metamask-agent-wallet

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

MetaMask Agentic CLI Skill

MetaMask Agentic CLI 技能

This skill documents the
mm
CLI surface for MetaMask Agent Wallet authentication, wallet lifecycle, balance queries, token transfers, message and typed-data signing, raw transactions, chain discovery, market data, token discovery, perpetual futures trading, prediction market trading, prediction trade/redeem history, token swaps, cross-chain bridges, DeFi earn/yield vaults, and EVM calldata decoding.
Use the routing table to select the relevant reference file. CLI behavior lives in
references/
. Repeatable operational patterns live in
workflows/
.
本技能记录了用于MetaMask Agent钱包身份验证、钱包生命周期、余额查询、代币转账、消息与类型数据签名、原始交易、链发现、市场数据、代币发现、永续期货交易、预测市场交易、预测交易/赎回历史、代币兑换、跨链桥、DeFi收益/收益金库以及EVM calldata解码的
mm
CLI接口。
使用路由表选择相关参考文件。CLI行为在
references/
目录下。可重复的操作模式在
workflows/
目录下。

Command Routing

命令路由

Match the user's intent to a command and reference file, then read the reference before constructing a command. If intent spans multiple domains, load them sequentially in dependency order.
User IntentCommandReference
Check authentication status
mm auth status
auth.md
Login in MetaMask Agentic CLI
mm login
auth.md
Choose a wallet mode and set up policies
mm init
auth.md
Show current init settings
mm init show
auth.md
Sign in via QR code with MetaMask Mobile
mm login qr
auth.md
Sign in via browser (Google or Email)
mm login browser
auth.md
Sign out
mm logout
auth.md
Reset CLI session
mm reset
auth.md
Show CLI configuration
mm config get
auth.md
Set CLI configuration
mm config set
auth.md
Set BYOK mnemonic encryption password
mm wallet password set
auth.md
Change BYOK mnemonic encryption password
mm wallet password change
auth.md
Remove BYOK mnemonic encryption password
mm wallet password remove
auth.md
Interpret raw CLI error codes
AuthError
,
ValidationError
,
WALLET_ERROR
errors.md
Inspect CLI, skills, environment, and session health
mm doctor
doctor.md
Decode EVM calldata into a human-readable intent
mm decode
decode.md
Create a wallet
mm wallet create
wallet.md
List all wallets
mm wallet list
wallet.md
Switch active wallet
mm wallet select
wallet.md
Show active wallet details
mm wallet show
wallet.md
Show active wallet address
mm wallet address
wallet.md
Check the active wallet balance
mm wallet balance
wallet.md
Show a QR code and address to fund the active wallet
mm wallet add-fund
wallet.md
Show current trading mode
mm wallet trading-mode get
wallet.md
Set trading mode to guard or beast
mm wallet trading-mode set
wallet.md
View wallet policy
mm wallet policy get
wallet.md
Set wallet policy
mm wallet policy set
wallet.md
Show project policy template
mm wallet policy template
wallet.md
Sign a plaintext message
mm wallet sign-message
signing.md
Sign EIP-712 typed data
mm wallet sign-typed-data
signing.md
Send a raw EVM transaction
mm wallet send-transaction
transaction.md
Transfer native tokens or ERC-20 tokens
mm transfer
transfer.md
List supported chains by the CLI
mm chains list
chain.md
List pending wallet requests
mm wallet requests list
polling.md
Watch a wallet polling id
mm wallet requests watch
polling.md
Query spot or historical prices
mm price ...
market-data.md
Discover tokens, token networks, or token metadata
mm token ...
market-data.md
List perpetual markets
mm perps markets
perps.md
Check perps account balance
mm perps balance
perps.md
List open perpetual positions
mm perps positions
perps.md
Get a quote for a perpetual order
mm perps quote
perps.md
List resting perpetual orders
mm perps orders
perps.md
Open a perpetual position
mm perps open
perps.md
Close a perpetual position
mm perps close
perps.md
Modify leverage, take-profit, or stop-loss
mm perps modify
perps.md
Cancel a resting perps order
mm perps cancel
perps.md
Deposit USDC into a perps venue
mm perps deposit
perps.md
Withdraw USDC from a perps venue
mm perps withdraw
perps.md
Transfer USDC between spot and perp accounts
mm perps transfer
perps.md
List perpetual futures venues
mm perps list-venues
perps.md
List available DEXs for a venue
mm perps dexs
perps.md
Set Predict trading mode
mm predict mode
predict.md
One-time Predict setup
mm predict setup
predict.md
Create or refresh Predict credentials
mm predict auth
predict.md
Repair Predict approvals
mm predict approve
predict.md
Check Predict back-end status and account setup
mm predict status
predict.md
Check if Polymarket is geoblocked for your IP
mm predict geoblock
predict.md
List prediction markets
mm predict markets list
predict.md
Search prediction markets
mm predict markets search
predict.md
Inspect a prediction market
mm predict markets get
predict.md
List Polymarket events
mm predict events list
predict.md
Inspect a Polymarket event
mm predict events get
predict.md
List Polymarket event series
mm predict series list
predict.md
Inspect a Polymarket event series
mm predict series get
predict.md
List Polymarket tags
mm predict tags list
predict.md
Inspect a Polymarket tag
mm predict tags get
predict.md
Preview a prediction order cost
mm predict quote
predict.md
Place a prediction market order
mm predict place
predict.md
Cancel prediction orders
mm predict cancel
predict.md
View prediction market positions
mm predict positions
predict.md
View open prediction orders
mm predict orders
predict.md
Show full Predict portfolio snapshot
mm predict portfolio
predict.md
List redeemable winning positions
mm predict redeem list
predict.md
Redeem winning positions
mm predict redeem
predict.md
Check Predict deposit wallet balance
mm predict balance
predict.md
Fund Predict deposit wallet
mm predict deposit
predict.md
Withdraw pUSD from Predict deposit wallet
mm predict withdraw
predict.md
Fetch prediction order book
mm predict book
predict.md
Watch a Predict job
mm predict watch
predict.md
List Predict trade or redeem history
mm predict history
predict.md
Inspect Predict history for a specific market
mm predict history get
predict.md
Look up a transaction by hash
mm tx
tx-history.md
List recent transactions for the active wallet
mm tx history
tx-history.md
Get a swap or bridge quote
mm swap quote
swap.md
Execute a token swap or bridge
mm swap execute
swap.md
Check swap or bridge status
mm swap status
swap.md
Bridge tokens to another chain
mm swap execute
swap.md
Pay an HTTP
402
/ x402 paywalled request
python3 scripts/x402_pay.py
x402.md
List earn vaults and APYs
mm earn markets
earn.md
View earn vault positions
mm earn positions
earn.md
Supply tokens to an earn vault
mm earn supply
earn.md
Withdraw tokens from an earn vault
mm earn withdraw
earn.md
将用户意图匹配到对应的命令和参考文件,然后在构造命令前阅读参考内容。如果意图涉及多个领域,按依赖顺序依次加载相关内容。
用户意图命令参考文件
检查身份验证状态
mm auth status
auth.md
登录MetaMask Agentic CLI
mm login
auth.md
选择钱包模式并设置策略
mm init
auth.md
显示当前初始化设置
mm init show
auth.md
通过MetaMask移动端扫码登录
mm login qr
auth.md
通过浏览器(谷歌或邮箱)登录
mm login browser
auth.md
登出
mm logout
auth.md
重置CLI会话
mm reset
auth.md
显示CLI配置
mm config get
auth.md
设置CLI配置
mm config set
auth.md
设置BYOK助记词加密密码
mm wallet password set
auth.md
修改BYOK助记词加密密码
mm wallet password change
auth.md
移除BYOK助记词加密密码
mm wallet password remove
auth.md
解析原始CLI错误码
AuthError
,
ValidationError
,
WALLET_ERROR
errors.md
检查CLI、技能、环境和会话健康状态
mm doctor
doctor.md
将EVM calldata解码为人类可读的意图
mm decode
decode.md
创建钱包
mm wallet create
wallet.md
列出所有钱包
mm wallet list
wallet.md
切换活跃钱包
mm wallet select
wallet.md
显示活跃钱包详情
mm wallet show
wallet.md
显示活跃钱包地址
mm wallet address
wallet.md
检查活跃钱包余额
mm wallet balance
wallet.md
显示二维码和地址以给活跃钱包充值
mm wallet add-fund
wallet.md
显示当前交易模式
mm wallet trading-mode get
wallet.md
将交易模式设置为guard或beast
mm wallet trading-mode set
wallet.md
查看钱包策略
mm wallet policy get
wallet.md
设置钱包策略
mm wallet policy set
wallet.md
显示项目策略模板
mm wallet policy template
wallet.md
签署明文消息
mm wallet sign-message
signing.md
签署EIP-712类型数据
mm wallet sign-typed-data
signing.md
发送原始EVM交易
mm wallet send-transaction
transaction.md
转账原生代币或ERC-20代币
mm transfer
transfer.md
列出CLI支持的链
mm chains list
chain.md
列出待处理的钱包请求
mm wallet requests list
polling.md
监听钱包轮询ID
mm wallet requests watch
polling.md
查询现货或历史价格
mm price ...
market-data.md
发现代币、代币网络或代币元数据
mm token ...
market-data.md
列出永续市场
mm perps markets
perps.md
检查永续账户余额
mm perps balance
perps.md
列出未平仓永续头寸
mm perps positions
perps.md
获取永续订单报价
mm perps quote
perps.md
列出挂单永续订单
mm perps orders
perps.md
开永续头寸
mm perps open
perps.md
平永续头寸
mm perps close
perps.md
修改杠杆、止盈或止损
mm perps modify
perps.md
取消挂单永续订单
mm perps cancel
perps.md
将USDC存入永续交易场所
mm perps deposit
perps.md
从永续交易场所提取USDC
mm perps withdraw
perps.md
在现货账户和永续账户之间划转USDC
mm perps transfer
perps.md
列出永续期货交易场所
mm perps list-venues
perps.md
列出交易场所支持的DEX
mm perps dexs
perps.md
设置Predict交易模式
mm predict mode
predict.md
Predict一次性设置
mm predict setup
predict.md
创建或刷新Predict凭证
mm predict auth
predict.md
修复Predict授权
mm predict approve
predict.md
检查Predict后端状态和账户设置
mm predict status
predict.md
检查Polymarket是否对当前IP进行地域限制
mm predict geoblock
predict.md
列出预测市场
mm predict markets list
predict.md
搜索预测市场
mm predict markets search
predict.md
查看预测市场详情
mm predict markets get
predict.md
列出Polymarket事件
mm predict events list
predict.md
查看Polymarket事件详情
mm predict events get
predict.md
列出Polymarket事件系列
mm predict series list
predict.md
查看Polymarket事件系列详情
mm predict series get
predict.md
列出Polymarket标签
mm predict tags list
predict.md
查看Polymarket标签详情
mm predict tags get
predict.md
预览预测订单成本
mm predict quote
predict.md
下达预测市场订单
mm predict place
predict.md
取消预测订单
mm predict cancel
predict.md
查看预测市场头寸
mm predict positions
predict.md
查看未平仓预测订单
mm predict orders
predict.md
显示完整的Predict投资组合快照
mm predict portfolio
predict.md
列出可赎回的盈利头寸
mm predict redeem list
predict.md
赎回盈利头寸
mm predict redeem
predict.md
检查Predict存款钱包余额
mm predict balance
predict.md
给Predict存款钱包充值
mm predict deposit
predict.md
从Predict存款钱包提取pUSD
mm predict withdraw
predict.md
获取预测订单簿
mm predict book
predict.md
监听Predict任务
mm predict watch
predict.md
列出Predict交易或赎回历史
mm predict history
predict.md
查看特定市场的Predict历史
mm predict history get
predict.md
通过哈希查询交易
mm tx
tx-history.md
列出活跃钱包的近期交易
mm tx history
tx-history.md
获取兑换或跨链桥报价
mm swap quote
swap.md
执行代币兑换或跨链桥操作
mm swap execute
swap.md
检查兑换或跨链桥状态
mm swap status
swap.md
将代币跨链到其他链
mm swap execute
swap.md
支付HTTP
402
/ x402付费请求
python3 scripts/x402_pay.py
x402.md
列出收益金库和年化收益率(APY)
mm earn markets
earn.md
查看收益金库头寸
mm earn positions
earn.md
向收益金库存入代币
mm earn supply
earn.md
从收益金库提取代币
mm earn withdraw
earn.md

Workflows

工作流

CLI behavior lives in
references/
. Repeatable patterns live in
workflows/
. Load a workflow file when the user's request is a pattern, not a single command.
PatternWorkflow
First time setup and onboardingonboarding.md
Login flowlogin.md
Troubleshooting decision treetroubleshooting.md
Swap quote-review-execute flowswap.md
Bridge quote-review-execute flowbridge.md
Open a perpetual position flowperps-open-position.md
Close a perpetual position flowperps-close-position.md
Modify a perpetual position flowperps-modify-position.md
Predict first-time setup and credentialspredict-setup.md
Deposit or withdraw pUSD from Predict walletpredict-funding.md
Search and browse prediction marketspredict-markets.md
Quote and place a prediction orderpredict-place-order.md
View or cancel Predict orders and positionspredict-manage-orders.md
View Predict portfolio and redeem winningspredict-portfolio.md
View Predict trade and redeem historypredict-history.md
Token discovery, prices, and market datamarket-data.md
Supply tokens to earn yieldearn-supply.md
Withdraw tokens from an earn vaultearn-withdraw.md
Pay an HTTP
402
(x402) paywalled request
x402-pay.md
CLI行为在
references/
目录下。可重复的操作模式在
workflows/
目录下。当用户请求是一种操作模式而非单一命令时,加载对应的工作流文件。
操作模式工作流
首次设置与入门onboarding.md
登录流程login.md
故障排除决策树troubleshooting.md
兑换报价-审核-执行流程swap.md
跨链桥报价-审核-执行流程bridge.md
开永续头寸流程perps-open-position.md
平永续头寸流程perps-close-position.md
修改永续头寸流程perps-modify-position.md
Predict首次设置与凭证配置predict-setup.md
向Predict钱包存入或提取pUSDpredict-funding.md
搜索与浏览预测市场predict-markets.md
预测订单报价与下达predict-place-order.md
查看或取消Predict订单与头寸predict-manage-orders.md
查看Predict投资组合与赎回盈利predict-portfolio.md
查看Predict交易与赎回历史predict-history.md
代币发现、价格与市场数据market-data.md
向收益金库存入代币获取收益earn-supply.md
从收益金库提取代币earn-withdraw.md
支付HTTP
402
(x402)付费请求
x402-pay.md

Global Flags

全局标志

Every
mm
command accepts these flags:
FlagShortDescription
--format
-f
Output format:
text
,
json
, or
toon
. Defaults to
text
in TTY,
json
when piped
--json
Shorthand for
--format=json
--toon
Shorthand for
--format=toon
--verbose
-v
Show debug logs on stderr. Use for troubleshooting
Always use
--toon
for command output unless the user explicitly requests a different format.
每个
mm
命令都支持以下标志:
标志简写描述
--format
-f
输出格式:
text
json
toon
。在TTY环境下默认是
text
,管道传输时默认是
json
--json
--format=json
的简写
--toon
--format=toon
的简写
--verbose
-v
在stderr显示调试日志,用于故障排除
除非用户明确要求其他格式,否则始终使用
--toon
作为命令输出格式。

Preflight

预检

Run these checks before the first CLI operation in a session, in order.
在会话中首次执行CLI操作前,按顺序运行以下检查。

1. Version compatibility

1. 版本兼容性

This skill is written for
@metamask/agent-wallet
v6.0.0, as specified by
cliVersion
in the frontmatter. Check the installed version:
bash
mm --version
The installed version is the value after
@metamask/agent-wallet/
, such as
@metamask/agent-wallet/2.0.0 darwin-arm64 node-v22.18.0
. Compare its
major.minor
against the pinned
cliVersion
. Optionally check the latest published version (best-effort, skip silently on network failure:
bash
npm view @metamask/agent-wallet version
If the installed
major.minor
differs from the pinned
cliVersion
, or the installed version is behind the latest release, warn the user once and continue:
Version mismatch: installed CLI
<installed>
, this skill is pinned to
5.2.1
, latest release is
<latest>
. Command syntax in this skill may be inaccurate until they are aligned. Update the CLI with
npm install -g @metamask/agent-wallet@latest
, then re-install the skills with
npx skills add metaMask/agent-skills
.
Run this check once per session. Do not block operations on it.
本技能是为
@metamask/agent-wallet
v6.0.0编写的,如前置元数据中的
cliVersion
所指定。检查已安装的版本:
bash
mm --version
已安装版本是
@metamask/agent-wallet/
之后的值,例如
@metamask/agent-wallet/2.0.0 darwin-arm64 node-v22.18.0
。将其
major.minor
版本与固定的
cliVersion
对比。可选地检查最新发布版本(尽最大努力执行,网络失败时静默跳过):
bash
npm view @metamask/agent-wallet version
如果已安装的
major.minor
版本与固定的
cliVersion
不同,或者已安装版本落后于最新发布版本,向用户发出一次警告后继续操作:
版本不匹配:已安装CLI版本为
<installed>
,本技能固定为
5.2.1
,最新发布版本为
<latest>
。在版本对齐前,本技能中的命令语法可能不准确。使用
npm install -g @metamask/agent-wallet@latest
更新CLI,然后使用
npx skills add metaMask/agent-skills
重新安装技能。
每个会话仅运行一次此检查,不要阻止后续操作。

2. Readiness gate — authentication and initialization

2. 就绪检查 — 身份验证与初始化

mm doctor
is the single readiness check. Run it before the first CLI operation in a session:
bash
mm doctor
It reports an
authenticated
boolean, an
initialized
boolean, and a list of
hints
. Do not run any other command until
mm doctor
reports both
authenticated: true
and
initialized: true
. Authentication and initialization are independent gates: a session can be authenticated while the project has no wallet mode selected, in which case any command that needs a wallet aborts before running with
NOT_INITIALIZED
— "Project not initialized." with hint: Run
mm init
to set up wallet and trading modes.
A project counts as initialized only when a wallet mode is set — and, for
server-wallet
, a trading mode is set as well.
byok
needs only the wallet mode. Do not use
mm init show
as the check: it requires an initialized project and throws
NOT_INITIALIZED
on an uninitialized one rather than reporting state.
Remediate, then re-run
mm doctor
and confirm a clean result before doing anything else:
  • authenticated: false
    → follow
    workflows/login.md
    , or
    workflows/onboarding.md
    for first-time setup, to run
    mm login
    .
  • authenticated: true
    and
    initialized: false
    → follow
    workflows/onboarding.md
    to run
    mm init
    and select a wallet mode. For server-wallet, also select a trading mode.
mm doctor
是唯一的就绪检查命令。在会话中首次执行CLI操作前运行:
bash
mm doctor
它会返回
authenticated
布尔值、
initialized
布尔值以及
hints
列表。在
mm doctor
返回
authenticated: true
initialized: true
之前,不要执行任何其他命令。身份验证和初始化是独立的检查项:会话可能已通过身份验证,但项目未选择钱包模式,此时任何需要钱包的命令会在执行前终止并返回
NOT_INITIALIZED
— "项目未初始化。",提示:运行
mm init
设置钱包和交易模式。
只有当设置了钱包模式后,项目才被视为已初始化 — 对于
server-wallet
,还需要设置交易模式。
byok
仅需设置钱包模式。不要使用
mm init show
作为检查命令:它要求项目已初始化,否则会抛出
NOT_INITIALIZED
错误而非报告状态。
修复问题后,重新运行
mm doctor
并确认结果正常后再执行其他操作:
  • authenticated: false
    → 遵循
    workflows/login.md
    ,或首次设置时遵循
    workflows/onboarding.md
    ,运行
    mm login
  • authenticated: true
    initialized: false
    → 遵循
    workflows/onboarding.md
    ,运行
    mm init
    并选择钱包模式。对于server-wallet,还需选择交易模式。

Safety Rules

安全规则

These rules apply to every operation, regardless of which reference or workflow is active.
无论使用哪个参考文件或工作流,以下规则适用于所有操作。

Input Validation

输入验证

Before constructing any command, validate all user-provided values:
FlagValidation rule
--to
,
--address
Must match
^0x[0-9a-fA-F]{40}$
--amount
Human-readable decimal such as 0.5 or 100. Must match
^\d+\.?\d*$
. Reject spaces, semicolons, pipes, backticks, or shell metacharacters
--chain-id
Must be a positive integer (
^\d+$
)
--payload
for send-transaction
Must be valid JSON. No unescaped shell metacharacters outside the JSON structure
--payload
for decode
Must be 0x-prefixed hex calldata, matching
^0x[0-9a-fA-F]+$
--token
Must be a valid hex address or known symbol
--leverage
Must be a positive integer (
^\d+$
)
--size
Human-readable decimal such as 0.01 or 1. Must match
^\d+\.?\d*$
and be positive
--venue
Must be
hyperliquid
--side
for perps
Must be
long
or
short
--order-id
Must be a positive integer (
^\d+$
)
--token-id
Must be a non-empty outcome token ID string
--price
,
--limit-price
Must be a positive number in range
(0, 1]
--order-type
Must be one of
GTC
,
GTD
,
FOK
,
FAK
--side
for predict
Must be
buy
or
sell
--slippage
Must be a number between 0 and 100
--tick-size
Must be one of
0.1
,
0.01
,
0.005
,
0.0025
,
0.001
,
0.0001
--from-chain-id
,
--to-chain-id
Must be a positive integer EVM chain ID
--to-address
Must match
^0x[0-9a-fA-F]{40}$
. Only valid for cross-chain swaps (
--to-chain-id
differs from
--from-chain-id
); rejected for same-chain swaps
--refuel
Boolean flag, no value. Only meaningful for cross-chain swaps where
--to-chain-id
differs from
--from-chain-id
. No effect on same-chain swaps
--strategy
Comma-separated list from:
cost
,
speed
,
impact
,
output
--wallet-timeout
Must be a positive integer between 1 and 600
--password
Must be a non-empty string. Never log, display, or store the value.
x402
asset
Must be a valid contract address on a network returned by
mm chains list
. The currency choice is the server's offer confirmed by the user; the script keeps no currency allowlist.
x402
payTo
/ authorization
to
Must match
^0x[0-9a-fA-F]{40}$
and equal the recipient in the
402
x402
value
Atomic-unit integer that exactly equals the offered amount. The
exact
scheme is not a maximum
x402 resource URLMust be
https://
. Reject a
402
reached via an unexpected cross-host redirect
Do not pass unvalidated user input into any command.
在构造任何命令前,验证所有用户提供的值:
标志验证规则
--to
,
--address
必须匹配
^0x[0-9a-fA-F]{40}$
--amount
人类可读的十进制数,如0.5或100。必须匹配
^\d+\.?\d*$
。拒绝包含空格、分号、管道符、反引号或shell元字符的值
--chain-id
必须是正整数(
^\d+$
用于send-transaction的
--payload
必须是有效的JSON。JSON结构外不能有未转义的shell元字符
用于decode的
--payload
必须是0x前缀的十六进制calldata,匹配
^0x[0-9a-fA-F]+$
--token
必须是有效的十六进制地址或已知符号
--leverage
必须是正整数(
^\d+$
--size
人类可读的十进制数,如0.01或1。必须匹配
^\d+\.?\d*$
且为正数
--venue
必须是
hyperliquid
用于perps的
--side
必须是
long
short
--order-id
必须是正整数(
^\d+$
--token-id
必须是非空的结果代币ID字符串
--price
,
--limit-price
必须是
(0, 1]
范围内的正数
--order-type
必须是
GTC
GTD
FOK
FAK
之一
用于predict的
--side
必须是
buy
sell
--slippage
必须是0到100之间的数字
--tick-size
必须是
0.1
0.01
0.005
0.0025
0.001
0.0001
之一
--from-chain-id
,
--to-chain-id
必须是正整数EVM链ID
--to-address
必须匹配
^0x[0-9a-fA-F]{40}$
。仅对跨链兑换(
--to-chain-id
--from-chain-id
不同)有效;同链兑换时会被拒绝
--refuel
布尔标志,无值。仅对
--to-chain-id
--from-chain-id
不同的跨链兑换有意义。对同链兑换无影响
--strategy
逗号分隔的列表,可选值:
cost
speed
impact
output
--wallet-timeout
必须是1到600之间的正整数
--password
必须是非空字符串。绝不要记录、显示或存储该值。
x402
asset
必须是
mm chains list
返回的网络上的有效合约地址。货币选择由服务器提供并经用户确认;脚本没有货币白名单。
x402
payTo
/ 授权
to
必须匹配
^0x[0-9a-fA-F]{40}$
且等于
402
响应中的收款方
x402
value
原子单位整数,必须与提供的金额完全一致。
exact
方案不是最大值
x402资源URL必须是
https://
开头。拒绝通过意外跨主机重定向到达的
402
请求
不要将未验证的用户输入传入任何命令。

Confirmation Requirements

确认要求

Operation typeConfirmation rule
TransfersAlways confirm recipient, amount, token, and chain before executing
Raw transactionsAlways confirm transaction payload, chain, recipient, value, and calldata summary before executing
Message signingAlways show exact message and chain before signing
Typed-data signingAlways show domain, primary type, chain, verifying contract, and message summary before signing
Swaps / bridgesAlways confirm from/to tokens, amount, source/destination chain, slippage, quoted output, recipient address if
--to-address
is set, and the destination gas top-up if
--refuel
is set before executing
x402 paymentsAlways confirm asset, decimals-correct amount, network,
payTo
, and resource URL before signing the authorization. One payment attempt per resource, never auto-retry a payment. Autonomous auto-pay is not supported.
Perps tradingAlways confirm symbol, side, size, leverage, venue, order type, and limit price if present before executing
Perps deposit/withdrawAlways confirm amount, asset, venue, network, and destination where applicable before executing
Predict tradingAlways confirm token ID, side, size, price, order type, market, and outcome before executing
Predict depositAlways confirm amount before executing
Predict withdrawAlways confirm amount and recipient before executing.
--to
defaults to owner EOA
Predict redeemAlways confirm the target, either condition ID or
--all
, before executing.
--all
redeems every winning position
Earn supplyAlways confirm token, amount, chain, vault/protocol, and APY before executing. For cross-chain supply, also confirm source chain and source token
Earn withdrawAlways confirm token, amount or full balance, chain, and vault/protocol before executing
Cancel-all operationsAlways confirm scope and exact destructive effect before executing
Wallet policy changesBroadening policy changes require MFA approval; non-broadening changes apply immediately
Trading mode changesBroadening from guard to beast requires MFA approval. Tightening from beast to guard applies immediately
Auth / wallet managementMay execute without confirmation, except
reset
which requires explicit user confirmation
Read-only queriesMay execute without confirmation
操作类型确认规则
转账执行前始终确认收款方、金额、代币和链
原始交易执行前始终确认交易负载、链、收款方、金额和calldata摘要
消息签名签名前始终显示完整消息和链
类型数据签名签名前始终显示域、主类型、链、验证合约和消息摘要
兑换/跨链桥执行前始终确认转出/转入代币、金额、源/目标链、滑点、报价输出、若设置
--to-address
则确认收款方地址、若设置
--refuel
则确认目标链燃气充值金额
x402支付签署授权前始终确认资产、金额(小数正确)、网络、
payTo
和资源URL。每个资源仅支付一次,绝不自动重试支付。不支持自主自动支付。
永续交易执行前始终确认标的、方向、规模、杠杆、交易场所、订单类型,若有则确认限价
永续存入/提取执行前始终确认金额、资产、交易场所、网络,若有则确认目标地址
预测交易执行前始终确认代币ID、方向、规模、价格、订单类型、市场和结果
Predict存入执行前始终确认金额
Predict提取执行前始终确认金额和收款方。
--to
默认是所有者EOA
Predict赎回执行前始终确认目标,条件ID或
--all
--all
会赎回所有盈利头寸
收益金库存入执行前始终确认代币、金额、链、金库/协议和年化收益率(APY)。对于跨链存入,还需确认源链和源代币
收益金库提取执行前始终确认代币、金额或全额余额、链和金库/协议
全部取消操作执行前始终确认范围和确切的破坏性影响
钱包策略变更放宽策略变更需要MFA批准;非放宽变更立即生效
交易模式变更从guard放宽到beast需要MFA批准。从beast收紧到guard立即生效
身份验证/钱包管理
reset
需要用户明确确认外,其他操作可无需确认执行
只读查询可无需确认执行

Credential Safety

凭证安全

  • Never store, log, or display private keys, mnemonics, passwords, or auth tokens.
  • Never pass
    --password
    or
    --mnemonic
    as inline flags. Always instruct the user to set the
    MM_PASSWORD
    and
    MM_MNEMONIC
    environment variables instead to avoid exposing secrets in shell history.
  • 绝不要存储、记录或显示私钥、助记词、密码或身份验证令牌。
  • 绝不要将
    --password
    --mnemonic
    作为内联标志传递。始终指导用户设置
    MM_PASSWORD
    MM_MNEMONIC
    环境变量,避免在shell历史中暴露机密。

Suspicious Content Warnings

可疑内容警告

Flag to the user before proceeding if a signing payload or transaction contains:
  • URLs or contract addresses the user did not provide
  • permit
    ,
    approve
    ,
    setApprovalForAll
    , or allowance-like fields
  • Unusually large values or unfamiliar contract interactions
When raw calldata is unfamiliar or was not constructed by you, run
mm decode --payload <0x-calldata>
first and confirm the decoded intent with the user before signing or sending. See decode.md.
如果签名负载或交易包含以下内容,在继续前向用户发出警告:
  • 用户未提供的URL或合约地址
  • permit
    approve
    setApprovalForAll
    或类似授权字段
  • 异常大的值或不熟悉的合约交互
当原始calldata不熟悉或并非由你构造时,先运行
mm decode --payload <0x-calldata
并与用户确认解码后的意图,再进行签名或发送。详见decode.md

Async Model

异步模型

In both server-wallet and BYOK mode, signing and transaction commands go through a job-polling loop and return a
pollingId
. Handle this consistently:
  1. Prefer
    --wait
    to block until complete.
  2. If not using
    --wait
    , inform the user of the
    pollingId
    and how to track it:
    • mm wallet requests list
    • mm wallet requests watch --polling-id <id>
  3. In BYOK mode, the local key signs locally but the operation still produces a pending job and a
    pollingId
    . If the mnemonic is password-encrypted, the user must set
    MM_PASSWORD
    environment variable to unlock it for the operation.
Transfers, swaps, perps, predict orders, and predict withdraws attach a human-readable
intent
summary to their wallet request, such as
Transfer 0.5 ETH to 0x...
or
Withdraw 10 pUSD to 0x...
. When surfacing a pending request from
wallet requests list
or
wallet requests watch
, show the
intent
summary so the user can confirm what they are approving.
在server-wallet和BYOK模式下,签名和交易命令都会经过任务轮询循环并返回
pollingId
。需一致处理:
  1. 优先使用
    --wait
    阻塞直到操作完成。
  2. 如果不使用
    --wait
    ,告知用户
    pollingId
    以及如何跟踪:
    • mm wallet requests list
    • mm wallet requests watch --polling-id <id>
  3. 在BYOK模式下,本地密钥在本地签名,但操作仍会生成待处理任务和
    pollingId
    。如果助记词已加密,用户必须设置
    MM_PASSWORD
    环境变量才能解锁以执行操作。
转账、兑换、永续交易、Predict订单和Predict提取操作会在钱包请求中附加人类可读的
intent
摘要,例如
Transfer 0.5 ETH to 0x...
Withdraw 10 pUSD to 0x...
。当从
wallet requests list
wallet requests watch
中显示待处理请求时,展示
intent
摘要以便用户确认他们要批准的内容。

Output Rules

输出规则

  • Route silently. Do not announce which reference you are loading.
  • Surface errors from commands verbatim. Do not mask or reword them.
  • If a command fails, check
    mm <command> --help
    and guide from there.
  • 静默路由,不要宣布正在加载哪个参考文件。
  • 原样展示命令返回的错误,不要掩盖或改写。
  • 如果命令失败,检查
    mm <command> --help
    并据此指导用户。