https://mcp.defiloops.com/mcp. Without signing in, your agent can read the public catalogue. After a wallet sign-in, it can read your accounts. If you also grant the chat scope, it can talk to your DeFiLoops chat as you. Without the chat scope, nothing on this server can write, sign or spend.
MCP is the Model Context Protocol, the standard way an AI client calls tools on a server. This server speaks the Streamable HTTP form of the specification dated 2025-11-25.
Three levels of access
The anonymous tools
These answer exactly what a plain call to the public gateway would answer. Any other tool, called without a token, answers401 and the sign-in challenge.
Signing in
Your agent signs in with a wallet signature. There is no password and no console login.- The client registers itself with the server and starts a standard OAuth 2.1 flow with PKCE.
- The sign-in page asks your wallet to sign one message. The message names the client, the permissions it asks for and the networks it covers. Signing costs no gas and approves nothing.
- The server issues a token that lasts one hour. It is not refreshed. Sign in again when it ends.
One sign-in for every network
One sign-in covers every network DeFiLoops serves, for your own accounts. This works for an ordinary key-held wallet only. A contract wallet stays limited to one network.Tokens tied to your client’s key
A token can be bound to a key your client holds, using the DPoP standard. A stolen token then fails without that key. The chat scope is issued only in this bound form.The chat scope
The chat scope lets your agent use your DeFiLoops chat as you. It is the only way a connected agent can start anything. What your agent gets:
How it is held:
- Your wallet signed for it. The message you sign names the chat scope. A read-only signature can never produce a chat token.
- It needs an ordinary wallet you already linked to your console login with a signed proof. A contract wallet, or a wallet with no proven link, is refused when you sign in.
- A start needs a hash.
chat_statusshows each action with a hash of the exact plan, network and account.chat_confirmrefuses if anything changed, or if nothing is waiting. - It is your chat. Every message and action appears in your console chat history, marked as coming from MCP. The same limits apply as in the console.
- It is short. Each call runs under its own narrow console session, which ends at most 12 minutes after it starts and is never extended.
- It is rate limited. One message every 20 seconds, with a burst of three. A turn is refused while your credit balance is below zero.
Limits and errors
Requests are limited per address. A429 answer carries a Retry-After header. A request body is limited to 64 KiB, and one tool call to 20 seconds.
Voice
A voice interface uses this same door. It is available to approved wallets only for now, and it is not open to everyone.Under the hood
The MCP server is a separate door from the tool server the console chat uses. It runs inside the gateway process and has no business logic of its own. Each tool is one read that the public gateway already answers, called through the same handler, so the two cannot disagree. The server refuses to start if a tool in its table would write, sign or spend. The tool server that holds the spending tools listens on a private link only, and no public address reaches it. The sign-in follows the MCP authorization section: protected-resource metadata (RFC 9728), authorization-server metadata (RFC 8414), dynamic client registration (RFC 7591), PKCE with S256 required of every client, and resource indicators (RFC 8707). A token is issued for one resource and refused on any other. Tokens are stored hashed. A token that is bad is refused with401 and never treated as anonymous.
→ The gateway · Hire a template agent · The agent card