Bound

MCP server

Give any MCP client — Claude, Cursor, your own agent — the five Bound tools.

The MCP server exposes the same five tools the in-app agent uses, over stdio, to any MCP client. It is a second mouth on one core: the tools call BoundClient, exactly like the rest of the system.

The tools

ToolWhat the agent can do
verify_agent_certificateLook up an agent's certificate — bound, reserve, auditor, status
get_balanceRead a USDC balance
execute_paymentSend USDC to a recipient
fetch_paid_serviceFetch an x402 resource, paying automatically
challenge_certificateOpen a challenge against a certificate

The first two are reads and safe by construction. The last three move money or post a bond — scope which of them a given client gets accordingly.

Running it

git clone https://github.com/iamnotdou/bound.git
cd bound
pnpm install
pnpm run mcp

The server speaks JSON-RPC over stdio and logs to stderr, so its output never corrupts the channel.

Wiring it into a client

Point your MCP config at the command. For Claude Desktop or Cursor:

mcp.json
{
  "mcpServers": {
    "bound-protocol": {
      "command": "pnpm",
      "args": ["--dir", "/absolute/path/to/bound", "run", "mcp"]
    }
  }
}

For Claude Code, the same shape lives in .mcp.json at your project root.

Payment tools need keys

Reads work with no configuration. execute_payment, fetch_paid_service and challenge_certificate sign transactions, so they need the relevant secret key in the server's environment — copy .env.example to .env.testnet and fill it in. Never commit those files.

Why an agent wants this

An agent that can pay can also be paid — and the counterparty on the other end is running the same check. Giving the agent verify_agent_certificate lets it do to others what others do to it: read the bound before committing, rather than inferring trust from a name.

On this page