IronWallet

io.ironwalletPublished by ironwallet.iov1.2.1Updated Oct 24, 2026

Non-custodial crypto wallet MCP: check balances, sign and send transfers, and swap tokens locally.

VerifiedSTDIODesktop onlyFinanceSecurity & Monitoring

Overview

AI-generated overview

Local non-custodial crypto wallet server that lets an AI assistant check balances, sign and send transfers, and swap tokens across many networks.

What you can do
  • Check balances, transaction history and deposit QR codes for wallets
  • Estimate and send transfers, then poll operation status
  • List swap networks and assets, get quotes, execute swaps and poll swap status
  • Create wallets, open a local browser manager for import, backup and delete, and set per-wallet spending policies
  • Inspect the running version and stage npm updates
When to use it
Useful when you want an assistant to operate a small hot wallet on your own desktop: checking balances, moving tokens, or swapping across chains from chat. Not intended for main wallets or for remote or phone-based agents.
Requirements
Node.js 20+ and npx; runs as a local stdio process on a desktop. No config needed for normal use: on first launch it writes a relay API key, keystore wrapping secret and device id under a local keystore directory. Optional overrides include IW_PASSPHRASE, IW_READ_ONLY, IW_RELAY_API_KEY, IW_DEVICE_ID, IW_KEYSTORE_DIR and IW_TON_API_KEY. Network access to IronWallet backends and public explorers is required.
Before you install
The agent can move funds without asking again, and there is no per-transaction confirmation UI. Wallet policy (readOnly, maxPerTxUsd, recipient allow-list) is off by default; set it with set_wallet_policy, which replaces the whole policy. Anyone with the keystore and the wrapping secret controls the funds, and a leaked seed cannot be revoked. Use a dedicated hot wallet with a limited balance, never a main wallet. A timeout does not always mean failure, so poll status before retrying.

Installation

In SourceWeft

  1. Open IronWallet in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

@ironwallet/mcp-server

Local MCP server for IronWallet (ironwallet-mcp bin).

The IronWallet MCP server gives AI agents secure access to a non-custodial wallet. Seed phrases stay encrypted on the host and never leave this machine — they never pass through the agent. Agents can retrieve balances, sign locally, transfer tokens, and swap across 10+ networks.

Seed-compatible with the IronWallet app.

There is no per-transaction confirmation UI.

Hot-wallet only. Use a dedicated wallet with limited balance. See Security.

Product page: ironwallet.io/ai

Requirements: Node.js 20+ (npx).

Install

bash
npx -y @ironwallet/mcp-server

Or add to MCP config (Cursor: .cursor/mcp.json or global):

json
{  "mcpServers": {    "ironwallet": {      "command": "npx",      "args": ["-y", "@ironwallet/mcp-server"]    }  }}

npx pulls the latest published build. First launch can take ~30s while dependencies install. If the MCP client times out, run the same command once in a terminal to warm the cache, then reconnect.

The plugin install on ironwallet.io/ai wires this up automatically.

How it works

MCP client  →  ironwallet-mcp (stdio)                    ├── encrypted keystore on disk                    ├── signs on this machine                    └── HTTPS to IronWallet backends

The mnemonic never appears in tool inputs/outputs, logs meant for the agent, or requests to backends / the LLM / the MCP client’s cloud.

Features

AreaCapability
NetworksEthereum, BSC, Polygon, Base, Arbitrum, Optimism, Avalanche, Tron, Bitcoin, Litecoin, Dogecoin, Solana, XRP, TON
WalletsCreate, import, list, deposit QR, and back up (local browser for secrets)
BalancesNative coins and tokens
TransfersFee estimate and send through IronWallet’s transfer relay
SwapsQuotes and execution through IronWallet
PolicyOptional per-wallet limits (readOnly, maxPerTxUsd, transfer recipient allow-list) set via set_wallet_policy. Applies to send_transfer and execute_swap.

Tools

ToolPurposeMoves funds?
get_runtime_infoRunning version vs published npm packageno
prepare_updateStage the npm update for the next restartno
list_walletsNames, addresses, and policyno
accept_mcp_consentRecord chat acceptance of the MCP disclaimerno
create_walletsNew wallets; returns a browser backup_urlno
open_wallet_managerLocal browser UI to import / create / back up / deleteno
set_wallet_policyReplace per-wallet limits (readOnly, maxPerTxUsd, allow-list)no
get_deposit_qrPNG QR (try chat; else local qr_url)no
get_balanceNative or token balanceno
get_transaction_historyRecent txs from public explorers (paged)no
estimate_transferFee estimate, no broadcastno
send_transferSign locally and sendyes
get_operation_statusPoll a transferno
list_swap_networksNetworks available for swapno
list_swap_assetsSell / buy catalogno
estimate_swapQuote (may expire)no
execute_swapFresh quote → sign → swapyes
get_swap_statusPoll a swapno

No tool accepts or returns a seed. Import, backup, and delete only in the local browser (open_wallet_manager / backup_url).

Wallets

  • Create: create_wallets — the agent gets names and addresses; open backup_url in a browser to view and back up recovery phrases.
  • Import / back up: open_wallet_manager — loopback-only page; the phrase is typed or shown only in the browser.
  • Delete: the Delete button in the manager. A separate confirmation page asks the user to retype the wallet name; a wallet that was never backed up also needs an explicit acknowledgement that its recovery phrase is destroyed. Funds are not moved. There is no MCP tool for this.
  • List: list_wallets
  • Deposit QR: get_deposit_qr — PNG (generated on the fly) plus qr_url. Show the image in chat when the host renders it; otherwise open qr_url. Pass network for one chain. The wallet manager also has a QR button next to each address.

The browser page binds to 127.0.0.1 under an unguessable path and shuts down after 15 minutes of inactivity.

Transfers

  1. list_wallets / get_balance
  2. estimate_transfer (optional)
  3. send_transfer
  4. get_operation_status when you need to wait on the operation

send_transfer may reduce the amount slightly so the fee still fits the balance; the response reports when that happened.

Swaps

Swaps are a separate flow from transfers.

  1. list_swap_networks
  2. list_swap_assets (direction=from, then direction=to with the chosen sell asset)
  3. Copy network, symbol, address, decimals from the catalog into estimate_swap / execute_swap (especially for tokens)
  4. estimate_swap for a preview, or go straight to execute_swap
  5. Poll with get_swap_status using the operationId from execute_swap (estimate_swap is a quote and has no status)

Useful options

  • maxMode: true — sell as much of the balance as the service allows (fees are accounted for server-side). amount can be omitted when maxMode is set.
  • Omit address only for native coins. For tokens, always pass address (and ideally decimals) from list_swap_assets.

Operational notes

  • Quotes expire. Prefer execute_swap (fresh quote). If execute times out, poll status before retrying — do not blindly re-run execute.
  • Wallet policy: readOnly blocks sends and swaps. maxPerTxUsd values the transfer amount (or the corrected swap sell amount) in USD at operation time via IronWallet backend rates; when no rate is available the operation is rejected (fail closed). The recipient allow-list applies to send_transfer. set_wallet_policy replaces the whole policy — read list_wallets.policy first.

Configuration

Nothing to paste into MCP config for normal use. On first launch the server writes a relay API key, keystore wrapping secret, and device id under ~/.ironwallet-mcp/ (keystore-passphrase, relay-api-key, device-id; owner-only POSIX 0600 or NTFS ACL on Windows). Set the env vars only to override.

The user-facing backup is the recovery phrase in the wallet manager, not those files.

VariableDefaultNotes
IW_PASSPHRASEgenerated locallyOverride keystore wrapping secret
IW_READ_ONLYfalseProcess-wide: reject send_transfer and execute_swap. true/1 enable; false/0/off/no disable. Distinct from per-wallet policy.readOnly.
IW_RELAY_API_KEYgenerated UUIDOverride x-api-key
IW_DEVICE_IDgenerated UUIDOverride the device UUID (stable per keystore directory). Sent as X-Device-Id: web:<uuid>; a value that already has a platform: prefix is sent unchanged
IW_KEYSTORE_DIR~/.ironwallet-mcpKeystore directory
IW_RATES_API_URLbaked profileRates backend for maxPerTxUsd valuation. Unset in the profile → USD limits reject (fail closed)
IW_STATIC_RESOURCES_URLbaked profileStatic asset catalogs (token → rates id)
IW_HTTP_TIMEOUT_MS15000General HTTP timeout (1s–120s)
IW_HTTP_FORWARD_TIMEOUT_MS60000Longer timeout for broadcast-style calls. A client timeout does not always mean the operation failed — check status
IW_HTTP_RETRIES2Retries for safe/idempotent calls; broadcasts are not auto-retried
IW_HISTORY_APISbaked profileJSON { "<network>": [{ "kind", "url"? }, …] } — per-network chain of history indexers for get_transaction_history, tried in order. Kinds: etherscan, nodereal, tronscan, trongrid, esplora, blockcypher, solana-rpc, toncenter, tonapi, xrp-rpc
IW_TON_API_KEYunsetTonCenter API key. Keyless TonCenter is ~1 request/s per IP (shared by every process behind the same NAT)
IW_TONAPI_KEYunsettonapi.io Bearer token for the tonapi history fallback; keyless is ~1 request/s per IP
IW_LOG_ENABLED1JSONL diagnostics to a log file (0 to disable)
IW_LOG_FILE{keystoreDir}/logs/iw-mcp-YYYY-MM-DD.jsonlLog path
IW_LOG_LEVELinfodebug / info / warn / error
IW_LOG_STDERR0Mirror logs to stderr (stdout is reserved for MCP)

Security

  • Seeds are encrypted at rest. They never appear in tool results, agent chat, or backend requests.
  • The agent can move funds without asking again. Optional wallet policy (readOnly, maxPerTxUsd, transfer recipient allow-list — set via set_wallet_policy) is off by default and applies to both send_transfer and execute_swap.
  • Anyone with the keystore and the wrapping secret controls the funds. A leaked seed cannot be revoked.
  • Timeout is not always failure: poll status before retrying a send or swap.
  • Desktop / stdio only. A phone or remote agent would need a design where signing stays on a trusted device.
  • Do not put a main wallet here. Use a small hot wallet.

Details and private disclosure: SECURITY.md.

License

MIT

Source: packages/mcp-server/README.md at commit 173c2d6

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v1.2.1LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts