MCP worked because tools are typed. Tokens are not.

An agent handed a wallet can enumerate its balances. It cannot enumerate what it is allowed to do with them. That is the whole problem, and the panel above is the whole proof: nine real assets on Base, four different shapes of rule, and no common way to ask.

The rules exist. USDC can freeze you, Centrifuge runs a compliance hook, three of the nine have an owner who can act. What does not exist is a common way to ask about any of it, so for five of the nine the only way to find out is to try and read an opaque revert.

The registry does not believe anyone. It asks.

register(asset) staticcalls every interface we know how to ask about, with a gas cap on each, and records only what actually answered. Nobody submits a manifest, nobody is trusted, and a token that reverts or burns gas on its own compliance function is simply recorded as not answering. It cannot break its own registration.

// AssetRegistry.sol
function _answers(address a, bytes memory data) internal view returns (bool) {
    (bool ok, bytes memory ret) = a.staticcall{gas: 60_000}(data);
    return ok && ret.length >= 32;
}

The shape an MCP tool hands back to a model.

Verdict{ ok, code, reason, checked }. The code is a stable enum. The reason is the asset's own sentence where it has one. And checked says which capabilities were actually consulted, because an agent has to be able to tell allowed from I could not find out. A thin mask is not a clean bill of health, and this is the difference between a tool a model can reason about and a boolean it has to trust.

Approve the walls once, not every transaction.

Approving every transaction does not scale, and the deeper problem is that the person approving at three in the morning knows less about the trade than the agent does. Approval theatre is not safety.

So the human approves the walls: which assets, how much per action, how much in total, to whom, until when. The agent acts freely inside them. Stepping outside is not discouraged, it is impossible, because the executor holds the money and the only way out is act, which moves one asset to one recipient and nothing else. There is no generic call and no calldata a caller can shape.

Four tools a model can actually use.

Rised ships an MCP server. Point any MCP client at it and a model can ask a token what it will allow, before it proposes a transaction, in the vocabulary it already reasons in.

// what rised_preflight actually returns, live from Base
{
  "ok": false,
  "code": "INSUFFICIENT_BALANCE",
  "reason": "sender holds less than the amount",
  "checked": ["balance"],
  "notChecked": ["erc1404", "allowlist", "freezable"],
  "atBlock": "50570985"
}

notChecked is the part that matters. A model that only sees ok: true will treat silence as permission. A model that also sees which questions were never asked can say so, and can refuse to promise what it did not verify.

{
  "mcpServers": {
    "rised": { "command": "npx", "args": ["-y", "rised-mcp"] }
  }
}

It earns from use, and from nothing else.

The executor charges a fee on successful actions, immutable and capped at 0.25% when it is constructed. It has exactly one destination, written into the contract before the first action and never writable again, and it is paid inside the same transaction as the action. No emission, no schedule, no inflation. If no agent acts, nothing is collected, and that is correct rather than a bug.

Where this is weaker than it sounds.