canton-agent-mcp

Your agent asks. You approve. Hardware signs.

An MCP server that lets an AI agent use the Canton Network through a human's mobile wallet. The agent can ask to sign in and to pay; every request lands as an approval sheet on the human's phone, and what gets signed is signed by the device key (Secure Enclave or Android StrongBox), never by the agent.

This server is a CIP-0103 dApp client over WalletConnect. It holds no keys and no ledger tokens. It can only ask, and the wallet's owner can see, approve, or refuse every request.

How it works

1. The agent calls canton_connect_wallet; a WalletConnect pairing QR appears.

2. The human scans it from their wallet's Connect tab and approves on the phone.

3. From then on the agent can request sign-in (canton_sign_in) or a payment (canton_request_payment). Each request pops an approval sheet on the phone; the wallet prepares the transaction on its participant, re-verifies the prepared-transaction hash on device, and signs in hardware.

4. Sessions persist on disk, so the wallet is paired once and reused.

The reference wallet on the other end is canton-mobile-app (iOS and Android, built on the native canton-mobile-sdk), but any CIP-0103 wallet that speaks WalletConnect works.

Related MCP server: Grip MCP

Quickstart

Requires Node 22.6+ (the server runs TypeScript directly, no build step) and a free WalletConnect Cloud project id.

git clone https://github.com/vsima/canton-agent-mcp
cd canton-agent-mcp && npm install

Register it with Claude Code:

claude mcp add canton-agent --env WC_PROJECT_ID=<your-project-id> \
  -- node <path-to>/canton-agent-mcp/src/main.ts

Then ask the agent to connect your wallet and pay someone. A payment request blocks until the human decides, so raise your MCP client's tool timeout if it cuts long calls short (in Claude Code: the MCP_TIMEOUT environment variable).

Tools

Configuration

All by environment variable:

Payments default to a local Splice LocalNet (boot one via the SDK repo's integration/run-localnet.sh).

Security model

• The server can ask, never act: no keys, no ledger tokens, no signing.

• Every sign-in and payment needs an explicit approval on the phone.

• The wallet re-derives and verifies the prepared-transaction hash on device before its hardware key signs, so the phone can only sign what it showed.

• Requests expire (an hour by default); the relay stores them encrypted.

• Wallet-side spend policy (per-agent caps and allowlists, enforced by the wallet before signing) is the next milestone in the native SDK.

Development

npm test        # typecheck + unit tests (no network)
npm run probe   # opens a real relay session and prints the pairing QR

An independent, community-built open-source project, licensed Apache-2.0. Not affiliated with or endorsed by Digital Asset, the Canton Foundation, or the Global Synchronizer Foundation.