Core MCP Server
The Core MCP Server gives AI agents controlled access to a Core wallet over the Model Context Protocol. An agent — Claude, ChatGPT, or anything else that speaks MCP — can list accounts, read balances, and submit transactions for signing, within limits the wallet owner defines and signs.
How it differs from the provider API
The injected provider assumes a human clicks "Approve" on every transaction. An agent has no human in the loop at request time, so the MCP server replaces per-transaction approval with a pre-authorised policy: the user decides in advance which accounts, networks, spend limits, and recipients an agent may use, and signs that policy with their wallet. Every tool call is evaluated against it before anything is signed.
| Provider API | MCP Server | |
|---|---|---|
| Caller | Dapp in the user's browser | AI agent, anywhere |
| Authorisation | Per-request approval screens | Signed, pre-authorised policy |
| Transport | Injected object / WalletConnect | Streamable HTTP with OAuth |
| Custody | User's local keys | CubeSigner-held keys |
What an agent can do
Six tools, covering account discovery, balances, and transaction submission on EVM networks, Avalanche X/P-Chains, Solana, and Bitcoin — the full list with parameters is in the tool reference.
An agent cannot: exceed the spend limit, use accounts or networks outside the policy, send to recipients the policy excludes, or change the policy itself — policy changes happen only in Core Web, signed by the user's wallet.
Start here
- Quickstart — connect Claude or ChatGPT.
- Policy and permissions — what the agent may do.
- Security model — what the boundary does and does not cover.