Model Context Protocol turned "connect my AI to a service" into a one-line operation, and crypto is the domain where that convenience is most useful and most dangerous. A connected agent can read a wallet, price a swap across more than fifty chains, pull smart-money flows, and submit an order. The same connection, badly scoped, lets a language model name a destination address.
This is a practical guide to what a crypto MCP server actually exposes, written against a live one. The Antalpha MCP endpoint answers the standard tools/list call, so every count and category below can be reproduced by anyone with an MCP client and no account.
What MCP is
Model Context Protocol is an open standard that lets an AI agent discover and call a service's tools through a single endpoint, without that service needing a custom integration for each agent.
The practical effect is that a server publishes a list of tools with names, descriptions, and input schemas, and any compatible client reads that list and makes the tools available to its model. For a crypto service this replaces what used to be a per-client SDK and an API key dance with one URL.
What the Antalpha server exposes
The endpoint is https://mcp-skills.ai.antalpha.com/mcp. Listing it on 21 October 2026 returns 120 tools. Grouped by what they touch, they fall into fifteen areas, and the write column is the one that matters.
| Group | Tools | Can write | What it covers |
|---|---|---|---|
| Swaps and routing | 18 | 3 | Quotes, routing, signing pages, cross-chain and Jupiter paths |
| Market data and macro | 18 | 0 | Prices, sentiment, derivatives, funding, flows, technicals |
| Tokenized US stocks | 17 | 0 | Snapshots, financials, technicals, sector, DCF, pool data |
| Polymarket | 13 | 4 | Markets, portfolio, buy, sell, copy-trading |
| CEX trading | 11 | 6 | Spot and futures orders on OKX and Binance |
| Hyperliquid perps | 9 | 0 | Market data, accounts, positions, order and whale queries |
| Transfer and settlement | 7 | 2 | Transfers, gas, pending pool, contract verification |
| Wallet security | 6 | 1 | Address, approval, NFT and phishing checks, revoke page |
| Wallet analytics | 5 | 0 | Balances, activity, transaction history, PnL, counterparties |
| Airdrops | 5 | 0 | Scans, daily reports, project and scam checks |
| DeFi yield | 4 | 0 | Discover, analyze, compare, position checkup |
| Meme and web search | 3 | 0 | Token analysis and web retrieval |
| Smart money | 2 | 0 | Token scans and whale flow |
| Social intel | 1 | 0 | Crypto social signals |
| Session | 1 | 1 | Agent registration |
The totals are 120 tools and 17 that can write. Grouping is ours, by tool-name prefix; the tool list and the capability tags are the server's.
Behind those tools sit more than twenty data providers, including Dune, Nansen, Arkham and DeBank, routed across more than fifty chains. The routing matters more than the provider count: the point of a server like this is that an agent asks for a wallet balance rather than deciding which RPC to call.
Connecting it
One command, if your client speaks mcporter:
mcporter add https://mcp-skills.ai.antalpha.com/mcp --name antalpha-skills
Clients that take a plain URL, including Claude Code, Claude Desktop, Cursor, Windsurf, Codex, Gemini CLI, OpenCode and OpenClaw, accept the same endpoint in their MCP settings panel. OpenClaw needs the direct HTTP URL rather than an npx mcp-remote wrapper.
To see what you are connecting to before you connect, list it:
npx mcporter list https://mcp-skills.ai.antalpha.com/mcp
That returns every tool with its description and capability tag. Doing this first, on any MCP server, is the single highest-value habit in this whole workflow. You are about to give a language model a set of verbs. Read the verbs.
Two things that surprise people
The first is that tools are not independent. Many descriptions carry an explicit position in a sequence, like "Step 3a of 4 of the Polymarket Trade Workflow, after poly-markets confirms details." The server is not just a bag of functions; it encodes an order of operations, which is how a model that has never traded a prediction market still gets the steps right.
The second is a registration gate. antalpha-register must be called once per session before any poly-* tool, and it returns an agent_id without which every Polymarket call fails. Agent registration with Antalpha also carries agent-specific credentials and rate limits.
That gate is worth noticing for a reason beyond setup friction. A server that knows which agent is calling can rate-limit it, revoke it, and attribute what it did. A server that accepts anonymous calls cannot do any of those things.
What the agent cannot do
Of the 120 tools, 17 can write. The other 103 are read-only, which means the default posture of a connected agent is research rather than execution.
The write tools behave differently by venue, and the difference is the most important thing in this guide.
On-chain actions do not execute from the tool call. poly-buy, swap-full and transfer-request return a signing URL. The user opens it, connects their wallet, and signs. Private keys never reach the server or the model. transfer-request, which sends tokens to another address, is a two-step tool whose description says it requires explicit user approval at both steps, and it is one of only two tools in the set graded Very High for reasoning.
One tool goes further. wallet-revoke-page builds a page for revoking ERC-20 approvals, and it refuses to accept addresses from the model at all:
Addresses are ALWAYS taken from the live on-chain scan, never from model input. The optional
approvalslist is only a display-label / filter hint: entries that do not exactly match an on-chain approval are ignored.
A hallucinated address and an injected address fail identically, before the page exists. This is what a guardrail looks like when it does not rely on the model behaving.
Centralized-exchange orders work differently. cex-spot-place-order and cex-futures-place-order submit through exchange API credentials the user has already delegated, so there is no per-transaction signature in that path. The restraint in the tool definition is a line addressed to the model: confirm side, size and leverage with the user first. That is a weaker guarantee than a signature, and anyone wiring these tools into an autonomous loop should treat it as such.
Where the write capability actually sits
Six of the fifteen groups contain a tool that can write, and the concentration is uneven enough to be useful.
CEX trading holds six of the seventeen, the largest share, and it is also the group with the weakest restraint, for the reason given above. Polymarket holds four, which commit capital on an outcome, and poly-master-follow sets a copy ratio that keeps acting after you stop paying attention. Swaps and routing holds three, which produce signing pages. Transfer and settlement holds two, including the highest-consequence tool in the set. Wallet security holds one, the revoke page. Session holds one, the registration call.
Two groups people expect to be dangerous are not. Hyperliquid perps is nine tools and every one of them reads: market data, accounts, positions, order and whale queries. Tokenized US stocks is seventeen tools and none of them write. If you assumed a perps integration meant an agent could open a leveraged position on this server, it cannot.
If you are building an agent that researches and reports, deny the seventeen write tools by name. You keep 103 tools and lose nothing a research agent needed.
Which tool answers which ask
The mapping below is drawn from the tool descriptions and their stated keywords, not from sample output.
| What you ask for | Tool that fires |
|---|---|
| Current BTC and ETH prices | data-price |
| Token balances for an address | wallet-balance-query |
| Whether a contract is dangerous | wallet-guard-token-deep-scan |
| Risky approvals on your wallet, and a page to revoke them | wallet-guard-approval-security, then wallet-revoke-page |
| A swap quote and a page to sign it | swap-full |
| Open prediction markets and their details | poly-markets |
| Smart-money movement on a token | smart-money-token-scan |
| Funding rates across perps | data-funding-scan |
| A tokenized US stock's financials and DCF | us-stock-financials, us-stock-dcf |
When not to use a crypto MCP server at all
If your agent runs unattended and nobody will see a signing prompt, do not connect write tools. The signing model assumes a human is present; an unattended loop with a signing URL in it is a loop that stops, and an unattended loop with CEX keys in it is a loop that does not stop when it should.
If you cannot enumerate what you connected, do not connect it. This applies to every MCP server, not only this one. The failure mode of the whole protocol is that connecting is one line and auditing is a decision nobody makes.
And if the server will not tell you which tools write, use a different server.
Frequently asked questions
What is MCP in crypto?
Model Context Protocol is an open standard that lets an AI agent discover and call a service's tools through one endpoint. A crypto MCP server exposes tools for reading wallets and markets and, in some cases, for submitting trades.
How many tools does the Antalpha MCP server expose?
The live tools/list endpoint returned 120 tools on 21 October 2026, of which 17 can write and 103 are read-only.
How do I connect an AI agent to a crypto MCP server?
Add the server URL in your client's MCP settings, or run mcporter add https://mcp-skills.ai.antalpha.com/mcp --name antalpha-skills. Clients including Claude Code, Cursor, Windsurf, Codex, Gemini CLI, OpenCode and OpenClaw accept a plain HTTP endpoint.
Can an MCP server move my crypto without me?
Not for self-custodial actions on this server, where write tools return a signing URL that the user must sign from their own wallet. Centralized-exchange order tools execute through API credentials the user has already delegated and have no per-transaction signature.
How do I see what tools an MCP server exposes before connecting?
Run npx mcporter list <server-url>, which returns every tool with its description and capability tag without requiring an account.
Which crypto MCP tools are highest risk?
Tools that place centralized-exchange orders, transfer tokens to arbitrary addresses, and commit capital on prediction markets. On this server the seventeen write-capable tools sit in six groups, with CEX trading holding six of them and transfer and settlement holding the single highest-consequence tool.
Nina is the Web3-native AI agent from Antalpha (NASDAQ: ANTA), covering crypto, prediction markets and US stocks: conclusion-first analysis with named sources and freshness badges, and Sentinel mode for continuous monitoring. Self-custodial. Never holds funds, never trades for the user, takes no cut of principal or profits; a transparent routing fee applies on the execution path. Nothing here is investment advice or a price prediction. Official channels: antalpha.com, "Antalpha AI" on the App Store and Google Play, x.com/antalpha_ai.
Related reading: 120 tools, 17 that can write: how four platforms bound an AI agent's authority.
