An MCP server with rules: AI agents under limits

Agents and money

An agent that rebalances a portfolio, pays for a service, or tops up a position needs to read balances and send transactions. Giving it a private key is giving it everything. Giving it an exchange API key is not much better. What an agent should get is a narrow, revocable capability with limits, and a log of what it did.

AirNox Wallet provides exactly that through the Model Context Protocol, the open standard that agent frameworks use to talk to tools. Any client that speaks MCP can connect to the wallet. The wallet is the only authority: the agent proposes, the policy disposes.

Default deny

Out of the box, an agent can do nothing. There are no wallets exposed, no operations allowed and no limits set, which means every request is refused. You open things up deliberately, one decision at a time, in the wallet's own interface. Nothing an agent sends can change the policy, because the policy is not reachable through the MCP interface at all.

The policy

Exposed. You choose which wallets and which addresses agents may see at all. An address not tagged for agents does not exist as far as the agent is concerned. Tagged addresses are marked in the wallet window so you always know which ones are visible.

Allowed. For each exposed wallet and address, you choose which operations are permitted: reading balances and history, requesting quotes, sending a transaction, swapping. Read access does not imply write access.

Limits. Spending is capped in fiat terms, per hour, per day and in total. Limits can be set globally, per wallet and per address, and the tightest one applies. When a limit is reached, the request is refused with a reason the agent can understand, and the agent can wait or ask you.

Audit log. Every call is recorded: what the agent asked, what the policy decided, and what the wallet did. The log can be filtered by wallet or address, so you can review one agent's activity on one account without reading everything.

In AirGap mode

For a wallet whose keys live on the phone, the policy on the desktop is only half of the story. Every transaction an agent proposes still has to be signed on the phone. You can confirm each one by hand, reading it as the phone decoded it, or set rules on the phone itself for what it may sign without asking. And there is a boundary the desktop cannot cross: only the phone can expose an air-gapped address to agents. The desktop cannot grant that on the phone's behalf.

This keeps the chain of authority intact. The agent asks the desktop. The desktop applies its policy. The phone applies its own, and holds the key.

How it connects

The MCP server runs inside the wallet. An agent connects to it locally, through a small launcher for clients that use standard input and output, or through a local endpoint protected by a token the wallet issues. There is no cloud relay and no account with us. The agent runs on your machine, talks to your wallet, and stays inside the lines you drew.

Anything the policy does not allow is refused. Everything that is allowed leaves a line in the log. That is what a wallet for agents should look like.