After a market resolves or is cancelled, withdraw your share of the remaining pool liquidity as an LP. Only callable on RESOLVED or CANCELLED markets. This is separate from LP fees; it returns your principal plus any pool surplus.
AI agents use claim_lp_residual to commit financial operations through Question Market — usually the final step of a payment, billing, or trading workflow. A call moves real money.
This tool initiates a financial transaction on the Algorand blockchain, withdrawing liquidity (principal and surplus) from a resolved or cancelled prediction market. It directly moves financial assets, qualifying it as Financial category. Severity is high because misuse could drain LP funds or be triggered on incorrect markets, though it is somewhat constrained to RESOLVED or CANCELLED markets.
From the tool's definition 'withdraw your share of the remaining pool liquidity as an LP... returns your principal plus any pool surplus' — this moves cryptocurrency assets from the market pool back to the user's wallet
Attacks that exploit this kind of access
After a market resolves or is cancelled, withdraw your share of the remaining pool liquidity as an LP. Only callable on RESOLVED or CANCELLED markets. This is separate from LP fees; it returns your principal plus any pool surplus. It is categorised as a Financial tool in the Question Market MCP Server, which means it involves financial transactions. Block by default and require explicit approval.
Register the Question Market MCP server in PolicyLayer and add a rule for claim_lp_residual: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Question Market. Nothing to install.
claim_lp_residual is a Financial tool with critical risk. Critical-risk tools should be blocked by default and only enabled with explicit human approval.
Yes. Add a rate_limit block to the claim_lp_residual rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.
Set action: deny in the PolicyLayer policy for claim_lp_residual. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.
claim_lp_residual is provided by the Question Market MCP server (qmrkt/mcp-server). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.
Every MCP server has a record like this.
Type a name, get the same breakdown: verified identity, auth posture, risk grade, capabilities, recommended policy.
Teams ship this data inside their own products. See what a licence covers →