IronWallet for AI agents

The IronWallet MCP server gives AI agents secure access to a non-custodial wallet. Seed phrases stay encrypted on the host and never leave this machine. Agents can retrieve balances, sign locally, transfer tokens, and swap across 10+ networks.

Seed-compatible with the IronWallet app. There is no per-transaction confirmation UI.

Requirements: Node.js 20+ (npx). Use a dedicated wallet with limited balance.

Product page: ironwallet.io/ai. Machine-readable index: llms.txt.

Opening this repository in Claude Code starts the wallet MCP via .mcp.json. See CLAUDE.md.

Install

Cursor: ironwallet.io/ai

Claude Code:

claude plugin marketplace add ironwallet/ironwallet-agent-kit
claude plugin install ironwallet-mcp@ironwallet

Codex:

codex plugin marketplace add ironwallet/ironwallet-agent-kit
codex plugin add ironwallet-mcp@ironwallet

Grok:

grok plugin marketplace add ironwallet/ironwallet-agent-kit
grok plugin install ironwallet-mcp --trust

Reload so MCP picks up PATH. From a local clone, use . instead of the GitHub repo.

MCP only (no plugin)

Manually installed MCP does not auto-update with the plugin.

{
  "mcpServers": {
    "ironwallet": {
      "command": "npx",
      "args": ["-y", "@ironwallet/mcp-server"]
    }
  }
}

Related MCP server: Universal Crypto MCP

What's included

Skill

Rules

Agent

MCP server

@ironwallet/mcp-server over stdio. Networks: Ethereum, BSC, Polygon, Base, Arbitrum, Optimism, Avalanche, Tron, Bitcoin, Litecoin, Dogecoin, Solana, XRP, TON.

Tools

No tool accepts or returns a seed. Import and backup only in the local browser (open_wallet_manager / backup_url).

Configuration

Nothing to paste into MCP config for normal use. On first launch the server writes a relay API key, keystore wrapping secret, and device id under ~/.ironwallet-mcp/ (mode 0600). Override with IW_RELAY_API_KEY / IW_PASSPHRASE / IW_DEVICE_ID only if you must.

The user-facing backup is the recovery phrase in the wallet manager, not those files.

Security

• Seeds are encrypted at rest. They never appear in tool results, agent chat, or backend requests.

• The agent can move funds without asking again. Optional wallet policy (readOnly, maxPerTxUsd, transfer recipient allow-list — set via set_wallet_policy) is off by default and applies to both sends and swaps.

• Anyone with the keystore and the wrapping secret controls the funds. A leaked seed cannot be revoked.

• Timeout is not always failure: poll status before retrying a send or swap.

• Do not put a main wallet here. Use a small hot wallet.

Details and private disclosure: SECURITY.md.

Contributing

This public tree is a release snapshot. See CONTRIBUTING.md. Please follow the Code of Conduct.

License

MIT