What Is MCP? How AI Agents Can Manage Your Crypto Wallet

The Model Context Protocol (MCP) is an open standard that lets AI applications connect to external tools, data sources, and workflows through a standardized client-server interface. Think of it as a universal adapter: instead of every AI assistant building its own custom integration with every external service, MCP gives them all a shared language. For crypto, that matters more than it might first appear.

What MCP Is

MCP uses a client-server architecture. An AI application acts as the host, creates MCP clients, and each client maintains a persistent connection with one MCP server. The MCP server is a local or remote service that exposes capabilities, including resources, tools, and prompts, for the AI application to use through that client.

In plain language: the AI assistant is the client side, and whatever external system you want it to interact with (a database, a calendar, a crypto wallet) runs an MCP server that describes what it can offer and how to call it.

This is not a new concept in software. APIs have connected applications for decades. What MCP adds is standardization: any AI assistant that speaks MCP can connect to any MCP server without custom plumbing on either side. That opens the door to a wide ecosystem of tools the assistant can reach, including financial ones.

The protocol was designed with large-language-model applications in mind. LLMs are good at understanding context and reasoning about instructions, but they have no native way to act on external systems. MCP is the bridge that changes that.

What That Means for a Crypto Wallet

A crypto wallet that runs an MCP server can expose its capabilities to an AI assistant. Depending on what the server is configured to offer, an AI assistant might check a balance, look up a transaction history, prepare a token swap, or draft a transfer to a specific address.

That list covers a wide range of actions. Some are read-only: checking a balance carries no risk on its own. Others are write actions that move funds, and those are a different category entirely.

Here's the distinction that matters: preparing a transaction is not the same as authorizing it. An MCP-connected assistant can construct the calldata for a transfer, including the destination address, the token, the amount, and the network, then hand it to the wallet interface for review.

Coinbase Wallet, for example, requires user approval for every write action when operating through its MCP integration, and the protocol itself does not access private keys. The preparation happens on the AI side. The authorization stays with the user.

That boundary is the architectural safety net. Whether it holds in practice depends on how the MCP server is configured, what permissions are granted, and whether the user actually reads what they're approving before they tap or click.

Who Actually Signs the Transaction

The signing step is where custody lives. In a self-custodial wallet, the private key authorizes transactions. The public key receives funds. Whoever controls the private key controls the wallet, and that control should never transfer to an AI assistant.

A hardware wallet makes this concrete. The general flow is: an internet-connected application sends unsigned transaction data to the device, the device signs internally using its secure element, and the signed transaction is returned for broadcast. The private key never leaves the hardware.

Take the Tangem Cold Wallet as an example of how that plays out physically. The wallet's private key is generated by a true random number generator inside the Samsung S3D350A chip, certified at Common Criteria EAL6+. It does not leave the card. When a transaction needs signing, the Tangem app prepares the unsigned transaction data and the user taps the physical card to their phone over NFC, a channel encrypted with AES-256 at a range of 0-5 cm. The secure element signs internally and returns the signed transaction. The app broadcasts it.

A physical card tap is always required. That architecture changes what MCP integration can and cannot mean for Tangem users. An AI assistant connected to the Tangem app via MCP could potentially read balances, check transaction history, or draft a swap. But it could not broadcast a signed transaction without the user physically tapping the card. The hardware enforces the boundary that the software describes.

That's the key difference between a software wallet and a hardware wallet in an AI-connected context: the hardware introduces a physical confirmation step that no remote instruction can bypass.

The Risk Everyone Should Understand: Prompt Injection

Prompt injection is an attack in which malicious instructions hidden in webpages, documents, emails, tool outputs, or other untrusted data cause an AI agent to disregard its intended instructions.

In a wallet-connected agent, the attack path looks like this: poisoned content enters the agent's context and manipulates its reasoning or tool selection. If the agent has overly broad wallet permissions, that can lead to unintended signing, asset transfers, or credential exposure. Those outcomes are often irreversible on-chain.

The attack surface is wider than it sounds. A user might ask their AI assistant to check a DeFi protocol's documentation, and that documentation could contain hidden text designed to redirect the agent's next wallet action. The screen shows a helpful summary. The agent sees an instruction.

Structural defenses exist: strict separation between instruction data and external content, context isolation, least-privilege tool access, sandboxed execution, transaction-policy checks, and mandatory human approval for any write action. No single defense reliably prevents prompt injection on its own. The OWASP AI Security Verification Standard recommends layering these controls and continuously red-teaming injection defenses.

What that means for you as a user: before approving any wallet action that an AI assistant has prepared, independently review the destination address, the network, the token, the amount, the fees, and any contract interaction data. The assistant may have assembled the transaction correctly. It may also have been manipulated into proposing one that looks correct but isn't.

Coinbase explicitly warns users not to follow AI responses that request signatures, fund transfers, secret disclosure, or system-prompt changes. That warning applies regardless of which wallet or assistant you use. The honest issue here is that prompt injection has no complete technical solution yet. The user-review step is not a fallback. It's the primary defense.

Permissions and Limits

How much an AI assistant can do with your wallet depends entirely on what the MCP server exposes and what permissions you grant when connecting.

Read-only access, including balances, transaction history, and token holdings, carries a different risk profile than write access, which can initiate transfers or contract calls. A well-designed MCP integration separates these scopes and requires explicit user consent before enabling write actions.

The principle of least privilege applies directly here: grant the assistant only the access it needs for the task at hand. If you're using an AI assistant to monitor a portfolio, there's no reason to grant it permission to send funds.

Access revocation matters too. Any MCP integration should give you a clear way to disconnect the assistant and confirm that the connection is closed. If you can't easily answer "what does this assistant currently have access to?", that's a gap worth closing before granting any write permissions.

The specific permission scopes, amount limits, and revocation mechanics vary by wallet implementation. Before connecting any AI assistant to a wallet, check what the wallet's MCP server actually exposes and what each permission level covers.

What This Does Not Do

For Coinbase Wallet's MCP integration, every write action requires user approval, and the protocol does not access private keys.

AI tools may generate inaccurate, misleading, outdated, or incomplete information. The European Securities and Markets Authority has noted that AI suggestions should not be treated as reliably predictive of financial-market performance. The UK's Financial Conduct Authority is direct on this: general-purpose AI tools are not regulated as financial advisers, may not act in the user's best interest, and do not carry the protections associated with authorised investment firms.

That means an AI assistant connected to your wallet can help you prepare a transaction or summarize your holdings. It cannot give you regulated financial advice, and its suggestions about which token to buy or when to sell are not a substitute for independent judgment or advice from an authorised professional. 

If you're using a hardware wallet, the physical signing step is always yours.

Getting Started

The practical starting point is checking whether your wallet supports an MCP server and which AI clients are compatible with it.

Support is client-dependent. IronWallet, for instance, lists Cursor and Claude Code as compatible clients for its MCP integration. Coinbase documents its Wallet MCP for AI-assistant integrations on its developer platform. Each wallet implementation defines its own compatible clients and setup route.

Before connecting:

• Confirm what the MCP server exposes (read-only vs. write access).
• Review the permission scopes before granting them.
• Understand the revocation process so you can disconnect cleanly.
• Start with read-only access if the wallet supports scoped permissions.

If you use a hardware wallet like Tangem, the physical signing requirement remains in place regardless of any MCP integration. No AI assistant can broadcast a signed transaction from a Tangem Cold Wallet without a physical card tap. That constraint is worth keeping in mind when evaluating what "AI wallet integration" actually means for your setup.

One honest limitation worth naming: the Tangem app is mobile-only. There's no desktop or web interface, which affects how MCP client connections would work in practice depending on which AI assistant you use.