FortFi Treasury MCP

Measured conclusion: Deep-tested. L2 outcome: tools_ok.

Policy-gated MCP treasury for AI agents — x402 subscribe, 50+ tools, multi-chain.

Add to your agent

Copy this into your MCP client config:

{
  "mcpServers": {
    "FortFi Treasury MCP": {
      "url": "https://fortfiapp.com/api/mcp",
      "transport": "streamable-http"
    }
  }
}

Measured tools (133)

• get_mcp_guide

  FortFi MCP capability guide: onboarding paths, pricing, limits, workflows, and full tool catalog. Call first when unsure which tool to use (e.g. market research → discover_tokens, not the Explore UI REST route).

  Parameters:

  • topic — string — Default overview

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• get_treasury_context

  Who am I? Returns treasury email, user id, credential kind/scopes, vault summary, and policy limits for this API key. Call first to confirm you are on the correct account before money-moving tools.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• list_wallets

  List FortFi wallets for this account: chain, address, nickname, metadata tags, and default flag. Optional metadataKey/metadataValue filter (exact match). Pass cursor and/or limit to page through large fleets — response becomes { items, nextCursor } when either is set; omit both for the plain array of all wallets.

  Parameters:

  • limit — number — Page size when paginating (default 50, max 200)
  • cursor — string — Opaque cursor from a previous page's nextCursor. Passing this (even empty) switches the response to { items, nextCursor }.
  • metadataKey — string — Filter wallets that include this metadata key (optional)
  • metadataValue — string — When set with metadataKey, require an exact value match

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• list_recipients

  List all allowlisted recipients. Includes cooldown status: `cooldownActive: true` means the recipient cannot yet receive funds (24-hour gate).

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• list_audit_log

  Recent account activity: transfers, swaps, security events. Optional walletId filters to one vault's history. Pass cursor (from a previous page's nextCursor, even as an empty string on the first call) to switch the response to { items, nextCursor } and page back through full history instead of only the most recent entries.

  Parameters:

  • limit — number — Max entries to return (default 20, max 100)
  • cursor — string — Opaque cursor from a previous page's nextCursor. Passing this key (even as '') switches the response to { items, nextCursor }.
  • walletId — string — Filter to audit entries for one wallet id

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• list_activity_report

  Treasury activity timeline (JSON) for reconciliation: normalized labels, USD hints, vault scope, and categories. Optional walletId narrows to one vault. Requires reporting:read (or account:read).

  Parameters:

  • category — string — Filter timeline category (default all)
  • walletId — string — Filter to one wallet mapping id

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• get_fusion_order_status

  Track an owned Fusion+ cross-chain order by orderHash. Returns authoritative settlement/refund status, source and destination transactions, receiver, and the real destination token contract.

  Parameters:

  • orderHash (required) — string — Fusion+ order hash (0x…)

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• get_policy_limits

  Current policy limits: per-tx/daily/monthly caps (USDC smallest units). Agent accounts also include agent cap tier limits, maxWallets, and credential access expiry.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• get_usage_balance

  Monthly UpTo product balance: cap, used, remaining, and period bounds. Billable writes consume this pool; unused budget is refunded at period end.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• resend_claim_link

  Resend the dashboard claim email to contactEmail (MCP agent API key only; keys:manage scope). Use when the original link expired (72h) or was lost. Rate limit: 3/hour.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• list_funding_wallet_agents

  List all FortFi agent accounts funded by the same payment wallet as this agent. Use to discover agentLabel / userId when renewing or spawning siblings (treasury multi-agent setups).

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• list_cosigner_memberships

  Active co-signers on this account.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• get_cosigner_rules

  Amount-banded cosigner quorum rules for sends and swaps. Below-band amounts auto-execute; matching bands require N cosigner votes.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• update_cosigner_rules

  Set cosigner quorum rules (send + swap USD bands). Tightening rules works with the agent key alone. WEAKENING them (lower required cosigners / raise the amount floor) is a GOVERN action: sign a challenge with your funding wallet (challengeId + walletSignature); applies immediately once signed (same as passkey in the UI). Amounts use USDC micro-units (1 USDC = 1000000).

  Parameters:

  • rules (required) — array
  • challengeId — string — Governance challengeId (only needed when weakening rules)
  • walletSignature — string — Funding-wallet signature over the challenge message

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• list_pending_cosigner_approvals

  Pending actions that require this account's co-signer approval. Use when this agent is a co-signer on another account.

  Parameters:

  • limit — number — Max entries (default 10)

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• add_recipient

  Add a payout address to the allowlist. Human developer key (frtfi_hu_* + DA): added with 24h cooldown (no Assist passkey). Agent key (frtfi_ag_*): GOVERN — funding-wallet signature required; then approved immediately.

  Parameters:

  • address (required) — string — Wallet address (0x… or Solana base58)
  • chainId (required) — string — FortFi chain id (e.g. hyperliquid-mainnet). Omit when fromWalletId is set — network is inferred from that wallet.
  • nickname — string — Optional display name
  • challengeId — string — Agent GOVERN: challengeId from the first call
  • fromWalletId — string — Optional source wallet id (list_wallets). Sets allowlist network to that wallet's chain — use for HL sends without passing chainId.
  • walletSignature — string — Agent GOVERN: funding-wallet signature

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• remove_recipient

  Remove a recipient from the FortFi allowlist (tightening policy — no funding-wallet GOVERN). Human developer key, session, or agent treasury key. Re-sync Turnkey policies in the app so the enclave matches.

  Parameters:

  • recipientId (required) — string — Recipient id from list_recipients

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• approve_recipient

  Approve a recipient still in cooldown (early release). Active cosigners may approve directly. Human passkey owners: use the FortFi app (passkey) or the approval email link; owner bearer keys cannot self-clear. Agent-owned accounts: owner self-approval is GOVERN (funding-wallet signature).

  Parameters:

  • recipientId (required) — string — Recipient id from list_recipients or add_recipient
  • challengeId — string — Governance challengeId from the first call
  • walletSignature — string — Funding-wallet signature over the challenge message

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• validate_recipient_manifest

  Preview a batch recipient import (max 50 rows). Each row: { address, chainId, nickname? }. Returns ready_new, already_exists, or invalid per line. Read-only.

  Parameters:

  • recipients (required) — array

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• propose_recipient_manifest

  Apply a validated recipient manifest (human/developer key). Adds new allowlist rows with normal 24h cooldown. Agent keys: use add_recipient per row (GOVERN).

  Parameters:

  • recipients (required) — array

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• validate_payout_manifest

  Preview batch payroll/payout (max 50 lines). Each line: { recipientId, amountUsdc, memo? }. All recipients must be allowlisted, same chain as fromWalletId, and past cooldown.

  Parameters:

  • fromWalletId (required) — string — Wallet id from list_wallets
  • lines (required) — array

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• propose_payout_manifest

  Execute a validated payout manifest sequentially (one ActionIntent per line). Requires Delegated Access or agent wallet. Set dryRun:true to validate only.

  Parameters:

  • fromWalletId (required) — string
  • lines (required) — array
  • dryRun — boolean — If true, validate only — no sends

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• propose_transfer

  Transfer USDC to an allowlisted recipient, OR pay a FortFi invoice by public pid (paymentRequestPid + fromWalletId — amount optional for partial pay). Recipient path requires allowlist approval. Invoice path binds settlement to the pid (Delegated Access / agent accounts execute server-side when configured).

  Parameters:

  • fromWalletId (required) — string — Source wallet id from list_wallets
  • memo — string — Optional transfer note (max 256 chars)
  • amountUsdc — string — Amount in USDC as a decimal string, e.g. '5.00'. Required for recipient sends; optional for invoice pay (defaults to remaining balance).
  • recipientId — string — Allowlisted recipient id (omit when using paymentRequestPid)
  • networkChainId — string — Optional. Send from the same EVM address on another supported mainnet (e.g. 'arbitrum-mainnet' for USDC withdrawn from Hyperliquid). Recipient must be allowlisted on that network. Omit to use the wallet's home network. Not allowed with paymentRequestPid.
  • paymentRequestPid — string — Public invoice pid from checkout URL — pays merchant vault with pid-bound settlement

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• invite_agent_cosigner

  Invite a co-signer. Agents: pass cosignerUserId (GOVERN / funding-wallet sign when using an agent API key). Humans: pass email — opens instructions for Security UI passkey provision (Turnkey dual-control with MCP DA).

  Parameters:

  • email — string — Human path: invitee email for Security UI co-signer provision
  • nickname — string — Optional nickname for this co-signer
  • challengeId — string — Governance challengeId from the first call
  • cosignerUserId — string — Agent path: FortFi userId of the agent to invite as co-signer
  • walletSignature — string — Funding-wallet signature over the challenge message

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• invite_cosigner

  Alias of invite_agent_cosigner. Humans: email → Security UI. Agents: cosignerUserId.

  Parameters:

  • email — string
  • nickname — string
  • challengeId — string
  • cosignerUserId — string
  • walletSignature — string

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• approve_cosigner_action

  Approve a pending action as co-signer. Use with list_pending_cosigner_approvals.

  Parameters:

  • pendingApprovalId (required) — string

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• reject_cosigner_action

  Reject a pending action as co-signer.

  Parameters:

  • pendingApprovalId (required) — string
  • reason — string — Optional rejection reason

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• get_portfolio

  Full portfolio summary across all wallets: token balances with USD values, 24h change, and total net worth.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• get_account_holdings

  Token holdings for a specific wallet, with USD values and 24h change.

  Parameters:

  • walletId (required) — string — Wallet id from list_wallets

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• review_portfolio

  Read-only treasury review: allocation buckets (cash, yield, tokens), top holdings, and optional drift vs target weights. Safe for cron — no proposals created.

  Parameters:

  • targets — array — Optional target allocation. Each row: { label, weightPercent, kind: cash|yield|token|symbol, symbol? }. Weights must sum to 100.
  • minLegUsd — number — Minimum USD for rebalance legs (default 1)
  • driftThresholdPercent — number — Hysteresis band in percentage points (default 5)

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• plan_rebalance

  Read-only rebalance planner toward target weights. Returns suggested legs (swap, yield_deposit, yield_withdraw) without executing. Use propose_* + confirm_proposal to act.

  Parameters:

  • targets (required) — array — Target allocation. Each row: { label, weightPercent, kind: cash|yield|token|symbol, symbol? }. Example: 40% cash, 10% yield, 30% UNI, 20% other tokens.
  • minLegUsd — number — Minimum leg size in USD (default 1)
  • driftThresholdPercent — number — Ignore drift below this % (default 5)

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• discover_tokens

  Market-wide token discovery on a FortFi chain (USD). Use for trending/gainers/losers/volume/mcap — NOT the browser Explore REST route. Sorts: gainers_1d, gainers_30d, gainers_90d, gainers_365d, losers_1d, losers_30d, losers_90d, losers_365d, market_cap, volume_1d. No 7d or 30d-volume sort exists upstream — closest available gainers granularity to '1 week' is gainers_1d or gainers_30d; say so explicitly rather than silently picking one. Returns contract addresses for propose_swap / propose_bridge.

  Parameters:

  • chainId (required) — string — FortFi chain id, e.g. base-mainnet, ethereum-mainnet
  • sort — string — gainers_1d, gainers_30d, gainers_90d, gainers_365d, losers_1d, losers_30d, losers_90d, losers_365d, market_cap, volume_1d (default market_cap)
  • limit — number — Max results (default 10, max 25)
  • query — string — Optional name/symbol filter, e.g. 'USDC' or 'wrapped'
  • verifiedOnly — boolean — Only verified tokens

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• get_token_chart

  Fetch a compact Zerion chart summary plus deterministic EMA, RSI, MACD, Bollinger, return, max-drawdown, and data-quality analysis. Raw points are omitted by default; set includePoints:true only for visual charting or external analysis. Discontinuous pre-migration/launch samples are excluded from TA.

  Parameters:

  • chainId (required) — string — FortFi chain id, e.g. base-mainnet, ethereum-mainnet
  • period — string — Chart window (default day)
  • address — string — Token contract address or Solana mint (fallback)
  • fungibleId — string — Zerion fungible id returned by discover_tokens (preferred)
  • indicators — array — Optional indicators to return; defaults to all. REST callers may pass a comma-separated value.
  • includePoints — boolean — Include the raw chart points array. Default false.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• screen_tokens

  Batch cheap-screen tokens across requested chains. Defaults to verified assets, $5M market cap, $50K daily volume, top 30-day performers plus volume leaders, stablecoin removal, and cross-chain deduplication. Returns no proposal.

  Parameters:

  • chains (required) — array
  • mode — string
  • sorts — array — Defaults to gainers_30d + volume_1d. Add gainers_1d, gainers_90d, gainers_365d, or market_cap when requested.
  • deepOptIn — boolean — Required when mode=deep
  • verifiedOnly — boolean — Default true
  • candidateLimit — number — Override merged candidate cap, max 100
  • minVolume1dUsd — number — Default 50000
  • minMarketCapUsd — number — Default 5000000
  • includeUnverified — boolean — Default false; unverified results are labeled and need execution opt-in

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• rank_tokens

  Two-stage token ranking: run the cheap screen, then concurrently fetch deterministic chart evidence only for the strongest candidates. Quick charts 5 candidates over month+3months; standard charts 10 over day+month+3months+year; deep charts 20 and requires explicit opt-in. Returns evidence for user review and never creates a proposal.

  Parameters:

  • chains (required) — array
  • mode — string
  • sorts — array — Defaults to gainers_30d + volume_1d. Optional supplements: gainers_1d, gainers_90d, gainers_365d, market_cap.
  • periods — array
  • deepOptIn — boolean — Required when mode=deep
  • verifiedOnly — boolean — Default true
  • candidateLimit — number — Override merged candidate cap, max 100
  • minVolume1dUsd — number — Default 50000
  • minMarketCapUsd — number — Default 5000000
  • includeUnverified — boolean — Default false
  • chartCandidateLimit — number — Override chart cap, max 20

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• get_swap_routing_guide

  Returns which swap/bridge tool to use for a given from→to chain pair, with notes on protocols supported.

  Parameters:

  • fromChainId (required) — string — Source chain id
  • toChainId (required) — string — Destination chain id

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• list_token_spender_grants

  List active ERC-20 token approvals (spender grants) on this account. Useful before proposing a swap to confirm the CoW vault is approved.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• list_incoming_cosigner_invites

  List pending co-signer invites sent TO this account (where this account is the invitee). Use to discover accounts you can become a co-signer for.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• accept_cosigner_invite

  Accept a pending co-signer invite. After accepting, you will be able to approve/reject pending actions for that account.

  Parameters:

  • inviteId (required) — string — Invite id from list_incoming_cosigner_invites

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• remove_cosigner

  Remove an active co-signer from this account. GOVERN action (it shrinks the approver set): via an agent key, sign a challenge with your funding wallet (challengeId + walletSignature); applies immediately once signed.

  Parameters:

  • membershipId (required) — string — Membership id from list_cosigner_memberships
  • challengeId — string — Governance challengeId from the first call
  • walletSignature — string — Funding-wallet signature over the challenge message

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• register_backup_governance_wallet

  Register (or replace) a single backup governance wallet — the agentic equivalent of a backup passkey. Either the funding wallet or this backup can authorize future governance. GOVERN action: sign the challenge with your CURRENT funding wallet (challengeId + walletSignature); applies immediately once signed. Max one backup.

  Parameters:

  • walletAddress (required) — string — The backup wallet address (0x…) to register
  • challengeId — string — Governance challengeId from the first call
  • walletSignature — string — CURRENT funding-wallet signature over the challenge message

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• remove_backup_governance_wallet

  Remove the registered backup governance wallet. GOVERN action: sign with your funding wallet (challengeId + walletSignature); applies immediately once signed. After removal, only the funding wallet may authorize governance.

  Parameters:

  • challengeId — string — Governance challengeId from the first call
  • walletSignature — string — Funding-wallet signature over the challenge message

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• list_governance_requests

  List open governance requests on this account: pending (awaiting signature) and legacy scheduled rows. Use to monitor for unexpected loosening attempts.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• cancel_governance_change

  Veto/cancel a pending governance challenge before it is signed and applied. Cancelling TIGHTENS security, so it needs only the agent key (no signature). Also cancels legacy scheduled rows from before immediate-apply parity.

  Parameters:

  • challengeId (required) — string — The governance request id from list_governance_requests

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• revoke_cosigner_invite

  Revoke a pending outbound co-signer invite before it is accepted.

  Parameters:

  • inviteId (required) — string — Invite id from the invite you sent

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• cancel_pending_action

  Cancel a pending approval that you (the account owner) initiated.

  Parameters:

  • pendingApprovalId (required) — string — Pending approval id from list_pending_cosigner_approvals or list_audit_log

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• propose_rename_account

  Rename a wallet (account nickname), then call confirm_proposal with the returned proposalId.

  Parameters:

  • accountId (required) — string — Wallet id from list_wallets
  • nickname (required) — string — New nickname (2–64 characters)

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• propose_create_account

  Create a new wallet on a supported chain. Optional metadata tags (e.g. customer_id). Then call confirm_proposal with the returned proposalId. Agent accounts execute server-side when no cosigners are configured.

  Parameters:

  • chainId (required) — string — FortFi chain id, e.g. base-mainnet, robinhood-mainnet, solana-mainnet
  • walletName (required) — string — Display name for the new wallet (2–64 chars)
  • metadata — object — Optional flat string tags (max 20 keys), e.g. { "customer_id": "cust_123" }

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• confirm_proposal

  Confirm a pending proposal returned by a propose_* tool. Reuses the same policy, risk, allowlist, vault-grant, delegated-authority, and cosign checks as POST /api/mcp/confirm. Returns executed, pending-approval, or passkey-required status.

  Parameters:

  • proposalId (required) — string — Proposal UUID returned by a propose_* tool
  • confirmToken — string — Optional proposal-bound confirmation token when one was returned

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• update_wallet_metadata

  Propose updating wallet metadata tags (flat string key/value pairs; replaces existing tags on confirm). Returns proposalId; call confirm_proposal to apply. Not a money-moving action.

  Parameters:

  • accountId (required) — string — Wallet id from list_wallets
  • metadata (required) — object — Full metadata object, e.g. { "customer_id": "cust_123", "agent_id": "ag_1" }

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• preview_swap_quote

  Optional advanced step: fetch a same-chain swap quote (CoW on EVM, Jupiter on Solana) and return previewQuoteId. Omit previewQuoteId on propose_* to bundle quote+proposal in one call. Does not execute or move funds.

  Parameters:

  • fromWalletId (required) — string — Source wallet id
  • sellSymbol (required) — string
  • buySymbol (required) — string
  • amountUsd (required) — string — Approximate sell amount in USD
  • buyMint — string — Solana buy mint — omit for EVM
  • sellMint — string — Solana sell mint — omit for EVM
  • toWalletId — string — Optional Solana receive wallet
  • buyTokenAddress — string — EVM buy token (0x…) — omit for Solana
  • slippagePercent — number — Optional Jupiter slippage 0–50
  • sellTokenAddress — string — EVM sell token (0x…) — omit for Solana

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• preview_bridge_quote

  Optional advanced step: fetch a cross-chain bridge quote (Fusion+ or deBridge) and return previewQuoteId. Omit previewQuoteId on propose_bridge to bundle quote+proposal in one call.

  Parameters:

  • fromWalletId (required) — string
  • toWalletId (required) — string
  • sellSymbol (required) — string
  • buySymbol (required) — string
  • amountUsd (required) — string

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• check_trade_allowance

  Check ERC-20 allowance for an upcoming CoW swap (cow_swap) or Fusion bridge (fusion_bridge). Call before propose_swap / propose_bridge; if insufficient, use propose_token_approve then confirm.

  Parameters:

  • fromWalletId (required) — string — Source EVM wallet id
  • tokenAddress (required) — string — Sell token contract (0x…)
  • requiredAmountSmallest (required) — string — Required allowance in token smallest units (e.g. USDC 6 decimals)
  • flow (required) — string — cow_swap = CoW VaultRelayer; fusion_bridge = 1inch Limit Order

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• propose_token_approve

  Propose max ERC-20 approval for CoW or Fusion spenders. Returns proposalId — call confirm_proposal before swap/bridge.

  Parameters:

  • fromWalletId (required) — string — EVM wallet id
  • tokenAddress (required) — string — Token to approve (0x…)
  • flow (required) — string

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• propose_swap

  Propose an EVM CoW swap. Autonomous agents: fetches and binds a quote inline (default), or pass previewQuoteId from preview_swap_quote for a two-step review. confirm always signs the bound quote — same principle as FortFi Assist. Human session MCP: confirm requires passkey in the app.

  Parameters:

  • fromWalletId (required) — string — Source wallet id (must be EVM, CoW-supported chain)
  • sellTokenAddress (required) — string — Token contract address to sell (0x…)
  • buyTokenAddress (required) — string — Token contract address to buy (0x…)
  • sellSymbol (required) — string — Human-readable symbol of sell token, e.g. USDC
  • buySymbol (required) — string — Human-readable symbol of buy token, e.g. ETH
  • amountUsd (required) — string — Sell amount in USD
  • previewQuoteId — string — Optional — from preview_swap_quote for explicit quote review before propose
  • slippagePercent — number — Optional slippage tolerance 0–50 (default 0.5)

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• propose_solana_swap

  Propose a Solana Jupiter swap. Autonomous agents: inline quote by default, or previewQuoteId for two-step review. confirm signs the bound quote.

  Parameters:

  • fromWalletId (required) — string — Solana wallet id to sell from
  • toWalletId (required) — string — Solana wallet id to receive (can be same as fromWalletId)
  • sellMint (required) — string — Mint address of token to sell
  • buyMint (required) — string — Mint address of token to buy
  • sellSymbol (required) — string — Human-readable sell symbol
  • buySymbol (required) — string — Human-readable buy symbol
  • amountUsd (required) — string — Sell amount in USD
  • previewQuoteId — string — Optional — from preview_swap_quote for explicit quote review before propose
  • slippagePercent — number — Optional slippage tolerance 0–50 (default 0.5)

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• propose_bridge

  Propose a Fusion+ or deBridge cross-chain swap. FortFi resolves chain-specific verified token contracts from sellSymbol/buySymbol; optional token addresses are mismatch assertions, never routing overrides. Inline quote by default, or use previewQuoteId for two-step review.

  Parameters:

  • fromWalletId (required) — string — Source wallet id
  • toWalletId (required) — string — Destination wallet id (different chain)
  • sellSymbol (required) — string — Sell token symbol
  • buySymbol (required) — string — Buy token symbol
  • amountUsd (required) — string — Bridge amount in USD
  • previewQuoteId — string — Optional — from preview_bridge_quote for explicit quote review before propose
  • buyTokenAddress — string — Optional expected destination token contract; proposal fails if it differs from FortFi's verified chain resolution
  • sellTokenAddress — string — Optional expected source token contract; proposal fails if it differs from FortFi's verified chain resolution

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• list_yield_markets

  Open Morpho yield discovery by chain with discovered, policyEligible, manuallyCurated, executionReady, and eligibilityReasons. Default minimum TVL is $500K everywhere (listing, policy, Turnkey). executionReady means TVL qualifies and you have a wallet on that chain; POLICY_SYNC_RECOMMENDED is advisory only.

  Parameters:

  • asset — string — Asset symbol filter, default USDC
  • limit — number — Max vaults (default 15, max 25)
  • sortBy — string — net_apy (default) or tvl
  • chainId — string — FortFi chain id or omit for all yield chains
  • minTvlUsd — number — Minimum vault TVL in USD (default 500000)
  • verifiedOnly — boolean — If true, only FortFi curated vaults; default false = open discovery

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• list_yield_positions

  Active Morpho yield positions with per-vault valueUsd, earnedUsd (Morpho pnlUsd), netApy, and a summary block. summary.cumulativeEarnedUsd matches Morpho pnl on the open vaults when the ledger cannot explain the balance. A deposit missing from the ledger is principal, not earnings. Use at the start of every yield desk run to report standing P&L.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• get_yield_market_detail

  Evidence for one Morpho vault: current net APY/TVL, historical APY and TVL series, period statistics, quality flags, allocation, instant-withdrawal liquidity, separated eligibility/readiness status, and timestamp. Rank on evidence.apy.medianPercent: the raw series contains upstream artifacts (points above 3000% APY) so averagePercent is filtered and medianPercent is the robust level. Check evidence.liquidity.redeemableUsd before sizing, since vaults typically run near 90% utilization and only unborrowed supply can be withdrawn on demand. Use before recommending or proposing a deposit.

  Parameters:

  • chainId (required) — string — FortFi yield-supported chain id
  • vaultAddress (required) — string — Vault address from list_yield_markets
  • apyDays — number — APY history window, 7–365 days; default 30
  • tvlDays — number — TVL history window, 7–365 days; default 90

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• rank_yield_markets

  Batch-rank Morpho markets using current net APY, APY median/average/range/volatility, TVL trend/drawdown, vault age, curation, instant-withdrawal liquidity, warnings, and current-user execution eligibility. Results are ordered by current net APY, which is a spot rate that spikes: re-rank on evidence.apy.medianPercent before acting, since a vault printing 12% today commonly pays under 5% tomorrow. Runs evidence requests concurrently and never creates a proposal.

  Parameters:

  • asset — string — Asset symbol, default USDC
  • limit — number — Default 10, max 25
  • apyDays — number — Default 30
  • chainId — string — FortFi chain id or all
  • tvlDays — number — Default 90
  • minTvlUsd — number — Default 500000

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• propose_yield_deposit

  Propose Morpho vault deposit, then call confirm_proposal. With Delegated Access / agent key this executes server-side when policy permits. Use list_yield_markets for vaultAddress.

  Parameters:

  • vaultAddress (required) — string — Morpho vault contract (0x…)
  • amountUsd (required) — string — USDC amount e.g. 100.00
  • assetSymbol — string
  • fromWalletId — string — FortFi wallet id
  • fromAccountQuery — string — Wallet nickname (alternative to fromWalletId)

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• propose_yield_withdraw

  Propose Morpho vault withdraw, then call confirm_proposal. With Delegated Access this executes server-side when policy permits. Use list_yield_positions for vaultAddress.

  Parameters:

  • vaultAddress (required) — string
  • amountDisplay (required) — string
  • vaultName — string
  • assetSymbol — string
  • fromWalletId — string
  • fromAccountQuery — string

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• list_polymarket_markets

  List active Polymarket prediction markets on Polygon with volume, liquidity, and outcome prices.

  Parameters:

  • limit — number — Max markets (default 25)
  • search — string — Optional question/slug filter
  • sortBy — string — volume_24hr (default), volume, liquidity, or end_date
  • afterCursor — string — Pagination cursor from a prior list response
  • sortDirection — string
  • minLiquidityUsd — number — Minimum liquidity USD (default 10000)

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• search_polymarket_markets

  Search Polymarket markets by question text.

  Parameters:

  • query (required) — string — Search text
  • limit — number

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• rank_polymarket_markets

  Rank Polymarket markets by volume, liquidity, or 24h volume.

  Parameters:

  • limit — number
  • sortBy — string

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• get_polymarket_market

  Get a Polymarket market by conditionId with optional outcome price history from the public CLOB API.

  Parameters:

  • conditionId (required) — string — Market condition id
  • tokenId — string — Outcome token id for history (defaults to first outcome)
  • interval — string — Price history window (default 1w)

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• list_polymarket_positions

  List Polymarket outcome token positions for a Polygon wallet. walletId is required.

  Parameters:

  • walletId (required) — string — FortFi Polygon wallet id

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• propose_polymarket_buy

  Propose buying Polymarket outcome shares, then call confirm_proposal. Requires Polygon wallet.

  Parameters:

  • conditionId (required) — string — Market condition id from list_polymarket_markets
  • outcomeIndex (required) — number — 0-based outcome index
  • price (required) — string — Limit price 0-1 (e.g. 0.52)
  • sizeDisplay (required) — string — Share count (e.g. 10)
  • fromWalletId — string
  • fromAccountQuery — string

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• propose_polymarket_sell

  Propose selling Polymarket outcome shares (redeem collateral), then call confirm_proposal.

  Parameters:

  • conditionId (required) — string
  • outcomeIndex (required) — number
  • price (required) — string
  • sizeDisplay (required) — string
  • fromWalletId — string
  • fromAccountQuery — string

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• propose_polymarket_redeem

  Propose redeeming winning shares from a resolved Polymarket market (CTF on Polygon), then call confirm_proposal.

  Parameters:

  • conditionId (required) — string
  • fromWalletId — string
  • outcomeIndex — number
  • fromAccountQuery — string

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• list_hyperliquid_markets

  List Hyperliquid perpetual markets with live mark/mid/oracle prices, funding, open interest, and 24h volume. Public data; no proposal.

  Parameters:

  • limit — number — Page size (default 30, max 100)
  • offset — number — Pagination offset (default 0)
  • search — string — Filter by coin symbol

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• get_hyperliquid_market

  Get a Hyperliquid perp market by symbol with mark/funding context and optional candle history.

  Parameters:

  • symbol (required) — string — Coin symbol, e.g. BTC
  • interval — string — Candle interval (default 1h)

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• list_hyperliquid_symbol_master

  Security master for Hyperliquid perps: symbol, dex, desk label, short symbol, display name, asset class (crypto/equity/commodity/fx/index/pre_ipo), plus live volume and funding. Default scope=core; pass scope=all for HIP-3.

  Parameters:

  • dex — Filter dex ids (core, xyz, io, para). Comma-separated string or array.
  • limit — number — Max rows by 24h volume (default all, max 500)
  • scope — string — Default core
  • assetClass — Filter asset classes. Comma-separated string or array.
  • includeAllDesks — boolean — When true, same as scope=all

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• rank_hyperliquid_markets

  Rank Hyperliquid perp markets by 24h volume, pctChange, or funding. Returns dex + assetClass tags. Default scope=core; pass scope=all for HIP-3. Cheap filter only — use screen_hyperliquid_markets for breakout TA.

  Parameters:

  • dex — Filter dex ids. Comma-separated string or array.
  • sort — string — Default volume
  • limit — number — Default 20
  • scope — string — Default core
  • direction — string — Default desc
  • assetClass — Filter asset classes. Comma-separated string or array.
  • includeAllDesks — boolean — When true, same as scope=all

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• screen_hyperliquid_markets

  Breakout screener for Hyperliquid perps: min volume filter, rank, HL candle TA (RSI, MACD, Bollinger). Returns dex + assetClass tags and long/short/neutral bias. Default scope=core; scope=all for HIP-3. Never creates proposals.

  Parameters:

  • dex — Filter dex ids. Comma-separated string or array.
  • sort — string — Default pctChange
  • limit — number — Default 40
  • scope — string — Default core
  • interval — string — Default 1h
  • sideBias — string
  • direction — string — desc=gainers, asc=losers/short ideas
  • assetClass — Filter asset classes. Comma-separated string or array.
  • chartLimit — number — TA depth, default 10
  • indicators — array
  • includeCharts — boolean
  • includeAllDesks — boolean — When true, same as scope=all
  • minDayVolumeUsd — number — Default 1000000

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• get_hyperliquid_cross_section

  Rank a Hyperliquid perp universe by trailing return in one call, for a dollar-neutral long/short book. Returns dex, assetClass, trailing returns, realized vol, funding, rank, percentile, and long/short/hold buckets. Default scope=core (validated trend desk); pass scope=all for HIP-3 cross-asset books. Read-only; never creates proposals.

  Parameters:

  • dex — Filter dex ids. Comma-separated string or array.
  • band — number — Hysteresis band, default 1.0. A held name stays eligible while inside the top legsPerSide*(1+band); surfaced as hold_long / hold_short.
  • limit — number — Max symbols ranked by volume, default 60
  • scope — string — Default core
  • assetClass — Filter asset classes. Comma-separated string or array.
  • legsPerSide — number — Legs per side, default 6
  • lookbackDays — array — Trailing return windows in days. FIRST entry is the ranking signal. Default [14,7,30].
  • includeAllDesks — boolean — When true, same as scope=all
  • minDayVolumeUsd — number — Liquidity floor, default 2000000

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• run_hyperliquid_research_backtest

  Run an out-of-sample backtest on Hyperliquid perp OHLCV stored in FortFi research Postgres (hl_research_candles). Returns IS/OOS metrics and a pass/fail verdict. Read-only; uses synced historical data, not live HL API for bars. Strategies: momentum_cross (default).

  Parameters:

  • coins — array — Optional fixed symbol list (e.g. BTC, ETH). Omit for volume-filtered universe
  • holdBars — number — Hold period in bars. Default 24
  • interval — string — Candle interval in research DB. Default 1h
  • strategy — string — Default momentum_cross
  • legsPerSide — number — Long/short leg count. Default 6
  • oosFraction — number — Out-of-sample tail fraction. Default 0.35
  • lookbackBars — number — Trailing return lookback. Default 336 on 1h (~14d)
  • minDayVolumeUsd — number — Universe liquidity floor when coins omitted. Default 1000000

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• run_hyperliquid_research_backtest_spec

  Run an out-of-sample backtest from a Strategy Spec JSON (universe + rank factor or named pattern + portfolio rules). Deterministic; reads hl_research_* Postgres. Agent should translate natural-language strategy ideas into the spec object before calling. Pass presetId instead of spec to get a FortFi house preset (crypto-majors, core-momentum, mag7, semis, memory, ai-compute, pre-ipo, ...) with its frozen spec and published OOS, walk-forward, drawdown and leverage scenarios; add rerun:true to recompute it live.

  Parameters:

  • prod — boolean — Use production Supabase (default false in dev)
  • spec — object — Strategy Spec: name, universe {dex, minDayVolumeUsd, includeCoins, excludeCoins, maxSymbols}, interval, signal {type rank|pattern, factor|pattern, params}, portfolio, costs, validation
  • rerun — boolean — With presetId, rerun the preset spec live instead of returning published stats
  • presetId — string — House preset id. Returns the spec plus published stats.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• get_hyperliquid_research_data_stats

  Row counts and last ingest time for hl_research_* tables (candles, funding, symbols). Use before backtests to confirm data freshness.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• list_strategy_presets

  List FortFi autonomous Hyperliquid strategies (house presets) with their published backtest: out-of-sample return, Sharpe and drawdown at 1x, walk-forward windows, every leverage scenario, tested leverage (start_strategy accepts these), high-risk leverage (owner passkey only), and the minimum account size per leverage. Read-only.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• list_strategies

  List strategies running on your Hyperliquid accounts (presets and copy trades): status, leverage, cap, next rebalance, and whether an API key started it. Stopped strategies are hidden unless includeStopped is true.

  Parameters:

  • walletId — string — Optional: only this hyperliquid-mainnet wallet
  • includeStopped — boolean — Include stopped strategies

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• get_strategy

  Get one strategy with its last 20 runs (each run lists the orders it placed and their result).

  Parameters:

  • id (required) — string — Strategy id from list_strategies
  • walletId (required) — string — Wallet the strategy runs on

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• list_copy_trade_leaders

  Top Hyperliquid accounts by profit over a window (week, month, allTime), from Hyperliquid's public leaderboard. Only accounts over $25k that traded this month and are profitable all-time. Use get_copy_trade_wallet before copying one.

  Parameters:

  • page — number — 0-based page, default 0
  • query — string — Address prefix (0x...) or display name fragment
  • window — string — Default month
  • pageSize — number — 1 to 50, default 20

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• get_copy_trade_wallet

  Deep dive on any Hyperliquid address: account value, leverage, open positions with share of book, PnL and volume for day, week, month and all time, and a copy preview per leverage cap (which positions would be copied, coverage, and the minimum account size so each copied position is at least $10).

  Parameters:

  • address (required) — string — 0x Hyperliquid address

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• start_strategy

  Start a house preset on a hyperliquid-mainnet wallet and place its first orders. Leverage must be one of the preset's testedLeverage levels; high-risk levels need the owner in the app. Requires the owner to have turned on autonomous trading and confirmed perps eligibility. One strategy per wallet. Every order is an ActionIntent under this key's caps and co-sign rules; the key is re-checked every run and the strategy pauses if it is revoked.

  Parameters:

  • walletId (required) — string — hyperliquid-mainnet wallet id
  • presetId (required) — string — From list_strategy_presets
  • leverage (required) — number — One of the preset's testedLeverage levels
  • maxLossPct — integer — Optional loss cap, whole percent (1-90). If the strategy's P&L since start falls this far below the money it runs on, FortFi stops it and closes its positions. Checked every 5 minutes.
  • maxAllocationUsd — string — Optional cap on equity the strategy sizes against, e.g. "500"

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• start_copy_trade

  Copy another Hyperliquid account on one of your wallets. Every hour FortFi reads their book, keeps their largest positions until 95% of their exposure is covered (at most 10 names), scales to your equity and leverage cap, and trades only when a position drifts more than 10% from target. API keys may set a leverage cap of 1 or 2; 3 and 5 need the owner in the app. Same rails, caps and key re-checks as start_strategy.

  Parameters:

  • walletId (required) — string — hyperliquid-mainnet wallet id
  • address (required) — string — 0x address to copy
  • leverage (required) — number — Leverage cap: 1 or 2 for API keys
  • maxLossPct — integer — Optional loss cap, whole percent (1-90). If the strategy's P&L since start falls this far below the money it runs on, FortFi stops it and closes its positions. Checked every 5 minutes.
  • maxAllocationUsd — string — Optional cap on equity used, e.g. "500"

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• update_strategy

  Lower a strategy's leverage or allocation cap. API keys can only tighten: raising leverage or the cap returns OWNER_PASSKEY_REQUIRED.

  Parameters:

  • id (required) — string
  • walletId (required) — string
  • leverage — number — New lower leverage
  • maxLossPct — integer — New loss cap, whole percent. API keys may add a cap or lower it, never raise or remove it.
  • maxAllocationUsd — string — New lower cap

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• pause_strategy

  Pause a strategy. Positions stay open; no more orders until resumed.

  Parameters:

  • id (required) — string
  • walletId (required) — string

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• resume_strategy

  Resume a paused strategy. An API key can only resume a strategy it started; others need the owner in the app.

  Parameters:

  • id (required) — string
  • walletId (required) — string

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• stop_strategy

  Stop a strategy and close every position it opened (cash out). Positions it did not open are left alone.

  Parameters:

  • id (required) — string
  • walletId (required) — string

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• rebalance_strategy_now

  Run a strategy's rebalance now instead of waiting for its schedule. Returns the run outcome.

  Parameters:

  • id (required) — string
  • walletId (required) — string

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• list_hyperliquid_positions

  List open Hyperliquid perp positions and margin summary for a hyperliquid-mainnet wallet (its address is used on the L1 order book).

  Parameters:

  • walletId (required) — string — FortFi wallet id on hyperliquid-mainnet

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• get_hyperliquid_balances

  Get Hyperliquid wallet balances: L1 perps margin (withdrawable), HL Spot USDC (MoonPay HyperCore lands here), and HyperEVM USDC/HYPE. Also returns a `perps` aggregate over open positions: openPositionCount, unrealizedPnlUsd, entryNotionalUsd, and unrealizedPnlPct (null when nothing is open).

  Parameters:

  • walletId (required) — string — FortFi wallet id on hyperliquid-mainnet

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• get_hyperliquid_trading_desk

  One-shot Hyperliquid trading desk snapshot for agent loops: margin, balances, positions, open orders, recent fills, and a `performance` block with unrealizedPnlUsd, unrealizedPnlPct, entryNotionalUsd, openPositionCount, and realizedPnlUsdRecentFills. Prefer this over many separate reads every 30-60 minutes.

  Parameters:

  • walletId (required) — string — FortFi wallet id on hyperliquid-mainnet
  • fillLimit — number — Recent fills to include (default 100, max 500)

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• list_hyperliquid_open_orders

  List resting Hyperliquid orders including SL/TP triggers for a wallet.

  Parameters:

  • walletId (required) — string

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• get_hyperliquid_user_fills

  Recent Hyperliquid trade fills with closedPnl per fill. Use for P&L review and trade history (up to 2000 from HL).

  Parameters:

  • walletId (required) — string
  • limit — number — Max fills to return (default 200, max 2000)

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• propose_hyperliquid_perp_open

  Propose opening a Hyperliquid perp position. Runs FortFi perp policy (max leverage, max notional) and rejects non-hyperliquid-mainnet wallets. Returns a proposalId for confirm_proposal.

  Parameters:

  • walletId (required) — string
  • symbol (required) — string — e.g. BTC, ETH, xyz:TSLA, xyz:GOLD
  • side (required) — string
  • size — string — Coin-unit size (string). Use sizeUsd instead for USD notional.
  • sizeUsd — string — USD notional target (min $10 on HL). Preferred for agents.
  • leverage — number
  • stopLoss — string — Optional stop-loss trigger. With limitPrice it attaches to the order (normalTpsl) and arms once it fills, validated against the limit price.
  • limitPrice — string — Optional resting limit price (GTC). Must be within 5% of mid when it crosses the book. Omit for a market order.
  • takeProfit — string — Optional take-profit trigger. With limitPrice it attaches to the order (normalTpsl) and arms once it fills, validated against the limit price.
  • timeInForce — string — Limit orders only. Gtc (default), Alo (post only, rejected if it would cross), Ioc.
  • acknowledgePriceImpact — boolean — Set true only after a HYPERLIQUID_PRICE_IMPACT_CONFIRM_REQUIRED error, to accept >=1% book impact on a market order. Prefer limitPrice or a smaller size.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• propose_hyperliquid_perp_close

  Propose closing a Hyperliquid perp position (reduce-only). Omit size to close the whole position. Returns a proposalId for confirm_proposal.

  Parameters:

  • walletId (required) — string
  • symbol (required) — string
  • size — string — Optional; omit to close all

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• propose_hyperliquid_perp_modify

  Propose modifying a Hyperliquid perp position's protective stop-loss / take-profit (reduce-only). Returns a proposalId for confirm_proposal.

  Parameters:

  • walletId (required) — string
  • symbol (required) — string
  • stopLoss — string
  • takeProfit — string

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• cancel_hyperliquid_orders

  Propose cancelling resting Hyperliquid orders (limit orders and SL/TP triggers) on one market. Pass oids from list_hyperliquid_open_orders, or omit oids to cancel every resting order on that symbol. Moves no money, but cancelling a stop loss removes protection, so it follows the normal confirm_proposal flow.

  Parameters:

  • walletId (required) — string
  • symbol (required) — string — e.g. BTC, xyz:TSLA
  • oids — array — Resting order ids on this symbol (max 50). Omit to cancel all of them.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• propose_hyperliquid_deposit

  Propose moving HyperEVM USDC into Hyperliquid perp margin (top up). Set perpDex for HIP-3 desks (xyz, io, para). Returns proposalId; execute with confirm_proposal (server-side when Delegated Access or agent credential).

  Parameters:

  • walletId (required) — string
  • amountUsd (required) — string
  • perpDex — string — core | xyz | io | para (default core)

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• propose_hyperliquid_withdraw

  Propose moving Hyperliquid perp USDC to the owner's own HyperEVM wallet (same address; perp to HL Spot, then sendAsset to the USDC system address). Funds cannot go to any other recipient. Returns proposalId; human confirms with passkey via Perps Withdraw to HyperEVM or confirm_proposal.

  Parameters:

  • walletId (required) — string
  • amountUsd (required) — string

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• propose_hyperliquid_spot_to_perp

  Propose moving USDC from HL Spot into core perps margin (required after MoonPay HyperCore on-ramp). Returns proposalId; human confirms via Perps Deposit to tradable balance or confirm_proposal.

  Parameters:

  • walletId (required) — string
  • amountUsd (required) — string

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• propose_hyperliquid_send_asset

  Move USDC between Hyperliquid margin desks without HyperEVM (any perp book: core, xyz, io, para, mkts, …, or spot → any perp desk). Use list_hyperliquid_balances perpDesks[].dex for valid dex ids.

  Parameters:

  • walletId (required) — string
  • amountUsd (required) — string
  • sourceDex (required) — string — core | spot | or any HIP-3 builder dex (xyz, io, para, mkts, …)
  • destinationDex (required) — string — core | or any HIP-3 builder dex (not spot)

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• list_hyperliquid_outcome_markets

  List Hyperliquid HIP-4 outcome markets on the same account as perps. Prices are quote-micro (650000 = $0.65) from exchange mids. volumeUsd is 0 because outcomeMeta does not publish volume.

  Parameters:

  • q — string — Search question, name, or description
  • limit — number — Page size, default 50, max 300
  • cursor — string — marketId from the previous page nextCursor

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• get_hyperliquid_outcome_market

  One HIP-4 outcome market. id is the numeric outcome id. Optional walletId reads that Hyperliquid account's share balance.

  Parameters:

  • id (required) — string — Outcome id, e.g. 9802
  • walletId — string

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• propose_hyperliquid_outcome_order

  Propose a HIP-4 buy or sell on the Hyperliquid account. size is micro-USDC collateral (10000000 = $10). limitPrice is quote-micro. Runs outcome policy (no leverage, max notional) before any signature. Confirm with confirm_proposal.

  Parameters:

  • walletId (required) — string
  • marketId (required) — string — Outcome id, e.g. 9802
  • outcomeId (required) — string — Side id outcomeId:sideIndex, e.g. 9802:0
  • side (required) — string
  • size (required) — string — Collateral in micro-USDC. Minimum 10000000 ($10).
  • orderType (required) — string
  • limitPrice — string — Quote-micro. Required for limit. 650000 is $0.65.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• create_checkout_session

  Create a per-customer checkout session: resolves (or provisions) the customer's own vault from your externalCustomerId, mints a payment request that settles into it, and returns checkoutUrl + x402Url. The paid webhook then carries customer identity. Price from productSlug or ad-hoc amountUsd.

  Parameters:

  • customer (required) — object — Your customer identity — vault is resolved per (namespace, externalId)
  • chainId — string — Chain for ad-hoc sessions (default base-mainnet)
  • metadata — object — Optional metadata object
  • amountUsd — number — Ad-hoc price in USD (alternative to productSlug)
  • reference — string — Your order/session id, echoed on every webhook
  • description — string — Optional checkout note
  • productSlug — string — Price from an existing payment product (SKU)
  • idempotencyKey — string — Safe retries — same key returns the same session
  • expiresInMinutes — number — Session TTL (default 60, product default wins if set)
  • amountSmallestUnit — string — Ad-hoc USDC amount in smallest units

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• create_payment_request

  Create a shareable payment request for a vault. Returns pid, paymentUrl, and qrPayload for humans or agents.

  Parameters:

  • walletMappingId (required) — string — Target collection vault id
  • metadata — object — Optional metadata object
  • amountUsd — number — Invoice amount in USD (1 USD = 1 USDC)
  • expiryDays — number — Days until expiry (default 30)
  • description — string — Optional invoice note
  • externalReference — string — Optional external invoice id
  • amountSmallestUnit — string — USDC amount in smallest units (alternative to amountUsd)

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• get_payment_request

  Get a payment request by internal id or public pid, including settlement attempts.

  Parameters:

  • idOrPid (required) — string — Internal id or public pid

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• list_payment_requests

  List payment requests for the authenticated account.

  Parameters:

  • status — string
  • walletMappingId — string — Optional vault filter

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• cancel_payment_request

  Cancel an open payment request with no verified settlement.

  Parameters:

  • idOrPid (required) — string

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• extend_payment_request

  Extend an open payment request expiry (default extension window in days).

  Parameters:

  • idOrPid (required) — string
  • expiryDays (required) — number — New expiry horizon from now (1-365)

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• pay_payment_request_x402

  Pay an open FortFi invoice via x402 EIP-3009 from a governed Turnkey vault. Requires Delegated Access on human developer keys or an agent account. Base mainnet first.

  Parameters:

  • paymentRequestPid (required) — string — Public invoice pid from checkout URL or create_payment_request
  • fromWalletId (required) — string — Payer vault id (must match invoice chain)

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• list_payment_sales

  Merchant view: paid and partially paid invoices on your collection vaults (what you sold). Includes payer, method, and settlement details.

  Parameters:

  • walletMappingId — string — Optional collection vault filter

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• list_payment_purchases

  Buyer view: FortFi checkouts your vaults paid (what you bought). Matches settlements by payer wallet address across your fleet.

  Parameters:

  • limit — number — Max rows (default 200, max 500)
  • walletMappingId — string — Optional payer vault filter

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• create_payment_product

  Create a persistent product checkout link (/pay/p/{slug}). Each visit mints a fresh payment request. One webhook endpoint receives paid events for all products.

  Parameters:

  • walletMappingId (required) — string — USDC collection vault id
  • name (required) — string — Product display name
  • slug — string — Optional URL slug (auto-generated if omitted)
  • imageUrl — string — HTTPS product image URL for checkout branding
  • amountUsd — number — Price in USD/USDC
  • description — string — Checkout subtitle shown to buyers
  • merchantSiteUrl — string — Merchant homepage for checkout branding (optional)
  • amountSmallestUnit — string — Alternative: amount in token smallest units
  • successRedirectUrl — string — HTTPS buyer redirect after pay (optional)

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• list_payment_products

  List persistent product checkout links for the account.

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• get_payment_product

  Get a payment product by internal id or public slug.

  Parameters:

  • id — string
  • slug — string

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• create_merchant_webhook

  Register a webhook URL. FortFi generates a signing secret (returned once) for the merchant to verify HMAC on incoming POSTs. Not per-product — one endpoint receives all paid events.

  Parameters:

  • url (required) — string — HTTPS callback URL on the merchant's server
  • description — string

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• list_merchant_webhooks

  List registered webhook endpoints (secrets are never returned).

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• list_merchant_webhook_deliveries

  List webhook delivery log. Use status=failed for dead-letter queue rows. Filter by paymentRequestId to find deliveries for one checkout.

  Parameters:

  • limit — number — Max rows (default 50, max 200)
  • status — string
  • endpointId — string
  • paymentRequestId — string — Internal payment request UUID

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• replay_merchant_webhook_delivery

  Replay a dead-lettered or failed webhook delivery after fixing your endpoint. Re-sends the same event id and body for idempotent handlers.

  Parameters:

  • deliveryId (required) — string — Delivery row id from list_merchant_webhook_deliveries

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• send_merchant_webhook_test

  Send a signed webhook.test event to an endpoint.

  Parameters:

  • endpointId (required) — string

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• search_vaults

  Parent-treasury vault inventory search (treasury credential + keys:manage + wallets:read). Matches nicknames, wallet IDs, addresses, external customer IDs, credential names, and prefixes. Never returns raw bearer keys.

  Parameters:

  • limit — number — Page size (default 50, max 100)
  • query — string — Free-text search
  • cursor — string — Pagination cursor from prior response
  • chainId — string — Exact chain filter
  • metadataKey — string — Exact metadata key (requires metadataValue)
  • metadataValue — string — Exact metadata value (requires metadataKey)
  • credentialAccess — string — Filter by linked credential access mode
  • credentialStatus — string — Filter by linked credential status
  • externalCustomerId — string — Exact external customer id

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• search_credentials

  Parent-treasury key-centric credential search (treasury credential + keys:manage + wallets:read). Complements search_vaults. Never returns raw bearer keys.

  Parameters:

  • limit — number — Page size (default 50, max 100)
  • query — string — Free-text search
  • access — string
  • cursor — string — Pagination cursor
  • status — string
  • walletId — string — Filter by vault wallet id
  • metadataKey — string — Exact metadata key (requires metadataValue)
  • metadataValue — string — Exact metadata value (requires metadataKey)
  • credentialKind — string
  • externalCustomerId — string — Exact external customer id

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• create_vault_credential

  Mint a vault-scoped credential for an existing wallet (treasury + keys:manage). Returns bearerKey once when agentPublicKey is omitted. Requires FORTFI_VAULT_CREDENTIALS_ENABLED.

  Parameters:

  • name (required) — string — Credential label (2–100 chars)
  • access (required) — string
  • vaultGrants (required) — array — Explicit wallet grants with optional USD micro caps
  • expiresAt — string — ISO-8601 expiry (optional)
  • agentPublicKey — string — Optional uncompressed P-256 public key (04… hex) for ECDSA auth

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• update_vault_credential

  Atomically replace a vault credential's name, access mode, grants, and expiry (treasury + keys:manage). Revoked credentials cannot be updated.

  Parameters:

  • credentialId (required) — string — Vault credential id
  • name (required) — string
  • access (required) — string
  • vaultGrants (required) — array
  • expiresAt — string — ISO-8601 expiry, or null to clear

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• revoke_vault_credential

  Revoke a vault-scoped credential (treasury + keys:manage). Idempotent if already revoked.

  Parameters:

  • credentialId (required) — string — Vault credential id

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• create_provisioning_job

  Bulk-provision up to 20 customer vaults per job (treasury + keys:manage + wallets:write). Requires idempotencyKey in args. Poll get_provisioning_job until terminal; bearer secrets reveal once on first terminal GET.

  Parameters:

  • idempotencyKey (required) — string — Unique key (8–200 chars) — same key + body replays the job
  • items (required) — array — Up to 20 provisioning items

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• get_provisioning_job

  Poll a bulk provisioning job (treasury + keys:manage + wallets:read). bearerKey appears once when secretsDelivery is revealed.

  Parameters:

  • jobId (required) — string — Job id from create_provisioning_job

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

• create_customer

  Create or sync one customer vault synchronously (treasury + wallets:write). Idempotent on externalCustomerId + namespace + chain. Returns wallet address immediately; Turnkey wallet creation may take a few seconds on first call.

  Parameters:

  • clientRequestId (required) — string — Caller idempotency id (unique per provisioning attempt)
  • externalCustomerId (required) — string — Your platform customer id (stable across retries)
  • wallet (required) — object — Wallet to create or reuse for this customer
  • namespace — string — Optional mapping namespace (default: default)
  • credential — object — Optional vault-scoped credential to issue for this wallet

  Hints: read-only not declared · destructive not declared · idempotent not declared · open-world not declared

Publisher website Repository

Measured by MCPYP probing. Untested fields are omitted, never estimated. Listing is always free; MCPYP never proxies calls or stores user tokens.