FortFi Treasury MCP

FortFi MCP capability guide: onboarding paths, pricing, limits, workflows, and full tool catalog. Call first when unsure which tool to use (e.g. market research → discover_tokens, not the Explore UI REST route).

List FortFi wallets for this account: chain, address, nickname, metadata tags, and default flag. Optional metadataKey/metadataValue filter (exact match).

List all allowlisted recipients. Includes cooldown status: `cooldownActive: true` means the recipient cannot yet receive funds (24-hour gate).

Recent account activity: transfers, swaps, security events.

Current policy limits: per-tx/daily/monthly caps (USDC smallest units). Agent accounts include billingPlan (personal|startup), billingPlanName, maxWallets, tier, and subscription expiry.

Resend the dashboard claim email to contactEmail (MCP agent API key only; keys:manage scope). Use when the original link expired (72h) or was lost. Rate limit: 3/hour.

List all FortFi agent accounts funded by the same payment wallet as this agent. Use to discover agentLabel / userId when renewing or spawning siblings (treasury multi-agent setups).

Active co-signers on this account.

Amount-banded cosigner quorum rules for sends and swaps. Below-band amounts auto-execute; matching bands require N cosigner votes.

Set cosigner quorum rules (send + swap USD bands). Tightening rules works with the agent key alone. WEAKENING them (lower required cosigners / raise the amount floor) is a GOVERN action: sign a challenge with your funding wallet (challengeId + walletSignature); applies immediately once signed (same

Pending actions that require this account's co-signer approval. Use when this agent is a co-signer on another account.

Add a payout address to the allowlist. Human developer key (frtfi_hu_* + DA): added with 24h cooldown (no Assist passkey). Agent key (frtfi_ag_*): GOVERN — funding-wallet signature required; then approved immediately.

Remove a recipient from the FortFi allowlist (tightening policy — no funding-wallet GOVERN). Human developer key, session, or agent treasury key. Re-sync Turnkey policies in the app so the enclave matches.

Approve a recipient still in cooldown (early release). A distinct active cosigner may approve directly; owner self-approval via an agent key is a GOVERN action requiring a funding-wallet signature (challengeId + walletSignature).

Transfer USDC to an allowlisted recipient. The recipient must be approved (no active cooldown). Rejected with POLICY_LIMIT_EXCEEDED if above tier limits. Rejected with RECIPIENT_NOT_APPROVED if in cooldown.

Invite a co-signer. Agents: pass cosignerUserId (GOVERN / funding-wallet sign when using an agent API key). Humans: pass email — opens instructions for Security UI passkey provision (Turnkey dual-control with MCP DA).

Alias of invite_agent_cosigner. Humans: email → Security UI. Agents: cosignerUserId.

Approve a pending action as co-signer. Use with list_pending_cosigner_approvals.

Reject a pending action as co-signer.

Full portfolio summary across all wallets: token balances with USD values, 24h change, and total net worth.

Token holdings for a specific wallet, with USD values and 24h change.

Market-wide token discovery on a FortFi chain (USD). Use for trending/gainers/volume/mcap — NOT the browser Explore REST route. Sorts: gainers_1d, gainers_30d, gainers_90d, market_cap, volume_1d. Returns contract addresses for propose_swap / propose_bridge.

Returns which swap/bridge tool to use for a given from→to chain pair, with notes on protocols supported.

List active ERC-20 token approvals (spender grants) on this account. Useful before proposing a swap to confirm the CoW vault is approved.

List pending co-signer invites sent TO this account (where this account is the invitee). Use to discover accounts you can become a co-signer for.

Accept a pending co-signer invite. After accepting, you will be able to approve/reject pending actions for that account.

Remove an active co-signer from this account. GOVERN action (it shrinks the approver set): via an agent key, sign a challenge with your funding wallet (challengeId + walletSignature); applies immediately once signed.

Register (or replace) a single backup governance wallet — the agentic equivalent of a backup passkey. Either the funding wallet or this backup can authorize future governance. GOVERN action: sign the challenge with your CURRENT funding wallet (challengeId + walletSignature); applies immediately once

Remove the registered backup governance wallet. GOVERN action: sign with your funding wallet (challengeId + walletSignature); applies immediately once signed. After removal, only the funding wallet may authorize governance.

List open governance requests on this account: pending (awaiting signature) and legacy scheduled rows. Use to monitor for unexpected loosening attempts.

Veto/cancel a pending governance challenge before it is signed and applied. Cancelling TIGHTENS security, so it needs only the agent key (no signature). Also cancels legacy scheduled rows from before immediate-apply parity.

Revoke a pending outbound co-signer invite before it is accepted.

Cancel a pending approval that you (the account owner) initiated.

Rename a wallet (account nickname). Confirm via POST /api/mcp/confirm with the returned proposalId.

Create a new wallet on a supported chain. Optional metadata tags (e.g. customer_id). Confirm via POST /api/mcp/confirm. Agent accounts execute server-side when no cosigners are configured.

Set metadata tags on a wallet (flat string key/value pairs; replaces existing tags). Not a money-moving action.

Optional advanced step: fetch a same-chain swap quote (CoW on EVM, Jupiter on Solana) and return previewQuoteId. Omit previewQuoteId on propose_* to bundle quote+proposal in one call. Does not execute or move funds.

Optional advanced step: fetch a cross-chain bridge quote (Fusion+ or deBridge) and return previewQuoteId. Omit previewQuoteId on propose_bridge to bundle quote+proposal in one call.

Check ERC-20 allowance for an upcoming CoW swap (cow_swap) or Fusion bridge (fusion_bridge). Call before propose_swap / propose_bridge; if insufficient, use propose_token_approve then confirm.

Propose max ERC-20 approval for CoW or Fusion spenders. Returns proposalId — confirm via POST /api/mcp/confirm before swap/bridge.

Propose an EVM CoW swap. Autonomous agents: fetches and binds a quote inline (default), or pass previewQuoteId from preview_swap_quote for a two-step review. confirm always signs the bound quote — same principle as FortFi Assist. Human session MCP: confirm requires passkey in the app.

Propose a Solana Jupiter swap. Autonomous agents: inline quote by default, or previewQuoteId for two-step review. confirm signs the bound quote.

Propose a Fusion+ or deBridge transfer. Autonomous agents: inline quote by default, or previewQuoteId from preview_bridge_quote for two-step review.

Open Morpho yield discovery by chain — APY, TVL (not limited to curated allowlist). Default: sort by net APY, min TVL $1M. Pass verifiedOnly:true for curated-only. Use before propose_yield_deposit.

User's Morpho yield positions from FortFi history.

Propose Morpho vault deposit. Confirm via POST /api/mcp/confirm — with Delegated Access / agent key this executes server-side (no Assist passkey). Use list_yield_markets for vaultAddress.

Propose Morpho vault withdraw. Confirm via POST /api/mcp/confirm — with Delegated Access executes server-side (no Assist passkey). Use list_yield_positions for vaultAddress.

Create a shareable payment request for a vault. Returns pid, paymentUrl, and qrPayload for humans or agents.

Get a payment request by internal id or public pid, including settlement attempts.

List payment requests for the authenticated account.

Cancel an open payment request with no verified settlement.

Extend an open payment request expiry (default extension window in days).

Parent-treasury vault inventory search (treasury credential + keys:manage + wallets:read). Matches nicknames, wallet IDs, addresses, external customer IDs, credential names, and prefixes. Never returns raw bearer keys.

Parent-treasury key-centric credential search (treasury credential + keys:manage + wallets:read). Complements search_vaults. Never returns raw bearer keys.

Mint a vault-scoped credential for an existing wallet (treasury + keys:manage). Returns bearerKey once when agentPublicKey is omitted. Requires FORTFI_VAULT_CREDENTIALS_ENABLED.

Atomically replace a vault credential's name, access mode, grants, and expiry (treasury + keys:manage). Revoked credentials cannot be updated.

Revoke a vault-scoped credential (treasury + keys:manage). Idempotent if already revoked.

Bulk-provision up to 20 customer vaults per job (treasury + keys:manage + wallets:write). Requires idempotencyKey in args. Poll get_provisioning_job until terminal; bearer secrets reveal once on first terminal GET.

Poll a bulk provisioning job (treasury + keys:manage + wallets:read). bearerKey appears once when secretsDelivery is revealed.