# MCP

MCP transport and tool boundaries for public discovery and OAuth-protected account operations.

Last updated: 2026-07-22

Canonical HTML: https://stakao.com/docs/mcp
Raw Markdown: https://stakao.com/docs/mcp.md

## Table of contents

- 01. [Public MCP card](#public-card)
- 02. [Public tools](#public-tools)
- 03. [Account MCP](#account-mcp)
- 04. [JSON-RPC safety](#json-rpc-safety)

## 01. Public MCP card

https://api.stakao.com/agent/mcp is a public read-only streamable HTTP JSON-RPC endpoint.

- Public tools expose catalog, manifest, pricing, x402 instructions, safety metadata, and public content search.
- Public MCP does not expose account data and does not require OAuth.
- The card advertises ANALYZED and informational_only=true.

### Read the public card

```bash
curl -sS https://api.stakao.com/agent/mcp
```

### Initialize

```bash
curl -sS -X POST https://api.stakao.com/agent/mcp \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{}}'
```

## 02. Public tools

Use tools/list after initialize to discover the exact public tool schemas.

- get_stakao_catalog
- get_agent_manifest
- get_paid_allocation_instructions
- get_reference_allocation_status
- explain_strategy
- quote_allocation_product
- quote_model_portfolio_snapshot
- search_public_content

## 03. Account MCP

https://api.stakao.com/agent/mcp/account is a separate OAuth-protected MCP transport for authorized account data.

The Worker requires a bearer token before initialize, tools/list, or tools/call, then validates the token and active Stakao consent through the backend account profile route.

- get_account_profile — requires openid.
- list_wallets — requires openid profile and returns only owned wallets.
- list_strategies — requires openid profile and returns only owned strategies.
- request_activation — requires openid profile email and creates PENDING only.

## 04. JSON-RPC safety

Both transports validate JSON-RPC 2.0 envelopes and bound batch sizes.

- Malformed envelopes return an HTTP error before tool dispatch.
- Account MCP batches cannot contain multiple request_activation mutations.
- No MCP tool signs, creates a proxy, submits a transaction, or executes on-chain staking.
- Bearer tokens, OAuth bodies, and account data are not written to Worker logs.

## Agent entrypoints

- [Agent manifest](https://api.stakao.com/agent): Worker-generated discovery manifest and safety metadata.
- [Agent OpenAPI](https://api.stakao.com/agent/openapi.json): Canonical REST contract generated by the Worker.
- [Agent llms.txt](https://api.stakao.com/agent/llms.txt): Worker-generated operational instructions.
- [Agent errors](https://api.stakao.com/agent/errors.json): Machine-readable error codes and remediation.
- [Public MCP](https://api.stakao.com/agent/mcp): Unauthenticated read-only MCP transport.

## Related Stakao references

- [AI Agents](https://stakao.com/docs/ai-agents): Start here for the complete agent flow.
- [Docs hub](https://stakao.com/docs): Canonical technical documentation index.
- [Full Markdown corpus](https://stakao.com/llms-full.txt): Complete docs and safety corpus.
- [Strategies Markdown](https://stakao.com/strategies.md): Generated strategy catalog.

## Related blog articles

- [Agent-native staking API](https://stakao.com/blog/agent-native-staking-api): Editorial context for the public agent API.
- [x402 payments for AI agents](https://stakao.com/blog/x402-payments-for-ai-agents): Editorial context for x402 payment retries.
- [MCP server for crypto staking agents](https://stakao.com/blog/mcp-server-for-crypto-staking-agents): Editorial context for the public MCP surface.