Agents and MCP

Two ways to connect

• Locally, with the agent's own seed. The server runs next to the agent, over stdio. It holds the agent's keys, proves every payment in its own process, and refuses anything over its limits. This is how an agent pays, trades and proves.
• Hosted, read-only. https://hushd.net/mcp speaks Streamable HTTP and runs only the read tools. It holds no keys and cannot move anything.

Run it locally

From a checkout of the repo:

pnpm install
pnpm mcp init   # writes a new agent seed to ~/.hushd/seed (mode 600)

# Claude Code: the agent's own wallet, inside its limits
claude mcp add hushd \
  -e HUSHD_LIMIT_PER_PAYMENT="USDC=100,wNEAR=50" \
  -e HUSHD_LIMIT_PER_DAY="USDC=500,wNEAR=250" \
  -- pnpm --silent --dir "$PWD" mcp

Any other MCP client takes the same command:

{
  "mcpServers": {
    "hushd": {
      "command": "pnpm",
      "args": ["--silent", "--dir", "/path/to/hushd", "mcp"],
      "env": {
        "HUSHD_LIMIT_PER_PAYMENT": "USDC=100,wNEAR=50",
        "HUSHD_LIMIT_PER_DAY": "USDC=500,wNEAR=250"
      }
    }
  }
}

The server is the @hushd/mcp package in the repo (packages/mcp), which is not published on npm, so it runs from a checkout of the repo. With no seed it starts anyway and serves the read tools only. To fund the agent, give it a policy wallet (or a NEAR account with its own key) and use hushd_faucet then hushd_shield, or pay its hushd1 address from your own private balance.

The hosted, read-only server

claude mcp add --transport http hushd-read https://hushd.net/mcp

In a client that takes a URL, add https://hushd.net/mcp as a Streamable HTTP server. It is stateless and answers the five read tools below, against NEAR testnet.

Tools

hushd_trade takes the package kind, what to sell and how much, what to buy, a min_receive above zero (the least it accepts, sealed to the enclave) and a quote window of 10 to 300 seconds. It returns the deal, the maker and what was given and received. hushd_prove takes a reader and a validity of 1 to 90 days, and returns the proof with a link to check it.

To pay a counterparty who is not on Hushd yet, hushd_pay_link takes a token and an amount and returns a claim link (https://hushd.net/app/claim#…). Hand it over privately: whoever opens it claims the payment into their own private balance with a passkey or a NEAR wallet, and needs no gas. If nobody claims it, hushd_take_back_link returns the amount. An agent paid with a link claims it with hushd_claim_link.

Spending limits

Every token the agent may spend needs two caps, in the token's own units: one per payment and one per UTC day. A token with no limit set cannot be spent at all.

HUSHD_LIMIT_PER_PAYMENT="USDC=100,wNEAR=50,BTC=0.002"   # the default
HUSHD_LIMIT_PER_DAY="USDC=500,wNEAR=250,BTC=0.01"       # the default

• hushd_send, hushd_pay_link, hushd_cash_out and hushd_trade (for the amount sold) check both caps before anything is proved, and record what was spent once it is.
• Anyone holding a link can claim it, so an agent with a payee list (HUSHD_ALLOW_TO) may not pay as a link at all.
• hushd_pay_x402 pays a 402 only up to the smaller of the per-payment cap and what is left of today's; a higher price is refused, not paid. Like a send, it stops at the end date, and with a payee list it pays only a 402 whose hushd1… address is on it.
• hushd_trade needs min_receive, the least the agent accepts, above zero. Anyone can register as a maker, so the floor is what keeps a fill fair.
• What was spent today is kept in a file under HUSHD_HOME, so restarting the server does not reset the day.
• hushd_limits lets the agent read its own limits, so it can plan inside them.

These limits are the only guard on the private balance, and they run in the MCP process beside the agent. The relayer sends whatever was proved and knows nothing of them. The seed sits on the same machine, so anything that can read it, an agent with shell or file access included, can spend the whole balance without asking the server. Keep in the balance only what you would let the agent lose.

Policy wallets

An agent does not need a NEAR key. Its NEAR account can be an OutLayer policy wallet: the key is made and kept inside OutLayer's TEE, the agent holds only an API key, and the enclave checks the owner's policy before it signs anything. The owner stores the policy on chain from their own account (on outlayer.testnet), which makes them its only controller, and can freeze the wallet with one transaction. The desk's three makers and the demo agent work this way.

# the owner: a wallet, its policy stored from the owner's account, funded for gas
pnpm --filter @hushd/services policy-wallet create MY_AGENT --per-tx 0.02 --daily 0.2 --per-hour 60
# the agent: only the wallet's key
claude mcp add hushd -e HUSHD_POLICY_WALLET_KEY=wk_… -e HUSHD_LIMIT_PER_DAY="USDC=500" -- pnpm --silent --dir "$PWD" mcp
# the owner, at any time
pnpm --filter @hushd/services policy-wallet freeze MY_AGENT

The Agents page in the app does the same from a NEAR wallet or a passkey.

Environment

What stays on the agent's machine

• The seed, which spends the agent's private balance. Keep it secret.
• Its notes, in a file encrypted with AES-256-GCM under a key from the seed, so the file alone reveals nothing.
• Every proof, made in the server's own process. The model sees results, never keys or notes.

Every note the agent makes for itself is also posted to the board, encrypted to it, so the seed alone recovers its balance on another machine.

For coding agents

The repo carries an AGENTS.md and an agent skill at skills/hushd/SKILL.md, and the site has llms.txt. Agents that pay for HTTP resources should also read private x402.