Hosted MCP
Connect an agent to Walletguide at api.walletguide.com/mcp over OAuth, with no local process and no API key.
One URL, and your browser does the signing in.
https://api.walletguide.com/mcpAdd it as a remote MCP server in whatever client you use. It will discover the authorization server, register itself, and open a browser for you to approve. Nothing to install, no key to store, and you can withdraw the grant later without touching the client.
Claude Code
claude mcp add --transport http walletguide https://api.walletguide.com/mcpWhat you are approving
The consent screen lists the scopes the client asked for. Two matter:
walletguide:readreads everything in the wallets you can reachwalletguide:writecreates, changes and deletes
Untick write and you get a read-only session, with the mutating tools absent rather than present and refused. For an agent you are pointing at your own finances to answer questions, that is the setting you want.
How it works underneath
The endpoint speaks streamable HTTP, and builds a fresh server per request rather than holding session state. A tool call is dispatched back through the real REST route in-process, so it gets exactly the validation and the authorisation an external caller gets. There is no faster path around the checks, deliberately.
The token is minted for the audience https://api.walletguide.com/mcp, which the REST routes refuse. So a client that holds an MCP grant cannot turn round and use it against /wallets/*, even though the same person approved the same application. See authentication.
Which wallet
An OAuth grant can reach several, so tools take a walletId. Call wallets_list first, or tell the agent which one to use.
Standards
RFC 8414 and RFC 9728 for discovery, RFC 8707 for the resource indicator, PKCE on every flow, and dynamic client registration so a client can register itself. If your client implements the MCP authorization spec, it will work without configuration.