01
Public MCP card
https://api.stakao.com/agent/mcp is a public read-only streamable HTTP JSON-RPC endpoint.
- Public tools expose catalog, manifest, pricing, x402 instructions, safety metadata, and public content search.
- Public MCP does not expose account data and does not require OAuth.
- The card advertises ANALYZED and informational_only=true.
Read the public card
bash
curl -sS https://api.stakao.com/agent/mcpInitialize
bash
curl -sS -X POST https://api.stakao.com/agent/mcp \
-H 'Content-Type: application/json' \
-d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{}}'02
Public tools
Use tools/list after initialize to discover the exact public tool schemas.
- get_stakao_catalog — returns the agent-available strategy products.
- get_agent_manifest — returns payment, endpoint, and safety metadata.
- get_paid_allocation_instructions — explains the x402 request flow.
- get_reference_allocation_status — reports the freshness of the latest reference analysis.
- explain_strategy — explains a catalog product.
- quote_allocation_product — returns price and endpoint metadata.
- quote_model_portfolio_snapshot — returns direct x402 price and endpoint metadata.
- search_public_content — searches public Stakao content.
03
Account MCP
https://api.stakao.com/agent/mcp/account is a separate OAuth-protected MCP transport for authorized account data.
The account MCP requires a bearer token before initialize, tools/list, or tools/call, and checks that the token has an active Stakao consent.
- get_account_profile — requires openid.
- list_wallets — requires openid profile and returns only owned wallets.
- list_strategies — requires openid profile and returns only owned strategies.
- request_activation — requires openid profile email and creates PENDING only.
04
JSON-RPC safety
Both transports validate JSON-RPC 2.0 envelopes and bound batch sizes.
- Malformed envelopes return an HTTP error before tool dispatch.
- Account MCP batches cannot contain multiple request_activation mutations.
- No MCP tool signs, creates a proxy, submits a transaction, or executes on-chain staking.
- Bearer tokens, OAuth bodies, and account data are not written to logs.
Agent entrypoints