Metadata-Version: 2.4
Name: tenzro-mcp-server
Version: 0.1.1
Summary: MCP server for Tenzro Network — 360 tools for AI agents
Project-URL: Homepage, https://tenzro.com
Project-URL: Repository, https://github.com/tenzro/tenzro-mcp-server
License:                                  Apache License
                                   Version 2.0, January 2004
                                http://www.apache.org/licenses/
        
           TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
        
           1. Definitions.
        
              "License" shall mean the terms and conditions for use, reproduction,
              and distribution as defined by Sections 1 through 9 of this document.
        
              "Licensor" shall mean the copyright owner or entity authorized by
              the copyright owner that is granting the License.
        
              "Legal Entity" shall mean the union of the acting entity and all
              other entities that control, are controlled by, or are under common
              control with that entity. For the purposes of this definition,
              "control" means (i) the power, direct or indirect, to cause the
              direction or management of such entity, whether by contract or
              otherwise, or (ii) ownership of fifty percent (50%) or more of the
              outstanding shares, or (iii) beneficial ownership of such entity.
        
              "You" (or "Your") shall mean an individual or Legal Entity
              exercising permissions granted by this License.
        
              "Source" form shall mean the preferred form for making modifications,
              including but not limited to software source code, documentation
              source, and configuration files.
        
              "Object" form shall mean any form resulting from mechanical
              transformation or translation of a Source form, including but
              not limited to compiled object code, generated documentation,
              and conversions to other media types.
        
              "Work" shall mean the work of authorship, whether in Source or
              Object form, made available under the License, as indicated by a
              copyright notice that is included in or attached to the work
              (an example is provided in the Appendix below).
        
              "Derivative Works" shall mean any work, whether in Source or Object
              form, that is based on (or derived from) the Work and for which the
              editorial revisions, annotations, elaborations, or other modifications
              represent, as a whole, an original work of authorship. For the purposes
              of this License, Derivative Works shall not include works that remain
              separable from, or merely link (or bind by name) to the interfaces of,
              the Work and Derivative Works thereof.
        
              "Contribution" shall mean any work of authorship, including
              the original version of the Work and any modifications or additions
              to that Work or Derivative Works thereof, that is intentionally
              submitted to Licensor for inclusion in the Work by the copyright owner
              or by an individual or Legal Entity authorized to submit on behalf of
              the copyright owner. For the purposes of this definition, "submitted"
              means any form of electronic, verbal, or written communication sent
              to the Licensor or its representatives, including but not limited to
              communication on electronic mailing lists, source code control systems,
              and issue tracking systems that are managed by, or on behalf of, the
              Licensor for the purpose of discussing and improving the Work, but
              excluding communication that is conspicuously marked or otherwise
              designated in writing by the copyright owner as "Not a Contribution."
        
              "Contributor" shall mean Licensor and any individual or Legal Entity
              on behalf of whom a Contribution has been received by Licensor and
              subsequently incorporated within the Work.
        
           2. Grant of Copyright License. Subject to the terms and conditions of
              this License, each Contributor hereby grants to You a perpetual,
              worldwide, non-exclusive, no-charge, royalty-free, irrevocable
              copyright license to reproduce, prepare Derivative Works of,
              publicly display, publicly perform, sublicense, and distribute the
              Work and such Derivative Works in Source or Object form.
        
           3. Grant of Patent License. Subject to the terms and conditions of
              this License, each Contributor hereby grants to You a perpetual,
              worldwide, non-exclusive, no-charge, royalty-free, irrevocable
              (except as stated in this section) patent license to make, have made,
              use, offer to sell, sell, import, and otherwise transfer the Work,
              where such license applies only to those patent claims licensable
              by such Contributor that are necessarily infringed by their
              Contribution(s) alone or by combination of their Contribution(s)
              with the Work to which such Contribution(s) was submitted. If You
              institute patent litigation against any entity (including a
              cross-claim or counterclaim in a lawsuit) alleging that the Work
              or a Contribution incorporated within the Work constitutes direct
              or contributory patent infringement, then any patent licenses
              granted to You under this License for that Work shall terminate
              as of the date such litigation is filed.
        
           4. Redistribution. You may reproduce and distribute copies of the
              Work or Derivative Works thereof in any medium, with or without
              modifications, and in Source or Object form, provided that You
              meet the following conditions:
        
              (a) You must give any other recipients of the Work or
                  Derivative Works a copy of this License; and
        
              (b) You must cause any modified files to carry prominent notices
                  stating that You changed the files; and
        
              (c) You must retain, in the Source form of any Derivative Works
                  that You distribute, all copyright, patent, trademark, and
                  attribution notices from the Source form of the Work,
                  excluding those notices that do not pertain to any part of
                  the Derivative Works; and
        
              (d) If the Work includes a "NOTICE" text file as part of its
                  distribution, then any Derivative Works that You distribute must
                  include a readable copy of the attribution notices contained
                  within such NOTICE file, excluding those notices that do not
                  pertain to any part of the Derivative Works, in at least one
                  of the following places: within a NOTICE text file distributed
                  as part of the Derivative Works; within the Source form or
                  documentation, if provided along with the Derivative Works; or,
                  within a display generated by the Derivative Works, if and
                  wherever such third-party notices normally appear. The contents
                  of the NOTICE file are for informational purposes only and
                  do not modify the License. You may add Your own attribution
                  notices within Derivative Works that You distribute, alongside
                  or as an addendum to the NOTICE text from the Work, provided
                  that such additional attribution notices cannot be construed
                  as modifying the License.
        
              You may add Your own copyright statement to Your modifications and
              may provide additional or different license terms and conditions
              for use, reproduction, or distribution of Your modifications, or
              for any such Derivative Works as a whole, provided Your use,
              reproduction, and distribution of the Work otherwise complies with
              the conditions stated in this License.
        
           5. Submission of Contributions. Unless You explicitly state otherwise,
              any Contribution intentionally submitted for inclusion in the Work
              by You to the Licensor shall be under the terms and conditions of
              this License, without any additional terms or conditions.
              Notwithstanding the above, nothing herein shall supersede or modify
              the terms of any separate license agreement you may have executed
              with Licensor regarding such Contributions.
        
           6. Trademarks. This License does not grant permission to use the trade
              names, trademarks, service marks, or product names of the Licensor,
              except as required for reasonable and customary use in describing the
              origin of the Work and reproducing the content of the NOTICE file.
        
           7. Disclaimer of Warranty. Unless required by applicable law or
              agreed to in writing, Licensor provides the Work (and each
              Contributor provides its Contributions) on an "AS IS" BASIS,
              WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
              implied, including, without limitation, any warranties or conditions
              of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
              PARTICULAR PURPOSE. You are solely responsible for determining the
              appropriateness of using or redistributing the Work and assume any
              risks associated with Your exercise of permissions under this License.
        
           8. Limitation of Liability. In no event and under no legal theory,
              whether in tort (including negligence), contract, or otherwise,
              unless required by applicable law (such as deliberate and grossly
              negligent acts) or agreed to in writing, shall any Contributor be
              liable to You for damages, including any direct, indirect, special,
              incidental, or consequential damages of any character arising as a
              result of this License or out of the use or inability to use the
              Work (including but not limited to damages for loss of goodwill,
              work stoppage, computer failure or malfunction, or any and all
              other commercial damages or losses), even if such Contributor
              has been advised of the possibility of such damages.
        
           9. Accepting Warranty or Additional Liability. While redistributing
              the Work or Derivative Works thereof, You may choose to offer,
              and charge a fee for, acceptance of support, warranty, indemnity,
              or other liability obligations and/or rights consistent with this
              License. However, in accepting such obligations, You may act only
              on Your own behalf and on Your sole responsibility, not on behalf
              of any other Contributor, and only if You agree to indemnify,
              defend, and hold each Contributor harmless for any liability
              incurred by, or claims asserted against, such Contributor by reason
              of your accepting any such warranty or additional liability.
        
           END OF TERMS AND CONDITIONS
        
           APPENDIX: How to apply the Apache License to your work.
        
              To apply the Apache License to your work, attach the following
              boilerplate notice, with the fields enclosed by brackets "[]"
              replaced with your own identifying information. (Don't include
              the brackets!)  The text should be enclosed in the appropriate
              comment syntax for the file format. We also recommend that a
              file or class name and description of purpose be included on the
              same "printed page" as the copyright notice for easier
              identification within third-party archives.
        
           Copyright [yyyy] [name of copyright owner]
        
           Licensed under the Apache License, Version 2.0 (the "License");
           you may not use this file except in compliance with the License.
           You may obtain a copy of the License at
        
               http://www.apache.org/licenses/LICENSE-2.0
        
           Unless required by applicable law or agreed to in writing, software
           distributed under the License is distributed on an "AS IS" BASIS,
           WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
           See the License for the specific language governing permissions and
           limitations under the License.
License-File: LICENSE
Requires-Python: >=3.10
Requires-Dist: fastmcp>=3.0
Requires-Dist: httpx>=0.27
Description-Content-Type: text/markdown

# Tenzro MCP Server

The official [Model Context Protocol](https://modelcontextprotocol.io) server for [Tenzro Network](https://tenzro.com) — giving AI agents direct access to blockchain operations, token management, cross-chain bridges, NFTs, identity, compliance, event streaming, and more.

[![Python](https://img.shields.io/badge/python-3.10+-blue)](https://python.org)
[![MCP](https://img.shields.io/badge/MCP-2025--11--25-blue)](https://modelcontextprotocol.io)
[![License](https://img.shields.io/badge/license-Apache--2.0-green)](LICENSE)

## Overview

The Tenzro MCP server is an installable Python package that exposes 360 blockchain and multi-modal AI tools to any MCP-compatible AI agent (Claude, GPT, Cursor, Windsurf, etc.) via **stdio** or **Streamable HTTP** transport. Install with `pip install tenzro-mcp-server` and run locally, or connect directly to the live testnet endpoint. Agents can query balances, send transactions, mint NFTs, bridge tokens, check compliance, subscribe to events, run timeseries forecasts, embed images and text, segment and detect objects, transcribe audio, and interact with AI models — all through the standard MCP tool interface.

The companion Tenzro Rust node MCP server (`crates/tenzro-node/src/mcp/server.rs`) registers **535 tools** (Tenzro Ledger + multi-modal AI + distributed MoE serving + ERC-8004 calldata encoders + AgentBond/insurance + agent memory + app hosting + multi-tenant file storage) and is the authoritative tool inventory; this Python distributable exposes a subset over stdio + Streamable HTTP.

**Access on a gated node.** A node operator may require a service key across the
node's service surfaces. Model _serving_ does not answer to that gate — a model
published at `network` visibility is reachable by payment alone — but that
carve-out currently applies to the **JSON-RPC** surface only, which is what
provider announcements advertise. MCP stays fully gated: reaching this server on
a gated node needs the service key in `X-Tenzro-Service-Key`, whatever a model's
visibility is. See [`docs/ACCESS.md`](https://github.com/tenzro/tenzro-network/blob/main/docs/ACCESS.md).

The Rust server also carries an RPC gateway pair — `list_rpc_methods` enumerates the JSON-RPC methods the node serves with how each is gated (admin token vs API-key scope), and `call_rpc` invokes anything you find there. The named tools cover the surfaces worth a dedicated schema; the node serves roughly 900 methods in total, so the gateway is how an agent reaches capability added since its tool list was built. Filter with `namespace` or `contains` — the unfiltered directory is ~900 entries. Authorization is unchanged: a gateway call passes the same gates as any other, so it reaches exactly what the presented credentials already allow.

**Testnet endpoint:** `https://mcp.tenzro.xyz/mcp`
**Local:** `http://localhost:3001/mcp`

## Installation

```bash
pip install tenzro-mcp-server
```

Or from source:

```bash
git clone https://github.com/tenzro/tenzro-network.git
cd integrations/mcp
pip install .
```

## Quick Start

### Claude Desktop

Add to `~/Library/Application Support/Claude/claude_desktop_config.json`:

**Option A: Connect to live testnet**

```json
{
  "mcpServers": {
    "tenzro": {
      "url": "https://mcp.tenzro.xyz/mcp"
    }
  }
}
```

**Option B: Run locally**

```json
{
  "mcpServers": {
    "tenzro": {
      "command": "tenzro-mcp-server"
    }
  }
}
```

### Claude Code

Add to your project's `.mcp.json`:

**Option A: Connect to live testnet**

```json
{
  "mcpServers": {
    "tenzro": {
      "type": "url",
      "url": "https://mcp.tenzro.xyz/mcp"
    }
  }
}
```

**Option B: Run locally**

```json
{
  "mcpServers": {
    "tenzro": {
      "type": "stdio",
      "command": "tenzro-mcp-server"
    }
  }
}
```

### Cursor / Windsurf / Other MCP Clients

**Option A: Connect to live testnet**

- **Name:** tenzro
- **Transport:** Streamable HTTP
- **URL:** `https://mcp.tenzro.xyz/mcp`

**Option B: Run locally**

- **Name:** tenzro
- **Command:** `tenzro-mcp-server`

Or with Streamable HTTP transport:

- **URL:** `http://localhost:3001/mcp`
- Start the server first: `tenzro-mcp-server --transport http --port 3001`

## Available Tools

The server exposes a Python subset across the categories below. The authoritative tool inventory lives on the Rust server (`crates/tenzro-node/src/mcp/server.rs`); consult that source for the complete list.

### Authentication (OAuth 2.1 + DPoP + AAP)

The Tenzro Agent Access Protocol (AAP) layers seven `aap_*` claims on top of OAuth 2.1, DPoP-bound JWTs (RFC 9449), and Rich Authorization Requests (RFC 9396).

- `onboard_human` — Provision a `did:tenzro:human:*` identity, FROST-Ed25519 threshold wallet, and access + refresh tokens (RFC 6749 + RFC 9449).
- `onboard_delegated_agent` — Issue an agent identity bound to a controller DID with a delegation scope.
- `onboard_autonomous_agent` — Issue a fully autonomous agent identity backed by a TNZO bond.
- `refresh_token` — Exchange a refresh token for a fresh access token (refresh tokens are not rotated in V1).
- `link_wallet_for_auth` — Mint a fresh access + refresh token pair against an existing FROST-Ed25519 threshold wallet.
- `revoke_did` — Cascade-invalidate every JWT minted under a DID and mark the identity `Revoked`.
- `oauth_discovery` — RFC 8414 Authorization Server Metadata discovery document.
- `exchange_token` — RFC 8693 OAuth 2.0 Token Exchange for delegated/impersonation flows.
- `introspect_token` — RFC 7662 OAuth 2.0 Token Introspection.

Pass `dpop_jkt` (RFC 7638 thumbprint of the holder's Ed25519 public key) to bind the issued token — every subsequent privileged call must then carry a fresh DPoP proof signed by the same key.

The RAR types the authorization server accepts are `transfer`, `create_escrow`, `discharge_escrow`, `inference`, `stake`, `vote`, `contract`, `register_identity`, and `resource_invocation`. The last of these is how a controller caps what its agent may spend on a marketplace resource: it takes a `max_amount_per_call` ceiling and optionally narrows to one resource `class` and a list of `allowed_resource_ids`. A controller that instead lists `resource.invoke` in the AAP oversight claim's `requires_human_approval_for` parks every paid invocation for review.

### Wallet & Balance (7 tools)

- `get_balance` — Get TNZO balance in wei
- `create_wallet` — Provision a chain-agnostic 2-of-3 FROST-Ed25519 (RFC 9591) threshold wallet (no seed phrase). Tenzro wallets are not per-chain — a single wallet projects into EVM, SVM, and Canton via the pointer-token model, so there is no `chain` parameter. Use `cross_vm_transfer` / `wrap_tnzo` for VM-specific operations and the bridge tools (`bridge_tokens`, deBridge, Wormhole, Li.Fi) for sends to external chains.
- `send_transaction` — Send TNZO transfer via server-side `tenzro_signAndSendTransaction` (live nonce + gas-price lookup; accepts `value` or `amount` alias; rejects self-sends with `cannot transfer to self`)
- `send_self_custody_transaction` — Submit a transaction the caller signed itself. The node never sees the private key; it verifies the supplied signature against the transaction hash and broadcasts.
- `request_faucet` — Request testnet TNZO (24h cooldown). The amount is set by the node's genesis faucet config and reported in the response.
- `token_balance` — Get TNZO balance via token subsystem
- `total_supply` — Get total TNZO supply

### Node & Blocks (10 tools)

- `get_node_status` — Node health, block height, peers, uptime, role
- `get_block` — Get block by height with transactions
- `get_block_range` — Batch-fetch a contiguous range of blocks for catch-up sync (max 256/call; returns `nextHeight` + `moreAvailable` for pagination)
- `get_transaction_receipt` — Look up a transaction receipt by hash: sender, recipient, status, gas used, logs
- `get_gas_price` — Current effective gas price in wei (base fee + suggested tip)
- `get_max_priority_fee_per_gas` — Suggested EIP-1559 priority fee in wei
- `get_fee_history` — Base-fee history and gas-usage ratios over the last N blocks
- `get_price` — Read one or more asset prices from the node's price oracle
- `list_mandates` — List the persisted AP2 mandates authorized by a controller DID
- `get_svm_cross_vm_program_info` — Canonical Tenzro Cross-VM SVM-native program id and instruction layout

### Identity (7 tools)

- `register_identity` — Register human or machine DID via TDIP
- `resolve_did` — Resolve DID to identity info and delegation scope
- `revoke_did` — Revoke a DID and cascade the revocation to every JWT minted under it
- `forget_identity` — GDPR Article 17 right-to-erasure. Hard-deletes a `Revoked` DID from the registry and persistent storage. The DID must already be in `Revoked` status; call `revoke_did` first and allow the cascading broadcaster to propagate.
- `set_delegation_scope` — Set spending limits and allowed operations for machine DID
- `set_username` — Set human-readable username for a DID
- `resolve_username` — Resolve username to DID

### Payments (11 tools)

- `create_payment_challenge` — Create MPP, x402, or native payment challenge
- `verify_payment` — Verify payment credential and settle on-chain
- `list_payment_protocols` — List supported payment protocols
- `list_x402_schemes` — Discover registered x402 scheme adapters (`tenzro-hybrid` default, `exact-eip3009`, `permit2`, `erc7710`)
- `settle_payment` — Execute immediate settlement
- `create_escrow` — Build & sign a `CreateEscrow` transaction (consensus-mediated, gas: 75,000). VM derives `escrow_id` and locks funds at a derived vault address.
- `release_escrow` — Build & sign a `ReleaseEscrow` transaction (payer-only, gas: 60,000)
- `refund_escrow` — Build & sign a `RefundEscrow` transaction (after expiry, payer-only, gas: 50,000)
- `get_escrow` — Read an escrow record by id (calls `tenzro_getEscrow`)
- `open_payment_channel` — Open micropayment channel
- `close_payment_channel` — Close payment channel with final balance

### x402 Bazaar (6 tools)

A discovery catalog over the x402 payment surface: sellers register paid resources, buyers browse and verify offers before paying.

- `x402_protocol_info` — x402 protocol metadata and registered scheme adapters (`tenzro-hybrid`, `exact-eip3009`, `permit2`, `erc7710`)
- `x402_register_resource` — Register a paid resource listing (resource, scheme, network, asset, pay-to, max amount required, tags). Listing id is derived from `(seller_did, resource)`, so re-registration is idempotent.
- `x402_discover_resources` — Browse listings, filtered by scheme / network / asset / tags
- `x402_deregister_resource` — Remove a listing by id (seller-scoped)
- `x402_verify_offer` — Validate a payment requirement against the registered scheme adapters before a buyer commits
- `x402_payment_id` — Derive the deterministic payment id for a settlement

### AP2 v0.2 (Agent Payments Protocol)

- `ap2_sign_mandate` — Sign a `checkout` or `payment` mandate. The wallet bound to `signer_did` signs the canonical preimage with its Ed25519 key. Only AP2 v0.2 `"ed25519"` alg is supported.
- `ap2_verify_mandate` — Verify a single Verifiable Digital Credential (VDC) envelope (checkout or payment mandate)
- `ap2_validate_mandate_pair` — Nested-ceiling validation of a checkout → payment mandate pair: AP2 CheckoutMandate constraints + TDIP `DelegationScope` (`enforce_operation`) + runtime `SpendingPolicy` (`SpendingPolicySnapshot::check`) + on-chain escrow balance when the pair carries an `escrow_id` + Stripe SPT `usage_limits` when it carries an `spt_grant_id`. An identifier that fails to resolve is a refusal, not a skip.
- `ap2_protocol_info` — AP2 protocol metadata and supported features

The ERC-8004 Trustless Agents calldata encoders (`erc8004_encode_*` / `erc8004_decode_*` for the Identity, Reputation, and Validation registries) are registered on the Rust node MCP server, not on this Python package. Agent registration itself happens through TDIP: a single `register_machine_with_fee` write mirrors into the EVM registry proxies and, when the operator has wired them, into the SVM and DAML backends. `agentId` is server-allocated by each backing registry (sequential `uint256` on EVM, 32-byte Pubkey on SVM, 8-byte LE u64 on DAML) — never derivable client-side.

### AI Models (16 tools)

- `list_models` — List available AI models
- `chat_completion` — Send chat completion request to a named model
- `route_by_intent` — Select a model from a use case plus budget, quality floor and cost-quality knob instead of naming one. Returns the model, tier, estimated cost, fallback chain, the difficulty cluster the prompt landed in, that model's observed error rate there, and the winning provider's address and endpoint when the offer came from another operator. Discovery only, though the per-DID budget gate and the wallet-balance ceiling still apply.
- `chat_by_intent` — Select and run in one call. Dispatch is pinned to the offer that was scored, so the price quoted is the price settled and the provider share goes to the address that offer named. The decision is attached under `route`.
- `record_route_outcome` — Report how a routed call turned out (`resolved` / `escalated` / `failed`) so per-cluster error rates reflect what happened. In practice this carries `escalated`; the other two are recorded from the dispatch itself. `retained: false` means the node has no difficulty index and the report was discarded.
- `route_difficulty_stats` — Read the cluster map and a model's per-cluster outcome counters. An operator diagnostic; `enabled: false` means the node routes on declared metadata alone.
- `list_model_endpoints` — List model service endpoints. Each endpoint carries `iroh_endpoint_id`, the hex iroh `EndpointId` of the serving node (empty for local-only services); cross-node inference routes to it over the `tenzro/infer` ALPN.
- `get_provenance` — Read the cached provenance manifest for generated content by content hash (the synthetic-content marker per EU AI Act Art. 50(2))
- `get_trainer_daemon_status` — Report the trainer auto-provisioning daemon status
- `discover_models` — Discover models on network
- `download_model` — Download model from registry
- `serve_model` — Start serving a model. Auto-clusters when one host cannot hold the model: reads the GGUF header for layer count and hidden dimension, discovers LAN members from gossiped `ClusterProfile` announcements, and runs a layer-wise pipeline across them. Pass `force_single` to keep it on one host, or `cluster_members` to override discovery.
- `stop_model` — Stop serving a model
- `delete_model` — Delete a downloaded model
- `get_download_progress` — Check model download progress
- `list_providers` — List registered providers

### Multi-Modal AI (41 tools)

Per-modality `list_*_catalog`, `list_*_models`, `load_*_model`, `unload_*_model`, plus the modality verb. Catalogs draw from `OnnxForecastEntry`, `OnnxVisionEntry`, `OnnxTextEmbeddingEntry`, `OnnxSegmentationEntry`, `OnnxTextSegmentationEntry`, `OnnxDetectionEntry`, `OnnxAudioEntry`, and `OnnxVideoEntry` in `tenzro-model`.

Passing `catalog_id` to a loader inherits the structural parameters from the catalog entry and runs the license-tier check (Permissive / Attribution / CommercialCustom / NonCommercial) — a CommercialCustom entry such as DINOv3 or SAM is refused with JSON-RPC `-32010` unless the node operator started `tenzro-node` accepting that license. Supplying the structural parameters explicitly skips the check. `model_id` on a loader is the id you register under; `model_id` on an inference call is that registered id, never the catalog id.

- **Forecast** — `list_forecast_catalog`, `list_forecast_models`, `load_forecast_model`, `unload_forecast_model`, `forecast` (TimesFM 2.5 200M, TiRex 35M)
- **Vision** — `list_vision_catalog`, `list_vision_models`, `load_vision_model`, `unload_vision_model`, `vision_embed`, `vision_similarity` (CLIP ViT-B/32 + L/14, SigLIP base/224, SigLIP2 base/large/so400m, DINOv3 vits16/vitb16/vitl16)
- **Text Embedding** — `list_text_embedding_catalog`, `list_text_embedding_models`, `load_text_embedding_model`, `unload_text_embedding_model`, `text_embed` (Qwen3-Embedding 0.6B/4B/8B, EmbeddingGemma-300M Matryoshka, BGE-M3, ModernBERT-embed base/large)
- **Segmentation** — `list_segmentation_catalog`, `list_segmentation_models`, `load_segmentation_model`, `unload_segmentation_model`, `segment` (SAM 2 base/large, EdgeSAM, MobileSAM — point and box prompts)
- **Text-Promptable Segmentation** — `list_text_segmentation_catalog`, `list_text_segmentation_models`, `load_text_segmentation_model`, `unload_text_segmentation_model`, `text_segment` (SAM 3 ViT-H — open-vocabulary noun phrases, its own runtime and decoder ABI)
- **Detection** — `list_detection_catalog`, `list_detection_models`, `load_detection_model`, `unload_detection_model`, `detect` (RF-DETR n/s/m/b/l/2xl, D-FINE n/s/m/l/x)
- **Audio (ASR)** — `list_audio_catalog`, `list_audio_models`, `load_audio_model`, `unload_audio_model`, `transcribe` (Moonshine tiny/base, Distil-Whisper small.en/medium.en/large-v3, Whisper-large-v3-turbo, Parakeet-TDT-0.6B-v3, Canary-1B-Flash)
- **Video** — `list_video_catalog`, `list_video_models`, `load_video_model`, `unload_video_model`, `video_embed` (V-JEPA 2 ViT-L/H/g in the catalog; `load_video_model` registers a `VisionFallbackVideoEncoder` over an already-loaded image encoder, so it takes `vision_model_id` + `num_frames` rather than a path)

### Staking & Governance (7 tools)

- `stake_tokens` — Stake TNZO as Validator, ModelProvider, or TeeProvider
- `unstake_tokens` — Unstake TNZO (initiates unbonding)
- `register_provider` — Register as network provider
- `get_provider_stats` — Get provider statistics
- `list_proposals` — List active governance proposals
- `vote_on_proposal` — Vote on a proposal (for/against/abstain)
- `get_voting_power` — Get voting power based on staked TNZO

### Validator Registry (4 tools)

- `get_validator_state` — Read one validator's registry record
- `list_validators` — List every validator known to the registry
- `list_active_validators` — List the validators in the active set for the current epoch
- `rotate_validator_key` — Rotate a validator's signing key without leaving the active set

### Bridge (5 tools)

- `bridge_tokens` — Bridge tokens via LayerZero, CCIP, or deBridge
- `get_bridge_routes` — Get available routes with fees and timing
- `list_bridge_adapters` — List bridge adapters
- `bridge_quote` — Get bridge fee quote
- `bridge_with_hook` — Bridge with post-delivery hook

### Tokens (7 tools)

- `create_token` — Create ERC-20 token via factory
- `get_token_info` — Look up token by symbol, address, or ID
- `list_tokens` — List registered tokens
- `deploy_contract` — Deploy bytecode to EVM/SVM/DAML
- `cross_vm_transfer` — Atomic cross-VM token transfer
- `wrap_tnzo` — Wrap native TNZO to VM representation
- `get_token_balance` — Get TNZO balance across all VMs

### Tasks (7 tools)

- `post_task` — Post task to marketplace
- `list_tasks` — List tasks by type or status
- `get_task` — Get task details
- `quote_task` — Submit price quote for a task
- `assign_task` — Assign task to agent
- `complete_task` — Mark task complete with result
- `cancel_task` — Cancel a task

### Agents (9 tools)

- `register_agent` — Register AI agent with capabilities
- `send_agent_message` — Send inter-agent message via A2A
- `spawn_agent` — Spawn child agent
- `create_swarm` — Create multi-agent swarm
- `get_swarm_status` — Get swarm status
- `terminate_swarm` — Terminate swarm
- `list_agents` — List all registered agents
- `get_agent_info` — Get agent details
- `deregister_agent` — Deregister an agent

### Capability Registry (4 tools)

- `list_capabilities` — List every capability registered on this node
- `get_capability_attestations` — Fetch attestations backing a capability claim
- `get_agent_capability_attestations` — Fetch every attestation issued for one agent
- `find_best_agent_for_capability` — Pick the best agent for a capability

### Agent Templates (7 tools)

- `register_agent_template` — Register reusable template
- `list_agent_templates` — List available templates
- `get_agent_template` — Get template details
- `search_agent_templates` — Search by name or description
- `spawn_from_template` — Spawn agent from template
- `rate_template` — Rate template (1-5 stars)
- `get_template_stats` — Get template usage stats

### NFTs (6 tools)

- `create_nft_collection` — Create ERC-721 or ERC-1155 collection
- `mint_nft` — Mint NFT in collection
- `transfer_nft` — Transfer NFT ownership
- `get_nft_info` — Query collection or token info
- `list_nft_collections` — List NFT collections
- `register_nft_pointer` — Register cross-VM NFT pointer

### Compliance (3 tools)

- `check_compliance` — Check if transfer is compliant
- `register_compliance` — Register compliance rules
- `freeze_address` — Freeze address for compliance

### Canton / DAML (Canton 3.5+ JSON Ledger API)

Canton is an operator-brokered resource: the ledger sits outside Tenzro and
the node reaches it with credentials the operator supplies. Every tool here
needs an API key with the `canton` scope, set as `TENZRO_API_KEY`. A node
serves each Canton network independently and a key is authorized for a
subset of them — set `TENZRO_CANTON_NETWORK` to `devnet` or `mainnet` and
the client merges it into each call as `canton_network`. A key authorizing
exactly one network needs no selector; a key authorizing more than one and
given none returns `-32004` naming the authorized set.

Each key carries a tier bounding its budget over a sliding 60-second
window: `free` at 60 requests/min with writes refused, `standard` at 600,
`priority` at 6,000. Over-budget returns `-32005` with `retry_after_ms`,
`requests_per_minute`, and `tier`.

Keys gate operator-brokered resources only. Publishing to the marketplace
registry — agents, skills, workflows, MCP servers — is permissionless,
priced by the provider in TNZO or offered free, and needs no operator
approval.

Reads:

- `canton_list_domains` — List Canton synchronization domains the node is configured against
- `canton_list_contracts` — Active-contracts query with `template_ids` filter (Canton 3.5+ requires a non-empty filter; the node attaches the resolved FQ party id automatically)
- `canton_list_parties` — `GET /v2/parties/known`
- `canton_list_packages` — `GET /v2/packages` — installed DAR package ids
- `canton_health` — combined `/livez` + `/readyz` + `/v2/version` probe
- `canton_version` — `GET /v2/version` — participant version + CIP feature flags (verified Canton 3.5.1)
- `canton_get_my_user` — Canton user record for the calling principal (CIP-26 User Management)
- `canton_coin_balance` — CIP-56 Canton Coin balance (sums every `Splice.Amulet:Amulet` contract the party signs)
- `canton_fee_schedule` — latest `Splice.AmuletRules:AmuletRules` active contract
- `canton_connected_synchronizers` — `GET /v2/state/connected-synchronizers` — currently-subscribed synchronizers with permission classes
- `canton_get_transaction` — `GET /v2/updates/transaction-tree-by-id/{hex}?requestingParties=...`

Writes:

- `canton_submit_command` — DAML `create` / `exercise` via the JSON Ledger API submit-and-wait path. When the presenting API key carries a bound `canton_user_id`, the node forwards `actAs` as that user's `primaryParty`, scoping the submission to the tenant. Canton's AuthService enforces per-user CanActAs rights server-side.
- `canton_allocate_party` — `POST /v2/parties` — returns the fully-qualified party id `<hint>::<participant-hash>`
- `canton_grant_user_rights` — `POST /v2/users/{userId}/rights` — grant CanActAs / CanReadAs on a party to a tenant's user (CIP-26). Required before a newly-allocated party can be acted on.
- `canton_list_user_rights` — `GET /v2/users/{userId}/rights` — inspect what a tenant can act/read as.
- `canton_upload_dar` — DAR upload via `POST /v2/packages` with a single `Content-Type: application/octet-stream` header (Canton 3.5+ rejects duplicates). Legacy `/admin/packages/upload-dar` is NOT used — that's gRPC-only and not exposed on the Tenzro-operated DevNet.

Per-tenant analytics:

- `canton_get_my_analytics` — Subject self-read: per-tenant call counters for the API key configured on this client. Returns `{key_id, canton_user_id, calls_total, errors_total, calls_by_method, errors_by_method, first_seen_at, last_called_at}`.
- `canton_list_api_key_analytics` — Operator admin-read: every tenant's counters (admin-token-gated). Optional `key_id` filter.

Node-scoped equivalents that go through the node's own Canton adapter rather than the tenant-scoped path: `list_canton_domains`, `list_daml_contracts`, `submit_daml_create`, `submit_daml_exercise`.

### Verification (1 tool)

- `verify_zk_proof` — Verify Plonky3 STARK proof over the KoalaBear field; requires `circuit_id` ∈ {inference, settlement, identity} and 4-byte LE field-chunk public inputs

### Tenzro Train (1 tool)

- `get_trainer_daemon_status` — Report the node's trainer auto-provisioning daemon: running state, trainer DID, live trainer subprocess count, and concurrent-trainer ceiling

### Events (3 tools)

- `get_events` — Query historical events
- `subscribe_events` — Subscribe to real-time events
- `register_webhook` — Register webhook for notifications

### Join (1 tool)

- `join_as_participant` — Join network as MicroNode

### Skills Registry (5 tools)

- `list_skills` — List registered skills
- `register_skill` — Register new skill
- `search_skills` — Search by keyword or tag
- `get_skill` — Get skill details
- `use_skill` — Invoke a skill

### Tools Registry (5 tools)

- `list_registered_tools` — List registered MCP tools
- `register_tool` — Register MCP server endpoint
- `search_tools` — Search tools by keyword
- `get_tool_info` — Get tool details
- `use_registered_tool` — Invoke a registered tool

### Hardware (1 tool)

- `get_hardware_profile` — Detect hardware capabilities

### Usage (2 tools)

- `get_skill_usage` — Get skill usage statistics
- `get_tool_usage` — Get tool usage statistics

### Crypto (9 tools)

- `sign_message` — Sign message with Ed25519 or Secp256k1
- `verify_signature` — Verify signature
- `encrypt_data` — AES-256-GCM encryption
- `decrypt_data` — AES-256-GCM decryption
- `derive_key` — Derive child key from seed
- `generate_keypair` — Generate new keypair
- `hash_sha256` — Compute SHA-256 hash
- `hash_keccak256` — Compute Keccak-256 hash
- `x25519_key_exchange` — X25519 Diffie-Hellman key exchange

### TEE (6 tools)

- `detect_tee` — Detect available TEE hardware
- `get_tee_attestation` — Get TEE attestation quote
- `verify_tee_attestation_rpc` — Verify attestation quote
- `seal_data` — Seal data inside TEE enclave
- `unseal_data` — Unseal TEE-sealed data
- `list_tee_providers` — List registered TEE providers

### ZK (2 tools)

- `create_zk_proof` — Create a Plonky3 STARK proof over KoalaBear (`inference`, `settlement`, `identity` circuits)
- `list_zk_circuits` — List available ZK circuits

### Custody (9 tools)

- `create_mpc_wallet` — Create FROST-Ed25519 (RFC 9591) threshold wallet
- `export_keystore` — Export encrypted keystore
- `import_keystore` — Import from keystore
- `get_key_shares` — Get FROST-Ed25519 secret share configuration
- `rotate_keys` — Rotate FROST-Ed25519 secret shares
- `set_spending_limits` — Set daily and per-tx limits
- `get_spending_limits` — Get spending limits and usage
- `authorize_session` — Create time-limited session key
- `revoke_session` — Revoke active session key

### App (6 tools)

- `register_app` — Register a developer app in the on-chain app registry (developer-signed DID envelope; app wallet is the developer's own TNZO treasury)
- `set_app_status` — Activate or deactivate a registered app
- `get_app` — Look up a registered app by id
- `list_apps` — List apps in the on-chain app registry
- `settle_authorized` — Execute a developer-signed settlement authorization
- `get_settle_authorized_outcome` — Fetch the recorded outcome for a settlement authorization

### Contract Encoding (2 tools)

- `encode_function` — ABI-encode smart contract function call
- `decode_result` — ABI-decode return data

### Streaming (2 tools)

- `chat_stream` — Stream chat completion token by token
- `subscribe_events_stream` — Subscribe to events via streaming

### deBridge Cross-Chain (5 tools)

- `debridge_search_tokens` — Search tokens on deBridge DLN
- `debridge_get_chains` — Get supported chains
- `debridge_get_instructions` — Get operational instructions
- `debridge_create_tx` — Create cross-chain transaction
- `debridge_same_chain_swap` — Execute same-chain swap

### Capital Intent (regulated capital allocation)

- `capital_intent_open` — Open a signed Capital Intent (capital-markets analog of an AP2 Intent Mandate)
- `capital_intent_quote` — Solver submits a bid against an opened intent
- `capital_intent_assign` — Auto-rank by ERC-8004 reputation, price, ETA
- `capital_intent_execute` — Execute a leg
- `capital_intent_verify` — Verify a step
- `capital_intent_compensate` — Roll back a step
- `capital_intent_settle` — Release escrow to the payee
- `get_capital_intent` — Read intent state
- `submit_reserve_attestation` — 1:1 backing attestation
- `get_reserve` — Read latest reserve attestation
- `attested_mint` — Token issuance gated by a fresh reserve attestation

### Multi-party workflows (8 tools)

- `workflow_open` — Declare a saga workflow with ordered steps
- `workflow_step_execute` — Transition step Pending → Executing (with optional per-step escrow)
- `workflow_step_verify` — Verify a step's outcome
- `workflow_step_compensate` — Roll back a step
- `workflow_set_step_deadline` — Set or clear a step's execution deadline
- `workflow_finalize` — Emit on-chain WorkflowReceipt
- `get_workflow_saga` — Read the saga state: steps, statuses, escrows, participants
- `verify_did_envelope` — Verify a DID-signed step payload

### EVM-side primitives (EIP-7702 / Permit2 / Secure-Mint)

- `eip7702_signing_hash`, `eip7702_build_designator`, `eip7702_parse_designator`, `eip7702_protocol_info` — Pectra Type-4 authorization hashing and the 23-byte `0xef0100 || addr20` delegation designator
- `permit2_domain_separator`, `permit2_digest`, `permit2_verify_and_consume`, `permit2_nonce_used` — Permit2 SignatureTransfer (optional witness for cross-chain intent origin opens)
- `set_secure_mint_policy`, `get_secure_mint_policy`, `clear_secure_mint_policy`, `secure_mint_check`, `secure_mint_apply`, `secure_mint_record_burn`, `set_secure_mint_paused`, `set_global_issuance_pause` — per-token 1:1 reserve-attestation invariant for tokenized RWAs (token-keyed; fail-closed gate order with freshness/heartbeat/velocity guards; per-token + global issuance circuit breakers)

### Chain-agnostic discovery (CAIP)

- `caip2`, `caip10`, `caip19` — Canonical Tenzro CAIP identifiers per the submitted `tenzro` namespace spec (`ChainAgnostic/namespaces#184`). CAIP-2 reference is the lowercase hex of the first 16 bytes of the genesis block hash; CAIP-19 supports `slip44` / `token` / `nft` asset namespaces.

### Hyperlane V3 (4 tools)

- `hyperlane_list_chains` — Chain domains the Hyperlane adapter recognizes
- `hyperlane_quote_dispatch` — Quote the interchain gas payment for a dispatch
- `hyperlane_dispatch` — Dispatch a message through the Mailbox
- `hyperlane_get_message` — Read a dispatched message by id

### Axelar GMP (4 tools)

- `axelar_list_chains` — Canonical Axelar chain identifiers the adapter recognizes
- `axelar_call_contract` — General Message Passing call to a contract on another chain
- `axelar_pay_gas` — Pre-pay the Gas Service for a GMP call
- `axelar_get_message` — Read a GMP message by payload hash

### Babylon Bitcoin Staking (6 tools)

- `babylon_register_finality_provider` — Register a Tenzro validator as a Babylon finality provider
- `babylon_get_finality_provider` — Read one finality provider's record
- `babylon_list_finality_providers` — List registered finality providers
- `babylon_total_stake_for_provider` — Aggregate delegated BTC stake for a provider
- `babylon_submit_finality_signature` — Submit an EOTS finality signature over a Tenzro block hash
- `babylon_list_delegations` — List BTC delegations tracked by the adapter

### Bridge fees, sponsorship, and analytics (7 tools)

- `wormhole_ntt_list_chains` — Chains the Wormhole NTT path covers
- `quote_bridge_fee_in_tnzo` — Quote a bridge fee denominated in TNZO
- `set_bridge_fee_rate` — Set the fee rate applied to a bridge lane
- `list_bridge_sponsorship_pools` — List pools that can cover a user's bridge fee
- `sponsor_bridge_fee` — Draw a bridge fee from a sponsorship pool
- `set_sponsorship_refill_threshold` — Set the balance at which a sponsorship pool refills
- `get_bridge_analytics` / `list_bridge_analytics` — Per-lane and fleet-wide bridge counters

### Stable-Asset Issuance (4 tools)

- `register_stable_asset` — Register a reserve-backed asset with its issuance policy
- `get_stable_asset` — Read a registered stable asset
- `mint_stable_asset` — Mint against attested reserves
- `redeem_stable_asset` — Redeem and decrement circulating supply

### Regulated-asset controls (7 tools)

- `urwa_is_kill_switched` — Whether a token is under a kill switch
- `urwa_trigger_kill_switch` / `urwa_clear_kill_switch` — Halt and resume transfers for a token
- `urwa_get_frozen_tokens` / `urwa_set_frozen_tokens` — Read and set the frozen balance on a holder
- `ivms101_canonical_hash` — Canonical hash of an IVMS 101 originator/beneficiary record for travel-rule messaging
- `attested_clock_now` — Attested wall-clock reading for time-bound compliance checks

### Signed agent cards (1 tool)

- `signed_agent_card_canonical_hash` — Canonical hash of an A2A Agent Card, the preimage a publisher signs

### Decentralized Storage (6 tools)

- `storage_store_object` — Store an object with an erasure-coded redundancy scheme
- `storage_open_deal` — Open a streaming deal (renter pre-funds total epochs from deposit)
- `storage_charge_epoch` — Run one proof-of-retrievability-gated charge epoch
- `storage_get_deal` — Look up a storage deal by id
- `storage_set_pricing` — Set the byte-epoch pricing policy (fixed or network-dynamic)
- `storage_status` — Read this node's storage-provider status

### Compute Rental (5 tools)

- `compute_book_rental` — Book a rental (renter pre-funds total epochs from deposit)
- `compute_settle_epoch` — Settle one epoch, gated on the provider's availability proof
- `compute_get_rental` — Look up a compute rental by id
- `compute_set_pricing` — Set the per-epoch pricing policy (fixed or network-dynamic)
- `compute_status` — Read this node's compute-rental status

### Distributed MoE Serving (8 tools)

- `moe_shard_map` — Providers holding each (layer, expert), replication, hot / under-replicated experts, role counts
- `moe_plan_dispatch` — Build a dispatch plan from per-token top-k routing decisions
- `moe_replication_policy` — Read the governance-tuned replication policy
- `moe_catalog_shape` — Read the catalog-side MoE topology for a model
- `moe_prepare_experts` — Slice a checkpoint into per-expert blobs, optionally block-quantizing each projection (`q4_k_m` / `q8_0` / `q4_k` / `q6_k` preset or a per-projection `gate`/`up`/`down` mix), and publish them for holders; returns a `job_id`
- `moe_prepare_status` — Poll a preparation job for its state and prepared per-expert blob URIs
- `moe_expert_status` — Resident experts / gates with residency tier (`memory` / `disk`), byte footprint, memory budget, and GPU-active flag
- `moe_forward` — Run one distributed MoE layer forward: gate locally, fan experts out to holders, combine gate-weighted outputs

### Treasury Multisig (3 tools)

- `treasury_approve_withdrawal` — Approve a treasury withdrawal with a signed approval (Ed25519 or Secp256k1 over the `tenzro/treasury/withdrawal-approval` preimage)
- `treasury_execute_withdrawal` — Execute a withdrawal once approvals reach the threshold
- `treasury_get_pending_withdrawal` — Read a pending withdrawal: approvers, approvals, threshold

Treasury config mutations (add/remove withdrawer, threshold) are admin-token-gated RPCs reserved for the node operator and are not exposed as MCP tools.

### Local Discovery & LAN Clustering (5 tools)

- `local_peers` — Peers discovered on this node's local segment via mDNS
- `node_reachability` — Sustained connectivity tier (`direct` / `relay_only` / `unreachable`)
- `node_profile` — Hardware self-profile: build commit, CPU arch, OS, devices, derived serving capacity / backend / capability key
- `cluster_plan` — Deterministic layer-wise LAN cluster placement for a model across candidate members
- `cluster_preview` — Dry-run a placement against the currently discovered members without committing it

### Managed Databases (11 tools)

An engine-agnostic protocol layer over persistent state. A node either holds a thin stateless client to an operator-run engine (PostgreSQL / Qdrant / Valkey via URL config) or serves an embedded engine in-process (Lance / Tantivy). Milvus and Dgraph are catalog-only until a driver is linked. Placement is `local`, `lan_cluster`, or `network`; query bodies are per-engine dialects (SQL, vector search, full-text, command array).

- `list_database_engines` — The engine catalog with placement modes and driver status
- `create_database` — Create a database from a descriptor (engine, placement, access policy, optional confidential seal)
- `get_database` — Read a database descriptor by id
- `list_databases` — List databases on this node
- `list_database_partitions` — List partitions for a database
- `get_database_partition` — Read a single partition by index
- `issue_database_connection` — Mint a scoped connection to the backing engine
- `database_query` — Run an engine-native query (SQL / vector / full-text / command array)
- `authorize_database_read` — Grant a reader access under the database's access policy
- `rescale_database` — Change partition/replica count
- `drop_database` — Delete a database and its partitions

## Ecosystem MCP Servers

In addition to the main Tenzro MCP server, the node runs specialized servers for direct blockchain interaction:

| Server        | Port | Endpoint | Description                                                                                                                                                                                                                                                                                             |
| ------------- | ---- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Tenzro**    | 3001 | `/mcp`   | 535 tools — Tenzro Ledger + multi-modal AI (forecast, vision, text-embed, segmentation, detection, audio ASR, video) + distributed MoE serving + AgentBond/insurance + agent memory + app hosting                                                                                                       |
| **Solana**    | 3003 | `/mcp`   | 14 tools — Jupiter swaps, SPL tokens, Metaplex NFTs, SNS, staking                                                                                                                                                                                                                                       |
| **Ethereum**  | 3004 | `/mcp`   | 17 tools — Chainlink feeds, ENS, ERC-20, EAS, ERC-8004                                                                                                                                                                                                                                                  |
| **Canton**    | 3005 | `/mcp`   | 23 tools — Canton 3.5+ JSON Ledger API (active-contracts queries with live offset + FQ party id, party / package / connected-synchronizer / version / health reads, CIP-56 Canton Coin balance, AmuletRules fee schedule, DAR upload via `/v2/packages`, submit-and-wait DAML commands, DvP settlement) |
| **LayerZero** | 3006 | `/mcp`   | 21 tools — V2 messaging, OFT, Stargate V2, Value Transfer API                                                                                                                                                                                                                                           |
| **Chainlink** | 3007 | `/mcp`   | 21 tools — CCIP, data feeds, Data Streams, VRF v2.5, PoR, automation, Functions                                                                                                                                                                                                                         |
| **Li.Fi**     | 3008 | `/mcp`   | 9 tools — cross-chain aggregation, quotes, routes, status                                                                                                                                                                                                                                               |

## Programmatic Usage

### TypeScript

```typescript
import { Client } from "@modelcontextprotocol/sdk/client/index.js";
import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";

const transport = new StreamableHTTPClientTransport(
  new URL("https://mcp.tenzro.xyz/mcp"),
);
const client = new Client({ name: "my-app", version: "1.0.0" }, {});
await client.connect(transport);

// List all tools
const tools = await client.listTools();
console.log(`${tools.tools.length} tools available`);

// Check balance
const balance = await client.callTool({
  name: "get_balance",
  arguments: { address: "0x742d35Cc6634C0532925a3b844Bc9e7595f2bD68" },
});

// Mint an NFT
const nft = await client.callTool({
  name: "mint_nft",
  arguments: {
    collection_id: "0xabc...",
    to: "0x742d...",
    token_id: 1,
    uri: "ipfs://Qm...",
  },
});
```

### Python

```python
from mcp import ClientSession
from mcp.client.streamable_http import streamablehttp_client

async with streamablehttp_client("https://mcp.tenzro.xyz/mcp") as (read, write):
    async with ClientSession(read, write) as session:
        await session.initialize()

        # List tools
        tools = await session.list_tools()
        print(f"{len(tools.tools)} tools available")

        # Check compliance before transfer
        compliance = await session.call_tool(
            "check_compliance",
            arguments={
                "token_id": "0xtoken...",
                "from": "0xsender...",
                "to": "0xrecipient...",
                "amount": "1000000",
            },
        )
```

### curl

```bash
# Initialize
curl -s -X POST https://mcp.tenzro.xyz/mcp \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-11-25","capabilities":{},"clientInfo":{"name":"curl","version":"1.0"}}}'

# List tools
curl -s -X POST https://mcp.tenzro.xyz/mcp \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/list","params":{}}'

# Call a tool
curl -s -X POST https://mcp.tenzro.xyz/mcp \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  -d '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"get_node_status","arguments":{}}}'
```

## Running the Server

### stdio (Claude Desktop, Cursor)

```bash
tenzro-mcp-server
```

### Streamable HTTP

```bash
tenzro-mcp-server --transport http --port 3001
```

### Test the server

```bash
curl -s -X POST http://localhost:3001/mcp \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-11-25","capabilities":{},"clientInfo":{"name":"test","version":"1.0"}}}'
```

## Configuration

| Variable                | Default                  | Description                                                           |
| ----------------------- | ------------------------ | --------------------------------------------------------------------- |
| `TENZRO_RPC_URL`        | `https://rpc.tenzro.xyz` | Tenzro JSON-RPC endpoint                                              |
| `TENZRO_API_URL`        | `https://api.tenzro.xyz` | Tenzro Web API endpoint                                               |
| `TENZRO_BEARER_JWT`     | unset                    | OAuth 2.1 access token forwarded as `Authorization: Bearer`           |
| `TENZRO_DPOP_PROOF`     | unset                    | DPoP proof forwarded as the `DPoP` header, binding the token to a key |
| `TENZRO_API_KEY`        | unset                    | Operator-issued `tnz_...` key forwarded as `X-Tenzro-Api-Key`         |
| `TENZRO_CANTON_NETWORK` | unset                    | Canton network selector forwarded as `X-Canton-Network`               |

Command-line options:

| Flag          | Default | Description                                    |
| ------------- | ------- | ---------------------------------------------- |
| `--transport` | `stdio` | Transport type (`stdio` or `http`)             |
| `--port`      | `3001`  | HTTP server port (when using `http` transport) |

## Protocol Details

- **MCP Version:** 2025-11-25
- **Transport:** Streamable HTTP (stateless JSON mode)
- **Content Types:** `application/json`, `text/event-stream`
- **Framework:** [fastmcp](https://pypi.org/project/fastmcp/)

## Related

| Resource          | URL                                                                          |
| ----------------- | ---------------------------------------------------------------------------- |
| Tenzro Network    | [tenzro.com](https://tenzro.com)                                             |
| A2A Server        | [github.com/tenzro/tenzro-network](https://github.com/tenzro/tenzro-network) |
| MCP Specification | [modelcontextprotocol.io](https://modelcontextprotocol.io)                   |

## Contact

- Website: [tenzro.com](https://tenzro.com)
- Engineering: [eng@tenzro.com](mailto:eng@tenzro.com)
- GitHub: [github.com/tenzro](https://github.com/tenzro)

## Owner-proof on resource mutations

Several tools that previously took only an identifier now also require a signed
DID envelope proving control of the resource. An identifier is not a credential:
a `jti` travels in every audit row, a `webhook_id` comes back from every list
call, and a `session_id` is a handle the node hands back.

| Tool                                   | Proof required                                                                    |
| -------------------------------------- | --------------------------------------------------------------------------------- |
| `revoke_did`                           | operator admin token **and** an envelope from the DID (or a machine's controller) |
| `register_webhook`                     | `owner_did` plus an envelope over the URL                                         |
| `authorize_session` / `revoke_session` | envelope from the DID that owns the wallet                                        |

Each envelope is bound to the method name and to that call's parameters, so one
produced for a given action cannot be replayed as another.

## License

Apache 2.0. See [LICENSE](LICENSE).
