Verify
Verify a contract and get one label. Free, and it never touches the credit ledger.
The Verify category is putty's security checks as two tools:
verify_methods and verify_contract. The order is the loop — read what this
deployment can verify, then verify something.
Read the methods first
verify_methods takes no arguments and answers with the three labels and what
each one means, the seven checks with their titles and their stated blind spots,
whether THIS deployment can read a contract's owner or run a project's tests and
fork simulation, and how many vetted templates are compiled here.
Two of its fields decide which labels are reachable at all:
liveReads— a deployment with no owner read and no sandbox reportsunknownfor every privileged function and skips tests-and-fork, which caps the label atexperimentalhowever clean the contract is.templates.compiled— at zero,verified templateis not reachable here whatever a contract looks like.
Both are facts about the deployment rather than about the contract, which is why they are served instead of assumed.
Verify a contract
verify_contract runs all seven checks and answers with the report, the label,
and what the label means. Send chain and abi; every other field unlocks a
check that otherwise skips:
| Field | The check it unlocks |
|---|---|
bytecode | template match — without it the report is experimental however clean the rest is |
source | static analysis — it skips rather than guessing from bytecode |
address | the owner read and the hook read |
isHook | the 14 permission bits a v4 hook's address encodes |
A skipped check is reported as skipped with a reason, never as a pass. A check
that did not run has verified nothing.
The one thing a report is not
clearedForMainnet is always false, and it is declared as the literal false
rather than a boolean precisely so the contract states what the code enforces:
no putty report, of any label, is an external audit. verified custom means
every check passed and putty has not had the contract audited. labelExplanation
is the sentence that must be shown beside the label, and it is part of the
report for that reason.
The paid review is not here
POST /verify/ai-review runs several model passes over the same source and
costs credits. It is not exposed as an MCP tool, and the omission is the
design: the only gate putty has for work that spends money is the run approval
path, and a direct tool call has no run to ask through. A tool that charged
outside it would spend without asking, which is worse than a missing tool.
tx_request_status
Read one signing request by id and see what happened to it. Call this after any value-moving tool: that tool returns a `TxRequest` with a `status` of `pending` and a `summary` of what the transaction would do, and this is how you learn whether the user signed, whether the transaction confirmed onchain, or whether it reverted. Works for both kinds of caller — a dashboard user polling a request the website is showing, and an external agent polling one it created with an `sk-` key. putty never signs: you sign with your own wallet and report the hash with `POST /tx-requests/{id}/submitted` (or the dashboard posts it for you). A request owned by another user answers exactly as a request that does not exist, so a wrong id is indistinguishable from a missing one.
verify_methods
Read what this deployment can actually verify, before verifying anything: the three labels and what each one means, the seven checks with their titles and their stated blind spots, whether this deployment can read a contract's owner or run a project's tests and fork simulation, and how many vetted templates are compiled here. Takes no arguments and is free. Call it first when you are about to tell a user what a label means — `liveReads` and `templates.compiled` decide which labels are reachable on this deployment, and both are facts about THIS deployment rather than about the contract. A deployment with no owner read and no sandbox reports `unknown` for every privileged function and skips tests-and-fork, which caps the label at `experimental` however clean the contract is.