Give your AI agent a
Canton wallet

Self-custody payments, inside your AI app.

@ftptech/canton-x402-mcp is a local MCP server that lets an AI agent hold Canton Coin, fund itself, and pay for the x402-gated APIs it calls. The key is generated and held on the machine that runs the server. Spending is capped by the owner.

View on npm See the hosted path Talk to us

What it provides

Four properties define the server. It runs in any MCP host, the agent holds its own key, the owner caps every spend, and it pays any x402-gated API on Canton.

Runs in any MCP host

Add the server to Claude Code, Claude Desktop, or any host that can run a local process. One connect command, with no account to sign in to.

The agent holds its key

The Ed25519 key is generated and held on the machine that runs the server. It is never returned to the agent or sent to the relay.

Owner-set spend policy

A daily cap, a per-transaction cap, and a domain allowlist bound what the agent can spend. The agent cannot change them.

Pays x402 APIs

The agent funds itself through the hosted quest, then pays any x402-gated endpoint and settles on-ledger on Canton MainNet.

How it works

Connect the server once with the spend policy. The agent then funds itself, pays an x402-gated URL, and the on-ledger updateId proves it settled.

Connect

The owner adds the MCP server to the host with one command, setting the spend caps and the domain allowlist.

Fund

The agent calls get_address, then auto_fund to bootstrap a funded wallet through the hosted quest, or asks its owner to send Canton Coin.

Pay

The agent calls pay on an x402-gated URL. The server signs the transfer locally with the agent's key; the signed payload travels in the payment header and the merchant's facilitator relays it on-ledger.

Verify

The tool returns the response and the on-ledger updateId. The wallet balance is the proof a payment landed.

The first payment takes about 60 to 90 seconds while Canton creates the payment counter. That is warm-up, not a failure; later payments are quick. A 200 response is never the proof a payment landed, the on-ledger balance is.

The building blocks

The server is a local process the agent's host runs, a self-custody key it holds on disk, and a facilitator relay that submits and pays gas without custody.

Local MCP server

Runs over local stdio and exposes the wallet as tools. Connect it once; the agent calls the tools and never runs an install.

@ftptech/canton-x402-mcp

Self-custody key

Generated on first use and held in the server's home directory. Never returned by any tool and never sent to the relay.

Ed25519, held on disk

Facilitator relay

Onboards the party, submits the agent's signed transactions, and pays gas. It cannot move the funds.

facilitator.ftptech.xyz

Add the server to any host that can run a local process. The server runs over local stdio, so hosts that can only attach a remote MCP over a URL, including ChatGPT on the web, cannot run it; for those, use the hosted HTTP path on the agents page.

claude mcp add canton-x402 -- npx -y @ftptech/canton-x402-mcp \
  --relay-url https://facilitator.ftptech.xyz \
  --pay-proxy-url https://pay.ftptech.xyz \
  --allow-domains api.cantrustai.xyz \
  --daily-cap 5 --max-per-tx 1

Replace the caps with your limits, then restart the client. The Claude Code command and the JSON config use the same flags: --relay-url is required, --pay-proxy-url is the funding quest auto_fund uses, --allow-domains is the pay allowlist (comma-separated; empty denies every pay, * allows any), and --daily-cap and --max-per-tx are the spend limits in CC. After it connects, have the agent call get_address, then auto_fund.

MCP tools@ftptech/canton-x402-mcp

get_addressReturns the agent's Canton party id. Creates the wallet on first use.read
get_balanceReturns the on-ledger Canton Coin balance.read
request_fundingReturns the party id and a paste-ready funding message for the owner.read
auto_fundBootstraps a funded wallet through the hosted quest: the pay-proxy mints a party, funds it, and returns the key, which the server imports. Refuses to run when a wallet already holds a balance; falls back to a manual funding ask.funds in
claimAccepts pending incoming transfers, Canton Coin and USDCx alike. Run after the owner sends funds.funds in
payPays an HTTP 402 / x402-gated URL and returns the response.money out
withdrawSends Canton Coin to another Canton party.money out

@ftptech/canton-x402-mcp v1.1.0 (Apache-2.0). Requires Node 18 or newer with npx. The key is never returned by any tool; back up the wallet with the canton-agent-wallet CLI against the same home directory.

Spend policy

The owner sets the spend policy at startup. The agent cannot change it.

--daily-cap <CC>

Cap on outbound spend across pay and withdraw. No built-in default; unset means uncapped, and the connect snippet sets 5. Set 0 to freeze.

--max-per-tx <CC>

Per-transaction cap. No built-in default; the connect snippet sets 1. Enforced before signing on both withdraw and pay: on pay the cap is handed to the signer, which refuses an over-quote before anything reaches the relay.

--allow-domains <csv>

The hosts pay may target. Empty denies every pay; withdraw is not domain-gated. Use * to allow any host.

Every cap is checked before a transaction is signed, and a refusal sends nothing to the relay. The per-transaction cap reaches pay as well: the price is only known mid-request, so the cap is handed to the paying fetch and the signer refuses a quote above it. A payment is additionally bounded by the daily cap, the funded ceiling, the domain allowlist, and balance accounting.

Who it is for

The same server serves the builder shipping one agent, the long-running service that pays as it goes, and the institution that needs self-custody and on-ledger settlement.

AI-agent builders

Give a desktop or IDE agent its own Canton wallet so it can pay for the tools it calls, bounded by a policy you set at startup.

Autonomous services

A long-running agent bootstraps itself through the hosted quest and settles payments with no human in the loop, capped by the daily limit, the allowlist, and the funded ceiling.

Institutions

Deploy agent payments with self-custody, on-ledger settlement on Canton MainNet, and a relay that controls no funds.

Giving your agents a wallet inside your app

FTP Tech LLC publishes the MCP server and runs the facilitator relay it settles through. Reach out to discuss an integration.

Talk to us

The Ed25519 key is generated and held locally by the MCP and is never sent to the agent or to the relay.

The facilitator relay at facilitator.ftptech.xyz onboards the party, submits the agent’s signed transactions, and pays gas. It cannot move the funds. Settlement is verifiable on the ledger: every paid request resolves to an updateId on Canton MainNet.

View on npm See the hosted path