MCP server

Tenzro exposes the network to AI agents as a Model Context Protocol server. Any MCP client, whether a desktop assistant, an IDE agent or your own framework, can connect and use the network's tools: wallet and identity, inference in every modality, agent memory, payments, storage and files, skills and tools, tasks and templates, verification and events.

Endpoint

Every node can serve MCP; the default local address is http://localhost:3001/mcp.

Connect a client

Most clients accept a URL. For a desktop or IDE client, add:

{
  "mcpServers": {
    "tenzro": {
      "url": "https://mcp.tenzro.com/mcp"
    }
  }
}

List the tools from the command line:

curl -s -X POST https://mcp.tenzro.com/mcp \
  -H 'content-type: application/json' \
  -H 'accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

Call a read tool:

curl -s -X POST https://mcp.tenzro.com/mcp \
  -H 'content-type: application/json' \
  -H 'accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/call",
       "params":{"name":"get_node_status","arguments":{}}}'

Authentication

Tools are tiered.

• Read tools need no credentials: node status, balances, models, DID resolution, registry listings and similar.
• Write tools need an OAuth 2.1 access token: anything that moves money, signs, stakes, registers or changes state.

The server publishes standard OAuth discovery documents, so a compliant client finds everything it needs from the MCP URL:

Tokens are:

• Bound to the MCP resource. A token issued for another service is rejected.
• Bound to your key with DPoP (RFC 9449). Each request sends Authorization: DPoP <token> and a fresh DPoP proof signed by the client's key, so a leaked token cannot be replayed from elsewhere.
• Scoped with rich authorisation details (RFC 9396): which tools, which operations and how much value per call and per day.

Agents sign in with their own device key through tenzro_issueAccessToken; see Agents. A delegated agent's MCP token carries the same delegation scope its controller set, and revoking the controller revokes the agent's tokens.

Every write tool goes through the same access check as its JSON-RPC equivalent, so MCP never reaches more than the RPC does. The acting account comes from the authenticated token, never from a tool argument, and tools never take private keys. Signing happens on the device that holds the key. See RPC access for the open, owner and admin classes.

Revoke a token with tenzro_revokeJwt, or a delegated agent and everything it was authorised to do with tenzro_revokeIdentity.

Reaching the whole RPC surface

Named tools cover the common tasks. Two gateway tools cover the rest:

• list_rpc_methods lists every JSON-RPC method the node serves and its access class, filterable by namespace or substring.
• call_rpc invokes any listed method. It passes the same gates as a direct call, so it reaches only what your credentials allow.

Paid tools

Tools that consume paid resources, such as inference, storage or a priced skill, charge the authenticated account. Some requests can also be paid per call over x402 or MPP.

Run it yourself

Every tenzro-node serves MCP on its own listener (--mcp-addr, loopback 127.0.0.1:3001 by default). Point a local client at your node's /mcp path over Streamable HTTP, or put your own HTTPS reverse proxy in front of it and announce it with --external-mcp-addr. Who may use it is your node's access policy for the mcp surface; see RPC access.

Every tool, with its input schema and the JSON-RPC methods it calls, is listed in the generated MCP tool reference.

Related

• A2A protocol, for agent-to-agent messaging
• Skills and tools, for publishing your own MCP tools to the registry
• Agent memory
• RPC access