soroban_retrieve_contract_methods

THE RISK

Low Risk

Why soroban_retrieve_contract_methods needs a policy

This tool retrieves contract interface information, which is a read-only operation. It queries contract methods for inspection purposes, similar to introspection or schema discovery. There are no side effects, state changes, code execution, financial implications, or destructive actions involved.

From the tool's definition The tool 'soroban_retrieve_contract_methods' with description 'Retrieve the methods of a Soroban contract' performs a query operation that retrieves contract metadata without modifying, executing, or affecting contract state.

Documented attack patterns abuse exactly the kind of access soroban_retrieve_contract_methods gives an agent:

POLICY

How to control soroban_retrieve_contract_methods

PolicyLayer is an MCP gateway — it sits between your AI agents and Stellar MCP, and nothing reaches the server without passing your rules. This is the rule we recommend for soroban_retrieve_contract_methods:

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "soroban_retrieve_contract_methods": {}
  }
}

soroban_retrieve_contract_methods is read-only, so it stays allowed — but everything else on the server is denied unless you say otherwise.

Create a free account and register Stellar MCP — nothing to install.
Add this policy — paste it, or build it visually.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

CAP THIS TOOL →

Free to start. No card required.

EXPLORE

Related tools and policies

More Stellar MCP tools

Financial stellar_claim_claimable_balance Claim a claimable balance Financial stellar_create_claimable_balance Create a new claimable balance Financial stellar_fund_account Fund a test account using the Friendbot Financial stellar_payment Send a payment to another account Execute soroban_build_and_optimize Build and optimize a Soroban contract Execute soroban_deploy Deploy a Soroban contract Write stellar_change_trust Change trustline for an asset Write stellar_create_account Create a new Stellar Account

All 12 Stellar MCP tools →

Read tools on other servers

M-Team MCP Server get_torrent_detail YouTube MCP Server search_channel Android Forensics ADB MCP Server parse_browser_history 0xarchive web3_challenge

Go deeper

The MCP Attack Database → Documented attack patterns against MCP deployments — and the policies that stop them.
Data exfiltration → How read access becomes an exfiltration channel when chained with untrusted content.
MCP token cost → What connecting this server costs in context-window tokens on every request.
Rate Limiting MCP Tool Calls: A Practical Guide →
MCP Security: Why Prompt Guardrails Aren't Enough →

FAQ

Questions about soroban_retrieve_contract_methods

What does the soroban_retrieve_contract_methods tool do? +

Retrieve the methods of a Soroban contract. It is categorised as a Read tool in the Stellar MCP MCP Server, which means it retrieves data without modifying state.

How do I enforce a policy on soroban_retrieve_contract_methods? +

Register the Stellar MCP server in PolicyLayer and add a rule for soroban_retrieve_contract_methods: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Stellar MCP. Nothing to install.

What risk level is soroban_retrieve_contract_methods? +

soroban_retrieve_contract_methods is a Read tool with low risk. Read-only tools are generally safe to allow by default.

Can I rate-limit soroban_retrieve_contract_methods? +

Yes. Add a rate_limit block to the soroban_retrieve_contract_methods rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block soroban_retrieve_contract_methods completely? +

Set action: deny in the PolicyLayer policy for soroban_retrieve_contract_methods. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides soroban_retrieve_contract_methods? +

soroban_retrieve_contract_methods is provided by the Stellar MCP server (syronlabs/stellar-mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.

Enforce policy on every Stellar MCP tool call.

Start from Stellar MCP, add the rest of your stack, and see everything your agents can call. Then put policy on all of it.

CHECK YOUR STACK →