- `buy_yt` — Financial — https://policylayer.com/tools/minhoyoo-iotrust-waiaas/buy-yt.md
- `cross_swap` — Financial — https://policylayer.com/tools/minhoyoo-iotrust-waiaas/cross-swap.md
- `dex_swap` — Financial — https://policylayer.com/tools/minhoyoo-iotrust-waiaas/dex-swap.md
- `drift_close_position` — Financial — https://policylayer.com/tools/minhoyoo-iotrust-waiaas/drift-close-position.md
- `drift_modify_position` — Financial — https://policylayer.com/tools/minhoyoo-iotrust-waiaas/drift-modify-position.md
- `drift_open_position` — Financial — https://policylayer.com/tools/minhoyoo-iotrust-waiaas/drift-open-position.md
- `drift_withdraw_margin` — Financial — https://policylayer.com/tools/minhoyoo-iotrust-waiaas/drift-withdraw-margin.md
- `erc8128_sign_request` — Financial — https://policylayer.com/tools/minhoyoo-iotrust-waiaas/erc8128-sign-request.md
- …and 95 more: https://policylayer.com/tools/minhoyoo-iotrust-waiaas.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=minhoyoo-iotrust-waiaas · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/minhoyoo-iotrust-waiaas