FortFi Treasury MCP Server

Propose a Fusion+ or deBridge cross-chain swap. FortFi resolves chain-specific verified token contracts from sellSymbol/buySymbol; optional token addresses are mismatch assertions, never routing overrides. Inline quote by default, or use previewQuoteId for two-step review.

Create a new wallet on a supported chain. Optional metadata tags (e.g. customer_id). Then call confirm_proposal with the returned proposalId. Agent accounts execute server-side when no cosigners are configured.

Execute a validated payout manifest sequentially (one ActionIntent per line). Requires Delegated Access or agent wallet. Set dryRun:true to validate only.

Apply a validated recipient manifest (human/developer key). Adds new allowlist rows with normal 24h cooldown. Agent keys: use add_recipient per row (GOVERN).

Rename a wallet (account nickname), then call confirm_proposal with the returned proposalId.

Propose a Solana Jupiter swap. Autonomous agents: inline quote by default, or previewQuoteId for two-step review. confirm signs the bound quote.

Propose an EVM CoW swap. Autonomous agents: fetches and binds a quote inline (default), or pass previewQuoteId from preview_swap_quote for a two-step review. confirm always signs the bound quote — same principle as FortFi Assist. Human session MCP: confirm requires passkey in the app.

Propose max ERC-20 approval for CoW or Fusion spenders. Returns proposalId — call confirm_proposal before swap/bridge.

Transfer USDC to an allowlisted recipient. The recipient must be approved (no active cooldown). Rejected with POLICY_LIMIT_EXCEEDED if above tier limits. Rejected with RECIPIENT_NOT_APPROVED if in cooldown.

Propose Morpho vault deposit, then call confirm_proposal. With Delegated Access / agent key this executes server-side when policy permits. Use list_yield_markets for vaultAddress.

Propose Morpho vault withdraw, then call confirm_proposal. With Delegated Access this executes server-side when policy permits. Use list_yield_positions for vaultAddress.

Amount-banded cosigner quorum rules for sends and swaps. Below-band amounts auto-execute; matching bands require N cosigner votes.

Active co-signers on this account.

Remove an active co-signer from this account. GOVERN action (it shrinks the approver set): via an agent key, sign a challenge with your funding wallet (challengeId + walletSignature); applies immediately once signed.

Set cosigner quorum rules (send + swap USD bands). Tightening rules works with the agent key alone. WEAKENING them (lower required cosigners / raise the amount floor) is a GOVERN action: sign a challenge with your funding wallet (challengeId + walletSignature); applies immediately once signed (same as passkey in the UI). Amounts use USDC micro-units (1 USDC = 1000000).

Veto/cancel a pending governance challenge before it is signed and applied. Cancelling TIGHTENS security, so it needs only the agent key (no signature). Also cancels legacy scheduled rows from before immediate-apply parity.

Cancel an open payment request with no verified settlement.

Cancel a pending approval that you (the account owner) initiated.

Create a shareable payment request for a vault. Returns pid, paymentUrl, and qrPayload for humans or agents.

Get a payment request by internal id or public pid, including settlement attempts.

List payment requests for the authenticated account.

Evidence for one Morpho vault: current net APY/TVL, historical APY and TVL series, period averages/volatility/drawdown, quality flags, allocation, separated eligibility/readiness status, and timestamp. Use before recommending or proposing a deposit.

Open Morpho yield discovery by chain with discovered, policyEligible, manuallyCurated, executionReady, and eligibilityReasons. Default minimum TVL is $500K everywhere (listing, policy, Turnkey). executionReady means TVL qualifies and you have a wallet on that chain; POLICY_SYNC_RECOMMENDED is advisory only.

User's Morpho yield positions from FortFi history.

Approve a pending action as co-signer. Use with list_pending_cosigner_approvals.

Approve a recipient still in cooldown (early release). A distinct active cosigner may approve directly; owner self-approval via an agent key is a GOVERN action requiring a funding-wallet signature (challengeId + walletSignature).

Invite a co-signer. Agents: pass cosignerUserId (GOVERN / funding-wallet sign when using an agent API key). Humans: pass email — opens instructions for Security UI passkey provision (Turnkey dual-control with MCP DA).

Alias of invite_agent_cosigner. Humans: email → Security UI. Agents: cosignerUserId.

Optional advanced step: fetch a cross-chain bridge quote (Fusion+ or deBridge) and return previewQuoteId. Omit previewQuoteId on propose_bridge to bundle quote+proposal in one call.

Optional advanced step: fetch a same-chain swap quote (CoW on EVM, Jupiter on Solana) and return previewQuoteId. Omit previewQuoteId on propose_* to bundle quote+proposal in one call. Does not execute or move funds.

Bulk-provision up to 20 customer vaults per job (treasury + keys:manage + wallets:write). Requires idempotencyKey in args. Poll get_provisioning_job until terminal; bearer secrets reveal once on first terminal GET.

Poll a bulk provisioning job (treasury + keys:manage + wallets:read). bearerKey appears once when secretsDelivery is revealed.

Two-stage token ranking: run the cheap screen, then concurrently fetch deterministic chart evidence only for the strongest candidates. Quick charts 5 candidates over month+3months; standard charts 10 over day+month+3months+year; deep charts 20 and requires explicit opt-in. Returns evidence for user review and never creates a proposal.

Batch-rank Morpho markets using current net APY, APY average/range/volatility, TVL trend/drawdown, vault age, curation, warnings, and current-user execution eligibility. Runs evidence requests concurrently and never creates a proposal.

Add a payout address to the allowlist. Human developer key (frtfi_hu_* + DA): added with 24h cooldown (no Assist passkey). Agent key (frtfi_ag_*): GOVERN — funding-wallet signature required; then approved immediately.

Remove a recipient from the FortFi allowlist (tightening policy — no funding-wallet GOVERN). Human developer key, session, or agent treasury key. Re-sync Turnkey policies in the app so the enclave matches.

Revoke a pending outbound co-signer invite before it is accepted.

Revoke a vault-scoped credential (treasury + keys:manage). Idempotent if already revoked.

Fetch a compact Zerion chart summary plus deterministic EMA, RSI, MACD, Bollinger, return, max-drawdown, and data-quality analysis. Raw points are omitted by default; set includePoints:true only for visual charting or external analysis. Discontinuous pre-migration/launch samples are excluded from TA.

List active ERC-20 token approvals (spender grants) on this account. Useful before proposing a swap to confirm the CoW vault is approved.

Preview batch payroll/payout (max 50 lines). Each line: { recipientId, amountUsdc, memo? }. All recipients must be allowlisted, same chain as fromWalletId, and past cooldown.

Preview a batch recipient import (max 50 rows). Each row: { address, chainId, nickname? }. Returns ready_new, already_exists, or invalid per line. Read-only.

Mint a vault-scoped credential for an existing wallet (treasury + keys:manage). Returns bearerKey once when agentPublicKey is omitted. Requires FORTFI_VAULT_CREDENTIALS_ENABLED.

Atomically replace a vault credential's name, access mode, grants, and expiry (treasury + keys:manage). Revoked credentials cannot be updated.

Accept a pending co-signer invite. After accepting, you will be able to approve/reject pending actions for that account.

Token holdings for a specific wallet, with USD values and 24h change.

Recent account activity: transfers, swaps, security events.

Remove the registered backup governance wallet. GOVERN action: sign with your funding wallet (challengeId + walletSignature); applies immediately once signed. After removal, only the funding wallet may authorize governance.

Confirm a pending proposal returned by a propose_* tool. Reuses the same policy, risk, allowlist, vault-grant, delegated-authority, and cosign checks as POST /api/mcp/confirm. Returns executed, pending-approval, or passkey-required status.

Parent-treasury key-centric credential search (treasury credential + keys:manage + wallets:read). Complements search_vaults. Never returns raw bearer keys.

Market-wide token discovery on a FortFi chain (USD). Use for trending/gainers/losers/volume/mcap — NOT the browser Explore REST route. Sorts: gainers_1d, gainers_30d, gainers_90d, gainers_365d, losers_1d, losers_30d, losers_90d, losers_365d, market_cap, volume_1d. No 7d or 30d-volume sort exists upstream — closest available gainers granularity to '1 week' is gainers_1d or gainers_30d; say so explicitly rather than silently picking one. Returns contract addresses for propose_swap / propose_bridge.

Extend an open payment request expiry (default extension window in days).

List all FortFi agent accounts funded by the same payment wallet as this agent. Use to discover agentLabel / userId when renewing or spawning siblings (treasury multi-agent setups).

Track an owned Fusion+ cross-chain order by orderHash. Returns authoritative settlement/refund status, source and destination transactions, receiver, and the real destination token contract.

List open governance requests on this account: pending (awaiting signature) and legacy scheduled rows. Use to monitor for unexpected loosening attempts.

List pending co-signer invites sent TO this account (where this account is the invitee). Use to discover accounts you can become a co-signer for.

FortFi MCP capability guide: onboarding paths, pricing, limits, workflows, and full tool catalog. Call first when unsure which tool to use (e.g. market research → discover_tokens, not the Explore UI REST route).

Pending actions that require this account's co-signer approval. Use when this agent is a co-signer on another account.

Read-only rebalance planner toward target weights. Returns suggested legs (swap, yield_deposit, yield_withdraw) without executing. Use propose_* + confirm_proposal to act.

Current policy limits: per-tx/daily/monthly caps (USDC smallest units). Agent accounts include billingPlan (personal|startup), billingPlanName, maxWallets, tier, and subscription expiry.

Full portfolio summary across all wallets: token balances with USD values, 24h change, and total net worth.

List all allowlisted recipients. Includes cooldown status: `cooldownActive: true` means the recipient cannot yet receive funds (24-hour gate).

Register (or replace) a single backup governance wallet — the agentic equivalent of a backup passkey. Either the funding wallet or this backup can authorize future governance. GOVERN action: sign the challenge with your CURRENT funding wallet (challengeId + walletSignature); applies immediately once signed. Max one backup.

Reject a pending action as co-signer.

Resend the dashboard claim email to contactEmail (MCP agent API key only; keys:manage scope). Use when the original link expired (72h) or was lost. Rate limit: 3/hour.

Read-only treasury review: allocation buckets (cash, yield, tokens), top holdings, and optional drift vs target weights. Safe for cron — no proposals created.

Batch cheap-screen tokens across requested chains. Defaults to verified assets, $5M market cap, $50K daily volume, top 30-day performers plus volume leaders, stablecoin removal, and cross-chain deduplication. Returns no proposal.

Returns which swap/bridge tool to use for a given from→to chain pair, with notes on protocols supported.

Check ERC-20 allowance for an upcoming CoW swap (cow_swap) or Fusion bridge (fusion_bridge). Call before propose_swap / propose_bridge; if insufficient, use propose_token_approve then confirm.

Parent-treasury vault inventory search (treasury credential + keys:manage + wallets:read). Matches nicknames, wallet IDs, addresses, external customer IDs, credential names, and prefixes. Never returns raw bearer keys.

Set metadata tags on a wallet (flat string key/value pairs; replaces existing tags). Not a money-moving action.

List FortFi wallets for this account: chain, address, nickname, metadata tags, and default flag. Optional metadataKey/metadataValue filter (exact match).