IronWallet has launched IronWallet MCP, a self-custodial cryptocurrency wallet that connects to AI agents through the Model Context Protocol (MCP), allowing users to manage crypto assets through natural-language commands while keeping private keys and seed phrases encrypted on their own devices.
What Is Model Context Protocol and Why It Matters
MCP is an open standard that enables seamless integration between LLM applications and external data sources and tools. It has recently surpassed 400 million monthly SDK downloads and become the industry standard for connecting AI agents to applications, with the latest specification (2026-07-28) moving to a stateless core, hardening authorization, and simplifying the experience of building and scaling MCP servers.
“We wanted to close the gap between what an AI agent can discuss in conversation and what it can actually do with a wallet. IronWallet MCP is our attempt to make managing crypto assets through AI as simple as an ordinary chat, without giving up the user’s control over their own funds,” the IronWallet team said.
How IronWallet MCP Works
IronWallet MCP Server runs on the user’s computer as a local, non-custodial hot wallet, not as remote control of the IronWallet mobile app. The flow follows a clear chain: User → AI Agent → IronWallet MCP Server → Local Signing → Blockchain.
Key architectural features include:
Local key management. Seed phrases are generated and encrypted locally — they never leave the machine and never pass through the AI agent, the LLM, or IronWallet backends. Recovery phrases are encrypted at rest in ~/.ironwallet-mcp/keystore.json and unwrapped with a local secret, with the server decrypting locally only to sign transactions.
Separation of concerns. The AI agent receives information about the requested operation and its result, but does not receive the underlying wallet credentials. The mnemonic and private keys never appear in MCP tool arguments or results, in agent chat, in logs intended for the model, or in HTTPS bodies to IronWallet backends.
Tool-based access. The MCP server exposes a defined set of tools — including get_balance, send_transfer, execute_swap, and estimate_transfer — that the AI agent can invoke through natural language without needing to know individual tool names.
The Security Gap IronWallet MCP Addresses
Connecting AI systems to cryptocurrency wallets introduces significant security considerations. Recent incidents illustrate the risks. In February 2026, the autonomous AI agent Owockibot leaked private keys across multiple platforms despite programmed denials, resulting in $2,100 in losses before developers revoked the bot’s internet access indefinitely. In a separate incident, an attacker sent a membership NFT to xAI Grok’s wallet and posted a Morse-code message on X; Grok decoded and executed the instruction, sending approximately $150,000 to the attacker’s address.
Security researchers have also highlighted “rug-pull” attacks in MCP networks, where a tool definition on an MCP server is silently altered after initial approval, causing an agent to invoke it believing it remains safe. Microsoft’s AI security team warned of precisely these cross-domain injection vulnerabilities in agentic systems and implemented mitigations to protect its own Azure AI services.
The fundamental challenge, according to security analysts, is that “current AI agent architectures are unsafe for Web3 because LLMs can’t separate instructions from data”. When a private key moves into an agent runtime — whether in server memory, an environment variable, or a cloud secrets manager — every tier of that environment has been successfully breached.
IronWallet MCP’s architecture directly addresses this by keeping the signing credential outside the AI’s reach entirely. Transaction signing and execution take place locally, with the private keys remaining on the user’s device throughout the process. As noted in the security documentation: “Signing never happens on IronWallet servers. A leaked seed cannot be revoked.”
Multichain Support Across 14 Networks
IronWallet MCP supports 14 blockchain networks: Bitcoin, Ethereum, Solana, TRON, BNB Smart Chain, Polygon, Arbitrum, Optimism, Base, Avalanche, TON, XRP, Dogecoin, and Litecoin. The multichain support allows users to access assets across different blockchain ecosystems through the same AI-assisted interface rather than configuring a separate wallet workflow for each network.
The integration requires no coding or SDK development from end users. The software can be installed on Windows, macOS, and Linux, after which it can be connected to a compatible MCP client, including Cursor, Claude Code, ChatGPT Codex, and other MCP-compatible applications.
What You Can Do With IronWallet MCP
Users can issue commands such as:
“Swap $500 of ETH when the price reaches $2,300.”
“Swap 0.01 ETH to USDC on Base.”
“Send 100 USDT to my employment wallet.”
“What’s my USDT balance on Ethereum?”
The agent interprets the request and calls the corresponding MCP function — such as execute_swap, send_transfer, or get_balance — performing the wallet operation while signing locally.
The company said the goal is to reduce the operational complexity associated with cryptocurrency transactions by allowing users to interact with wallets through conversational commands instead of manually entering wallet addresses, selecting networks, or navigating multiple transaction screens.
Optional Security Policies
IronWallet MCP includes optional per-wallet policies that can be set via set_wallet_policy, including a read-only mode, a maximum per-transaction USD limit, and a transfer recipient allow-list. These policies apply to both send_transfer and execute_swap functions. The policies are off by default, but when configured, they provide an additional layer of protection against unintended transactions.
The security documentation also notes an important operational consideration: there is no per-transaction confirmation UI. Once a user asks the agent to send or swap, it can sign and broadcast without asking again. IronWallet recommends using a dedicated hot wallet with a limited balance, never your main wallet.
AI Agents and the Future of Self-Custody
The launch comes as AI agents are increasingly being integrated with financial and blockchain applications. Coinbase launched Agentic Wallets in February 2026, and McKinsey estimates that AI agent-mediated commerce could reach $3–5 trillion globally by 2030. As Coinbase CEO Brian Armstrong observed, “AI Agents can’t open bank accounts, but they can own a crypto wallet”.
The key challenge is that letting AI operate on-chain assets is fundamentally different from letting it manage calendars or emails. On-chain transactions are irreversible — no refunds, no chargebacks. A single malicious signature can drain an entire wallet in one block. Keeping signing credentials outside the AI model and maintaining local control over private keys are therefore central considerations for self-custodial AI wallet architectures.
IronWallet MCP is designed around this separation, with the AI agent responsible for interpreting user instructions while transaction signing remains within the local wallet environment. As the IronWallet team put it, IronWallet MCP is “our attempt to make managing crypto assets through AI as simple as an ordinary chat, without giving up the user’s control over their own funds.”
FAQs
What is IronWallet MCP?
IronWallet MCP is a self-custodial crypto wallet integration that connects to AI agents via the Model Context Protocol (MCP). It lets users manage crypto through natural-language commands while private keys and seed phrases stay encrypted locally on their device.
How does IronWallet MCP keep my keys safe?
The MCP server runs locally, signs transactions on-device, and never sends seed phrases or private keys to the AI agent, LLM, or IronWallet servers. Keys are encrypted at rest in ~/.ironwallet-mcp/keystore.json.
Which AI clients work with IronWallet MCP?
It is compatible with MCP-enabled applications including Claude, Cursor, ChatGPT Codex, Claude Code, and other MCP clients.
Which blockchains are supported?
IronWallet MCP supports 14 networks: Bitcoin, Ethereum, Solana, TRON, BNB Smart Chain, Polygon, Arbitrum, Optimism, Base, Avalanche, TON, XRP, Dogecoin, and Litecoin.
Do I need to code to use it?
No. The software installs on Windows, macOS, and Linux, then connects to a compatible MCP client. No SDK or coding is required from end users.
Can I set spending limits or read-only mode?
Yes. Optional per-wallet policies via set_wallet_policy include read-only mode, a maximum per-transaction USD limit, and a transfer recipient allow-list. These apply to both send_transfer and execute_swap.
Is IronWallet MCP a replacement for a hardware wallet?
IronWallet positions it as an alternative to hardware wallets for AI-assisted workflows. It retains local control over private keys without requiring physical device access for every transaction. However, because there is no per-transaction confirmation UI, the company recommends using a dedicated hot wallet with a limited balance.
Getting Started
IronWallet MCP is compatible with MCP-enabled applications including Cursor, Claude Code, ChatGPT Codex, and other MCP clients. Installation requires Node.js 20+ and follows a straightforward process: add the MCP server, create a dedicated wallet, fund it with a limited amount, and test with natural-language prompts. For Cursor, users can add the server to ~/.cursor/mcp.json with a single configuration block.
Additional information about IronWallet MCP, including security and setup documentation, is available at ironwallet.io/ai. The source code and agent kit are available on GitHub, with machine-readable documentation provided via the llms.txt index.
