# Core MCP Server

The Core MCP Server gives AI agents controlled access to a Core wallet over
the [Model Context Protocol](https://modelcontextprotocol.io/). An agent —
Claude, ChatGPT, or anything else that speaks MCP — can list accounts, read
balances, and submit transactions for signing, **within limits the wallet
owner defines and signs**.

## How it differs from the provider API

The [injected provider](/docs/connect-your-dapp/core-extension) assumes a
human clicks "Approve" on every transaction. An agent has no human in the
loop at request time, so the MCP server replaces per-transaction approval
with a **pre-authorised policy**: the user decides in advance which accounts,
networks, spend limits, and recipients an agent may use, and signs that
policy with their wallet. Every tool call is evaluated against it before
anything is signed.

| | Provider API | MCP Server |
| --- | --- | --- |
| Caller | Dapp in the user's browser | AI agent, anywhere |
| Authorisation | Per-request approval screens | Signed, pre-authorised [policy](/docs/mcp/policy) |
| Transport | Injected object / WalletConnect | Streamable HTTP with OAuth |
| Custody | User's local keys | CubeSigner-held keys |

## What an agent can do

Six tools, covering account discovery, balances, and transaction submission
on EVM networks, Avalanche X/P-Chains, Solana, and Bitcoin — the full list
with parameters is in the [tool reference](/docs/mcp/tools).

An agent cannot: exceed the spend limit, use accounts or networks outside
the policy, send to recipients the policy excludes, or change the policy
itself — policy changes happen only in Core Web, signed by the user's wallet.

## Start here

1. [Quickstart](/docs/mcp/quickstart) — connect Claude or ChatGPT.
2. [Policy and permissions](/docs/mcp/policy) — what the agent may do.
3. [Security model](/docs/mcp/security) — what the boundary does and does not cover.