botwallet-co/mcp

**Let your AI agent send invoices to earn, pay for APIs and manage money, while you stay in control.**
Give your AI agent financial autonomy without giving up control. Your agent can create invoices to get paid, spend on other agents and paid APIs, and manage its own USDC wallet. You set the spending limits, approve large transactions, and see everything it does. Works with Claude Desktop, Claude Code, Cursor, Windsurf, Cline, and any MCP-compatible client.
Website · Dashboard · Docs · CLI · npm
---
Add one JSON block to your MCP client config. That's it.
Then tell your agent: *"Create a Botwallet for yourself."*
It runs botwallet_register, generates a cryptographic key share locally, and comes back with a deposit address. No setup, no API keys to configure beforehand.
From there:
> "Send $5 to @acme-bot for the data report"
If the amount is within guard rails, the agent signs and submits. If not, it asks the human owner for approval.
> "Create an invoice for $25 for the consulting session"
The agent creates a paylink. When someone pays it, the USDC goes straight to the wallet.
> "Find a speech-to-text API and use it"
The agent searches the x402 catalog, finds a paid API, pays for access, and returns the result.
How signing works
Every wallet uses FROST 2-of-2 threshold signatures. During wallet creation, a key generation ceremony produces two shares:
- **Key 1** — the agent's share, stored locally at ~/.botwallet/seeds/
- **Key 2** — the server's share, held by Botwallet
The full private key never exists. Every transaction requires both parties to co-sign. Neither the agent nor Botwallet can move funds alone. Human owners set spending limits and approve anything outside the rules.
Botwallet prepares each transaction; before Key 1 co-signs it, this server decodes it and refuses to sign unless it moves only USDC out of the wallet: the agreed amount into the recipient's associated (standard) USDC account, plus at most the quoted fee (up to a cent more for paid APIs, whose fee is quoted in whole cents), and nothing else. The recipient is checked against the address the agent gave for withdrawals, paid APIs and payments to a Solana address. For payments to a username the address comes from Botwallet's lookup, so only the amount and fee are checked against the agent's request. The Agent CLI and the signing page apply the same rules.
The agent's own amount, recipient and fee are kept in memory, so they are used only while the MCP server process that started the transfer is still running. After a restart, which is common when an owner approves hours later, Key 1 checks the transaction against the amount, recipient and fee Botwallet recorded, and never signs a fee above a fixed ceiling.
If a payment call times out or loses its connection, the result says whether money may have moved. OUTCOME_UNKNOWN means check the tool named in its check_tool (usually botwallet_list_payments or botwallet_get_withdrawal, or botwallet_balance when Botwallet lists the transfer as failed but it may still have gone through) before paying again; to retry the same payment, pass back its idempotency_key.
Pending, frozen and repeated payments
**Sent, not confirmed yet.** Botwallet waits for Solana to confirm a payment or withdrawal. If the network has not confirmed it in time, the tool returns a normal result, not an error, with status: "pending", sent: true, the Solana signature, an explorer link and check_tool. It may still go through, so the agent must not pay again: in about a minute, the tool in check_tool shows completed or failed.
**Frozen wallet.** The owner can freeze the wallet in the Botwallet dashboard. A frozen wallet can still receive money but can't send any: new payments, withdrawals and paid API calls are blocked, and a confirm stops with WALLET_SUSPENDED before anything is signed or sent. A transfer approved before the freeze is kept: once the owner unfreezes the wallet, the agent finishes it with the same confirm tool and transaction_id (for a paid API, botwallet_x402_pay_and_fetch with the same fetch_id).