MCP server
Give any MCP client — Claude, Cursor, your own agent — the five Bound tools.
The MCP server exposes the same five tools the in-app agent uses, over stdio, to any
MCP client. It is a second mouth on one
core: the tools call BoundClient, exactly like the rest of the system.
The tools
| Tool | What the agent can do |
|---|---|
verify_agent_certificate | Look up an agent's certificate — bound, reserve, auditor, status |
get_balance | Read a USDC balance |
execute_payment | Send USDC to a recipient |
fetch_paid_service | Fetch an x402 resource, paying automatically |
challenge_certificate | Open a challenge against a certificate |
The first two are reads and safe by construction. The last three move money or post a bond — scope which of them a given client gets accordingly.
Running it
git clone https://github.com/iamnotdou/bound.git
cd bound
pnpm install
pnpm run mcpThe server speaks JSON-RPC over stdio and logs to stderr, so its output never corrupts the channel.
Wiring it into a client
Point your MCP config at the command. For Claude Desktop or Cursor:
{
"mcpServers": {
"bound-protocol": {
"command": "pnpm",
"args": ["--dir", "/absolute/path/to/bound", "run", "mcp"]
}
}
}For Claude Code, the same shape lives in .mcp.json at your project root.
Payment tools need keys
Reads work with no configuration. execute_payment, fetch_paid_service and
challenge_certificate sign transactions, so they need the relevant secret key in the
server's environment — copy .env.example to .env.testnet and fill it in. Never
commit those files.
Why an agent wants this
An agent that can pay can also be paid — and the counterparty on the other end is
running the same check. Giving the agent verify_agent_certificate lets it do to
others what others do to it: read the bound before committing, rather than inferring
trust from a name.