MCP server & agent security

The CLI ships a standardized stdio MCP server for Claude, Cursor, Gemini and autonomous trading agents — 25 tools, each carrying the same live/simulated label the terminal uses, with spend policies and human-approval gates enforced before value moves.

Connect a client

Start the server with a delegated agent wallet:

furlpay mcp --wallet agent-alpha

Then register it in your MCP configuration (claude_desktop_config.json, Cursor, or any MCP client):

{
  "mcpServers": {
    "furlpay-execution": {
      "command": "furlpay",
      "args": [
        "mcp",
        "--wallet",
        "agent-alpha"
      ]
    }
  }
}

Delegated agent keys

The MCP server acts through a delegated session key — never your primary keystore. The key carries a spending policy the server enforces before every gated tool call:

furlpay wallet agent-keygen \
  --name agent-alpha \
  --daily-limit 50.00 \
  --allowed-assets USDC,JQQQ,FOBXX \
  --expiry 7d

• Daily spend cap — enforced atomically: validate-and-record happens under the policy lock, so concurrent tool calls cannot both pass against a stale spent-today snapshot.
• Allowed assets — anything outside the list is rejected by policy.
• Expiry — the key stops working at the configured time, not whenever someone remembers to rotate it.
• Fail closed — no policy on disk means simulation-only mode: gated calls never move value.

The tool surface

Every tool below exists in the v0.4.0 release — no invented parameters. Human-approval tools are marked with anthropic/requiresUserInteraction in the server's tool metadata and cannot be exercised silently by an autonomous agent.

Agent Trust Engine

Before a payment-shaped tool call executes, the server runs policy checks: OFAC/SDN screening, velocity limits and the delegated spend caps above. A rejected call fails closed with the policy reason — the agent does not get a retry-until-it-passes loop.

Credentials and environment

• Hyperliquid execution reads HYPERLIQUID_PRIVATE_KEY (or ETH_PRIVATE_KEY) from the environment — never from argv — and fails closed without a signer.
• Wallet imports and login --key accept secrets on stdin only.
• The MCP server transmits nothing anywhere on your behalf except the operations you can see in its responses; there are no invented approval-server URLs in the registry.