What is an MCP server in crypto?

A crypto MCP server wraps a blockchain capability — a wallet, an RPC node, a data indexer, or a protocol — and exposes it as typed tools any AI agent can call. Base MCP handles wallet and contract actions on Base, while Bankless Onchain MCP provides read-only onchain data. The server contains the chain-specific logic so the agent doesn't have to.

How is MCP different from a regular API?

An API is a service's own interface; MCP is a standard wrapper that makes any service callable by an AI model the same way. The server publishes machine-readable tool schemas the model can discover and reason about at runtime, so an agent can pick up new tools without bespoke integration code for each one.

Is MCP safe for onchain agents?

MCP standardizes the connection, not the trust. A read-only data server is low risk; a server that can sign transactions controls real value and is a high-value target. Safety comes from the server's code and the permissions you grant — spend limits, allowlists, and approvals — not from the protocol itself. Prefer open-source servers you can inspect.

How do MCP servers relate to agent skills?

An MCP server exposes raw tools — discrete actions like send_transaction or read_contract. An agent skill packages higher-level know-how, often on top of those tools, so an agent knows how and when to use them. They compose: skills frequently call MCP tools under the hood.

← Back to wiki

What Are MCPs? The Standard Way to Give Agents Tools

Last updated 2026-06-24

The Model Context Protocol (MCP) is an open standard, introduced by Anthropic, that defines how AI applications connect to external tools, data sources, and services. MCP servers expose capabilities; AI clients consume them.

Key takeaways

▸MCP is an open standard from Anthropic that lets any AI agent discover and call external tools through one common interface — no bespoke integration per tool.
▸The three moving parts are simple: a **client** (the agent), a **server** (wraps a service and exposes typed tools), and the **tools** themselves (schema-defined actions the model can call).
▸For onchain agents, MCP turns blockchains into composable capabilities — a [Base MCP](/resources/base-mcp) server can give any agent wallet and contract actions without rewriting the agent.
▸Crypto MCP servers range from read-only data access to full transaction signing. A signing-capable server controls real value, so permission scope is the whole ballgame.
▸MCP is plumbing, not a trust layer. A server's tools are only as safe as the server — check the source, not the label. See the [Sato Score](/sato-score) for how SatoHub grades transparency.

MCP (Model Context Protocol) is the standard way to give an AI agent tools. It's an open protocol, released by Anthropic in November 2024, that defines a common interface between an AI client (the model doing the reasoning) and the external capabilities it needs — APIs, databases, file systems, and increasingly, blockchains. Instead of writing custom glue code for every integration, you wrap a service once as an MCP server, and any MCP-compatible agent can use it.

Think of MCP as a universal adapter for agent tooling. For onchain agents, that's a meaningful shift: a single crypto MCP server — for wallet actions, chain reads, or protocol calls — can serve any agent that speaks the protocol, instead of being locked to one framework. This page covers what MCP is, the client/server/tools model, why it matters onchain, and the crypto MCP servers already shipping. SatoHub runs one too, exposing its directory and wiki to agents.

Why It Matters

Before MCP, every agent integration was custom glue code — a one-off connector for each API, wallet, or data source, rewritten for each framework. MCP standardizes the interface, so one onchain MCP server (for wallet actions, chain data, or protocol interactions) can serve any MCP-compatible AI client. For crypto, that means blockchains become composable capabilities any agent can pick up, and the tooling ecosystem compounds instead of fragmenting. A builder shipping an onchain agent can reach for an existing MCP server the way a web developer reaches for an npm package.

How It Works

▸An MCP server wraps a service (an exchange API, a wallet, an RPC node, a data indexer) and exposes typed tools with machine-readable schemas describing each action's inputs and outputs.
▸An MCP client (Claude Desktop, an IDE, or a custom agent runtime) connects to the server, discovers the tools it offers, and presents them to the model during reasoning.
▸When the model decides to act, it calls a tool by name with structured arguments; the server executes the work and returns a structured result the model can read.
▸The protocol standardizes tool schemas, resources, prompts, authentication, and transport (local stdio or remote HTTP), so capabilities from different servers compose in one agent.
▸Crypto MCP servers span a spectrum: read-only servers fetch chain state and market data, while write-capable servers can sign and broadcast transactions — which is exactly where permission scoping has to be tight.

Key Components

•MCP server (wraps a service, exposes tools and resources)
•MCP client (the AI application or agent runtime)
•Tool schemas (typed definitions of each capability)
•Resources (read-only context the server can surface)
•Transport layer (local stdio or remote HTTP/SSE)
•Authentication and permission scopes

The client / server / tools model

MCP has three roles, and keeping them straight is most of the battle.

▸The client is the AI application — Claude Desktop, an IDE assistant, or a custom onchain agent runtime. It hosts the model and manages connections to one or more servers.
▸The server wraps a single service and advertises what it can do. A wallet MCP server might expose get_balance, send_transaction, and swap. A data server might expose read_contract and get_token_price.
▸The tools are the individual actions, each defined by a JSON schema that tells the model what arguments it takes and what it returns.

The flow is a handshake: the client connects, asks the server *what can you do?*, and the server answers with its tool list. The model then calls tools by name as it reasons. Because every server speaks the same protocol, an agent can hold a wallet server, a market-data server, and a governance server at once, and treat them as one toolbox. MCP also defines resources (read-only context a server can surface) and prompts (reusable templates), but tools are the part that does the work.

Why MCP matters for onchain agents

Onchain agents have a specific problem: the actions they need — reading chain state, signing transactions, calling protocol contracts — are spread across dozens of chains, SDKs, and RPC providers. Without a standard, every framework reimplements the same wallet and chain connectors, and a tool built for one agent can't move to another.

MCP collapses that. A crypto capability gets wrapped once as a server and becomes portable across every MCP client. That has three concrete effects:

Composability. An agent can combine a Base MCP wallet server with a data server and an exchange server without custom integration code.
Reuse. Tooling built by one team is usable by another, so the ecosystem compounds instead of fragmenting per framework.
Separation of concerns. The reasoning model stays framework-agnostic; the chain-specific risk lives in the server, where permissions and limits can be enforced in one place.

This is why MCP shows up in the onchain agent stack as the default way to attach tools. It pairs naturally with agent skills, which package higher-level know-how on top of the raw tools a server exposes.

Crypto MCP servers shipping today

The crypto MCP ecosystem is young but real. A few notable servers:

▸[Base MCP](/resources/base-mcp) (from the Base team) lets an assistant manage a wallet, transfer assets, and deploy contracts on Base. It's open source on GitHub, so the tool set is inspectable rather than self-reported.
▸[Bankless Onchain MCP](/resources/bankless-onchain-mcp) exposes onchain data — contract state, token info, transaction history — to agents as structured, read-only tools, which is the lower-risk end of the spectrum.
▸Exchange and data MCPs wrap market data and trading endpoints so an agent can observe prices and, where permitted, route orders.

These map cleanly onto the read-vs-write split. Data servers like Bankless are read-only — worst case, they feed bad context. Write-capable servers like Base MCP can move funds, which is powerful and demands tight scoping. Browse the broader set in the directory; the underlying standard itself is tracked as model-context-protocol.

Where the risk actually lives

MCP is plumbing. It standardizes *how* tools connect; it makes no promise that any given server is honest or safe. A server's tools are exactly as trustworthy as the server's code and the permissions you grant it.

The real failure modes are concrete:

▸A signing-capable server is a high-value target. If it can move funds, scope it to the minimum — spend limits, allowlisted contracts, and human approval for anything irreversible.
▸Malicious or compromised servers can feed an agent bad data or exfiltrate the context the model sees.
▸Tool poisoning — manipulating the tool *descriptions* the model reads — can steer an agent toward harmful calls, so the metadata matters as much as the code.

The defensive move runs through every SatoHub page: prefer servers whose source is open and checkable over ones that simply claim to be safe. The Sato Score grades how transparent and active a resource is — a transparency signal, not a safety or returns grade.

Examples

▸Base MCP: lets an assistant transfer assets and deploy contracts on Base.
▸Bankless Onchain MCP: gives research agents structured, read-only access to contract state and onchain data.
▸Exchange MCPs: expose market data and trading endpoints to agents within permission limits.
▸SatoHub's own MCP server: exposes the directory and wiki so agents can query tracked resources.

Risks & Limitations

⚠A signing-capable MCP server is a high-value attack target, scope permissions tightly.
⚠Malicious or compromised MCP servers can feed agents bad data or exfiltrate context.
⚠Tool descriptions can be manipulated (tool poisoning); prefer servers whose source is open.
⚠MCP standardizes the connection, not the trust — an open standard does not make any given server safe.

Frequently Asked Questions

What does MCP stand for?: MCP stands for Model Context Protocol. It's an open standard introduced by Anthropic in November 2024 that defines how AI applications connect to external tools, data, and services through one common interface, so the same tool works across any MCP-compatible agent.
What is an MCP server in crypto?: A crypto MCP server wraps a blockchain capability — a wallet, an RPC node, a data indexer, or a protocol — and exposes it as typed tools any AI agent can call. Base MCP handles wallet and contract actions on Base, while Bankless Onchain MCP provides read-only onchain data. The server contains the chain-specific logic so the agent doesn't have to.
How is MCP different from a regular API?: An API is a service's own interface; MCP is a standard wrapper that makes any service callable by an AI model the same way. The server publishes machine-readable tool schemas the model can discover and reason about at runtime, so an agent can pick up new tools without bespoke integration code for each one.
Is MCP safe for onchain agents?: MCP standardizes the connection, not the trust. A read-only data server is low risk; a server that can sign transactions controls real value and is a high-value target. Safety comes from the server's code and the permissions you grant — spend limits, allowlists, and approvals — not from the protocol itself. Prefer open-source servers you can inspect.
How do MCP servers relate to agent skills?: An MCP server exposes raw tools — discrete actions like send_transaction or read_contract. An agent skill packages higher-level know-how, often on top of those tools, so an agent knows how and when to use them. They compose: skills frequently call MCP tools under the hood.