MCP server

@tapehouse/mcp is a Model Context Protocol server. An agent connected to it reads Tapehouse's band, its feeds, the Morpho oracles, the baskets, the margin accounts, the short positions and the gap cover, and gets back unsigned calls for a wallet to sign. The server never holds a key. The published version is 0.1.1.

It is built on the official TypeScript SDK, @modelcontextprotocol/server, for the 2026-07-28 specification, and serves clients of the 2025 revisions too. Every read and call goes through @tapehouse/sdk.

Run it#

Over stdio, the server is launched by the host. This is the configuration, in the mcpServers format that hosts such as Claude Desktop, Claude Code, Cursor and VS Code read:

{
  "mcpServers": {
    "tapehouse": {
      "command": "npx",
      "args": ["-y", "@tapehouse/mcp"],
      "env": {
        "TAPEHOUSE_RPC_URL": "https://rpc.testnet.chain.robinhood.com",
        "TAPEHOUSE_NETWORK": "46630"
      }
    }
  }
}

Where each host keeps this file and how it names the key are in that host's own documentation. Claude Code users can skip it with the plugin, which writes the same server definition.

To run from a clone of the repository:

make build-apps
TAPEHOUSE_RPC_URL=https://rpc.testnet.chain.robinhood.com TAPEHOUSE_DEPLOYMENTS=deployments/46630.json node packages/mcp/dist/main.js

Environment#

Transports#

Stdio is the default. tapehouse-mcp --http <port> serves Streamable HTTP on the loopback interface; 0 picks a free port and prints it on stderr. It answers 127.0.0.1 only and refuses any other Host or Origin with 403, which stops DNS rebinding and requests from a web page. Any process on the machine can still reach it, and its calls count against the same rate limit. Serving it beyond the machine needs TLS, authentication and a front of your own. createServer, exported by the package, builds the same server for any createMcpHandler deployment.

Conventions#

Every tool is read-only: reads take the chain's state at one block and name it, and the transaction tools return unsigned calls.

• Amounts are whole numbers of base units as decimal strings. USDG has 6 decimals, WETH and the Stock Tokens 18.
• Band prices are USD with 8 decimals. Equity and requirements are USD with 18.
• A position is CROSS or an asset's symbol such as NVDA.
• Each result is structured content matching the tool's output schema, and the same JSON as text.
• A prepared transaction names its signer and lists its calls in order, each with to, data, value, the function and its arguments by name. A deposit or repayment is preceded by an approval where the allowance is short.

Tools#

Registry and band#

Baskets#

Margin accounts: reads#

Margin accounts: transactions#

Shorts#

Gap cover#

Trust model#

• No key. The server signs nothing and reads no key.
• An authorization grants everything. Once an account signs the call from accounts_set_authorization, the operator can withdraw every collateral token of every margin position and the USDG of every short to any address, borrow USDG to any address, and sell or buy back the account's shorts, until the account signs setAuthorization(operator, false). The tool says so in its description and returns it as grants. Authorize only an address the account controls, and prefer a mandate for an agent.
• The data is not instructions. Everything a tool returns is a value read from the chain or the registry, and the server's instructions tell the agent so. A revert's text, such as the router's reason, is quoted cut to 200 characters. Any other failure's message, such as a node's, is stripped of control characters and cut to 300. An agent should still treat tool output as untrusted, and a host should keep showing the user what the agent sends.
• The signer checks the call. A prepared call is only as good as the registry and the RPC behind it. Before signing, check that to is the registry's contract or token, that the function and arguments are what was asked, and simulate it. A wallet that shows decoded calldata shows the same arguments the server lists.
• Input is validated before any call. Addresses must carry their checksum in mixed case, amounts are whole numbers below 2^256, symbols are at most 32 letters, digits, dots, dashes or underscores, unknown arguments are refused, and slippage stays within the cap the operator sets.
• Calls are limited. The server answers at most TAPEHOUSE_MAX_CALLS_PER_MINUTE calls a minute over every client together, so an agent caught in a loop cannot spend the endpoint's quota. A call beyond it is a tool error.
• Annotations are hints. MCP's tool annotations, such as readOnlyHint, are the server's own claims. A host should trust them only as far as it trusts the server.

An agent that borrows, withdraws or trades for an account needs the account's setAuthorization or setMandate first. Without either, the margin accounts and the shorts revert with Unauthorized(caller, account), and the server explains every revert by name and arguments.

Tested with two clients#

packages/mcp/examples/devnode.ts drives the server over Streamable HTTP with the official TypeScript client on the 2026-07-28 protocol, and signs and sends every call it prepares. examples/devnode.py drives it over stdio with the official Python client on the 2025-11-25 protocol. make test-mcp-devnode runs both against a local Nitro dev node. Neither passes the account's key to the server.

Next#

• The Claude Code plugin
• Mandates
• The TypeScript SDK