SwapWallet

SwapWallet MCP Server

The official remote MCP server for SwapWallet.

Let your AI assistant read your crypto balances, P&L and history, and request swaps, transfers and withdrawals that run only after you approve them in Telegram.

https://swapwallet.app/mcp

Hosted by SwapWallet: there is nothing to install or run. Add the URL to any MCP client that supports remote servers, sign in once with OAuth, and pick what the assistant may do.

Contents

• What you can ask
• Nothing moves without your approval
• Tools
• Connect
• Authentication and scopes
• For agent developers
• About this repository

What you can ask

• "What's my total SwapWallet balance, and how much of it is USDT?"
• "Show my profit and loss on BTC and TON."
• "List my last 10 transactions from this week."
• "Give me my USDT deposit address on TRON."
• "Swap 50 USDT to TON." (creates a request you approve in Telegram)
• "Withdraw 2,000,000 toman to my verified bank account." (creates a request you approve in Telegram)

Nothing moves without your approval

Read tools answer directly. Tools that would move money never do it themselves:

1. The assistant calls request_swap, request_transfer, request_crypto_withdraw or request_fiat_withdraw.
2. SwapWallet prices the action and sends you a preview in Telegram (the SwapWallet bot) with Approve and Cancel buttons.
3. Only when you tap Approve is the action re-priced and executed. Unanswered requests expire after 15 minutes.
4. The assistant checks the outcome with get_action_request.

There is no scope that lets an agent move funds without you: withdraw:execute exists and can never be granted. With two-factor authentication on, crypto withdrawals and transfers can't be requested over MCP at all; make those in the app.

Tools

Every tool ships MCP annotations (readOnlyHint, destructiveHint, idempotentHint, openWorldHint). No tool is destructive: a request_* tool only adds a request that you approve or cancel. The full definitions, with input schemas, are in the server card at /.well-known/mcp/server-card.json.

Connect

Claude (claude.ai, desktop)

Settings → Connectors → Add custom connector → URL https://swapwallet.app/mcp.

Claude Code

claude mcp add --transport http swapwallet https://swapwallet.app/mcp

Or install it as a plugin from this repository:

/plugin marketplace add SwapWallet/swapwallet-mcp
/plugin install swapwallet@swapwallet

Cursor

Use the Add to Cursor button above, or add to ~/.cursor/mcp.json:

{
  "mcpServers": {
    "swapwallet": { "url": "https://swapwallet.app/mcp" }
  }
}

VS Code (GitHub Copilot)

Use the Install in VS Code button above, or run:

code --add-mcp '{"name":"swapwallet","type":"http","url":"https://swapwallet.app/mcp"}'

Windsurf

Add to ~/.codeium/windsurf/mcp_config.json:

{
  "mcpServers": {
    "swapwallet": { "serverUrl": "https://swapwallet.app/mcp" }
  }
}

Gemini CLI

gemini mcp add --transport http swapwallet https://swapwallet.app/mcp

Or as an extension, which also loads the agent rules in GEMINI.md:

gemini extensions install https://github.com/SwapWallet/swapwallet-mcp

Codex CLI

codex mcp add swapwallet --url https://swapwallet.app/mcp

Any other client

Add https://swapwallet.app/mcp as a remote Streamable HTTP server. The client discovers OAuth on its own from the 401 response.

Authentication and scopes

OAuth 2.1 with dynamic client registration (RFC 7591) and PKCE (S256); public clients, no secret, no API keys. You sign in on SwapWallet's consent page with your phone number and an SMS code, review the scopes, untick any you don't want, and approve. Revoke access any time from the app.

tools/list returns only the tools your granted scopes allow, and scopes are checked again on every call. Access tokens last 1 hour; refresh tokens last until you revoke the grant.

Requirements: a SwapWallet account (sign up at swapwallet.app with a phone number; trading and withdrawals need identity verification), and a linked Telegram account for the request_* tools.

For agent developers

• Endpoint https://swapwallet.app/mcp: Streamable HTTP, JSON responses only, stateless (no session, no SSE, no batches). Protocol versions 2025-06-18, 2025-03-26 and 2024-11-05.
• Discovery: /.well-known/oauth-protected-resource, /.well-known/oauth-authorization-server, and the server card.
• Amounts are decimal strings; token and network are enums listed in each tool's input schema.
• Never report a swap, transfer or withdrawal as done until get_action_request says EXECUTED. PENDING means "waiting for the user in Telegram". The full rules are in skills/swapwallet/SKILL.md.

Full reference: swapwallet.app/docs/mcp · REST API: docs.swapwallet.app

About this repository

The server runs inside SwapWallet's backend; this repository holds its public description and client configs, so you can install it from tools that work with repositories:

Found an issue with the docs or a client config? Open an issue or a pull request.

About SwapWallet

SwapWallet (سواپ‌ولت) is an Iranian crypto exchange with a wallet-style app: buy, sell, swap, hold and send crypto, and deposit and withdraw toman. It is custodial, and is operated by Zanjireh Tabdil Soba. Web app, Android apps and a Telegram mini app.

• Support: support@swapwallet.app · live chat
• Privacy policy · Terms of service · Fees

Security

Please report vulnerabilities in the MCP server or the OAuth flow privately, as described in the security policy (security.txt), not in a public issue.

License

The contents of this repository are released under the MIT license.