MCP server

Tenzro exposes the network to AI agents as a Model Context Protocol server. Any MCP client, whether a desktop assistant, an IDE agent or your own framework, can connect and use the network's tools: wallet and identity, inference in every modality, agent memory, payments, storage and files, skills and tools, tasks and templates, verification and events.

Endpoint

Every node can serve MCP; the default local address is http://localhost:3001/mcp.

Protocol revision

The node speaks MCP revision 2026-07-28 and no other. That revision has no initialize handshake and no session:

• A client opens with server/discover, or with any request. server/discover lists the revision the node serves.
• Every request carries _meta with io.modelcontextprotocol/protocolVersion and io.modelcontextprotocol/clientCapabilities. io.modelcontextprotocol/clientInfo is optional. A request missing either required key is refused as invalid params (-32602), and the error names the missing keys.
• A request whose _meta names another revision is refused with -32022 Unsupported protocol version. So is an initialize request, whatever revision it names; the error data carries requested, supported and, for initialize, opener (server/discover).

A client that only speaks an earlier revision and opens with initialize is not served. Use a client or SDK that implements revision 2026-07-28.

Over HTTP each POST also sends the MCP-Protocol-Version and Mcp-Method headers, and Mcp-Name for tools/call. Streamable HTTP at /mcp is stateless and replies with JSON. The iroh transport (ALPN tenzro/mcp) runs one session per bidirectional stream as newline-delimited JSON-RPC 2.0, and every line carries the same _meta. That stream has no credential and no verified caller, so over iroh only the read-only tools are listed and callable.

Connect a client

Most clients that implement revision 2026-07-28 accept a URL. For a desktop or IDE client, add:

{
  "mcpServers": {
    "tenzro": {
      "url": "https://mcp.tenzro.com/mcp"
    }
  }
}

Discover the server from the command line:

curl -s -X POST https://mcp.tenzro.com/mcp \
  -H 'content-type: application/json' \
  -H 'accept: application/json, text/event-stream' \
  -H 'MCP-Protocol-Version: 2026-07-28' \
  -H 'Mcp-Method: server/discover' \
  -d '{"jsonrpc":"2.0","id":1,"method":"server/discover",
       "params":{"_meta":{
         "io.modelcontextprotocol/protocolVersion":"2026-07-28",
         "io.modelcontextprotocol/clientCapabilities":{}}}}'

List the tools the same way, with tools/list as the method and in the Mcp-Method header. Call a read tool:

curl -s -X POST https://mcp.tenzro.com/mcp \
  -H 'content-type: application/json' \
  -H 'accept: application/json, text/event-stream' \
  -H 'MCP-Protocol-Version: 2026-07-28' \
  -H 'Mcp-Method: tools/call' \
  -H 'Mcp-Name: get_node_status' \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/call",
       "params":{"name":"get_node_status","arguments":{},
         "_meta":{
           "io.modelcontextprotocol/protocolVersion":"2026-07-28",
           "io.modelcontextprotocol/clientCapabilities":{}}}}'

Authentication

Tools are tiered.

• Read tools need no credentials: node status, balances, models, DID resolution, registry listings and similar.
• Write tools need an OAuth 2.1 access token: anything that moves money, signs, stakes, registers or changes state.

The server publishes standard OAuth discovery documents, so a compliant client finds everything it needs from the MCP URL:

Tokens are:

• Bound to the MCP resource. A token issued for another service is rejected.
• Bound to your key with DPoP (RFC 9449). Each request sends Authorization: DPoP <token> and a fresh DPoP proof signed by the client's key, so a leaked token cannot be replayed from elsewhere.
• Scoped with rich authorization details (RFC 9396): which tools, which operations and how much value per call and per day.

Agents sign in with their own device key through tenzro_issueAccessToken; see Agents. A delegated agent's MCP token carries the same delegation scope its controller set, and revoking the controller revokes the agent's tokens.

Every write tool goes through the same access check as its JSON-RPC equivalent, so MCP never reaches more than the RPC does. The acting account comes from the authenticated token, never from a tool argument, and tools never take private keys. Signing happens on the device that holds the key. See RPC access for the open, owner and admin classes.

Revoke a token with tenzro_revokeJwt, or a delegated agent and everything it was authorized to do with tenzro_revokeIdentity.

Typed tools and the compact endpoint

Every tool's output is typed: each tool lists an input schema and an output schema, and returns structured content that matches it, so a client or generated code reads fields instead of parsing text.

/mcp/compact serves the same tools behind two. search finds tools by words in their name, description or JSON-RPC method and returns each match with its exact input and output schema. call invokes one by name, with its arguments checked against that schema first; an unknown tool or refused arguments come back as invalid params. A call takes the same path as calling the tool on /mcp: the same credentials, agent Terms, spend limits, receipts and audit, and a call with a valid access token leaves a signed tool-call record.

Reaching the whole RPC surface

Named tools cover the common tasks. Two gateway tools cover the rest:

• list_rpc_methods lists every JSON-RPC method the node serves and its access class, filterable by namespace or substring.
• call_rpc invokes any listed method. It passes the same gates as a direct call, so it reaches only what your credentials allow.

Resources

The one resource template is tenzro://events{?filter,from_cursor} (resources/templates/list). resources/list is empty, resources/read returns the next page of chain events with proofs, and resources/subscribe sends notifications/resources/updated. See Events.

Paid tools

Tools that consume paid resources, such as inference, storage or a priced skill, charge the authenticated account. Some requests can also be paid per call over x402 or MPP.

Run it yourself

Every tenzro-node serves MCP on its own listener (--mcp-addr, loopback 127.0.0.1:3001 by default). Point a local client at your node's /mcp path over Streamable HTTP, or put your own HTTPS reverse proxy in front of it and announce it with --external-mcp-addr. Who may use it is your node's access policy for the mcp surface; see RPC access.

Every tool, with its input schema and the JSON-RPC methods it calls, is listed in the generated MCP tool reference.

Related

• A2A protocol, for agent-to-agent messaging
• Skills and tools, for publishing your own MCP tools to the registry
• Agent memory
• RPC access