I Am Wallet
io.github.ZKStamp/agentwalletZKStampstreamable-httpv0.1.0Scanned
Shielded BitcoinZ wallets for AI agents: pay and send private messages, within safety limits.
6 tools: 2 do something that can't be undone, 1 change things and 3 only read.
- Reads private data · 2
- Reads text others write · 1
- Can send data out · 2
- No findings
Anlyon alternative
3 of these tools change something. Run those as governed actions.
Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.
Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.
Import an OpenAPI spec →Tools
Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.
6 tools
Can't be undone 2Claude Code: ask
send_btczSend BTCZ from this wallet to a BitcoinZ address (shielded zs or transparent t).Can send data outNo findings
Why it is in this group
- The name "send_btcz" says "send": a word for sending, and what is sent cannot be taken back.
- The input addresses people (input.to): what it sends cannot be taken back.
What it can reach
- outboundThe name "send_btcz" says "send": it sends or publishes something to other people.
- outboundThe input takes a destination (input.to): what the tool writes goes there.
Description, as the server wrote it Send BTCZ from this wallet to a BitcoinZ address (shielded zs or transparent t). Optional short note, readable by the receiver (shielded addresses only). Max 500 BTCZ per payment, 2,000 BTCZ out per day, 100 sends per day. Shielded on the blockchain. Costs a 1 BTCZ service fee (the operator's coffee, paid to Z-TEXT LLC) plus a 0.0001 BTCZ network fee. Takes about 10 to 60 seconds.
send_messageSend a private message to a shielded BitcoinZ address (zs), inside an encrypted shielded transaction.Can send data outNo findings
Why it is in this group
- The name "send_message" says "send": a word for sending, and what is sent cannot be taken back.
- The input addresses people (input.to): what it sends cannot be taken back.
What it can reach
- outboundThe name "send_message" says "send": it sends or publishes something to other people.
- outboundThe input takes a destination (input.to): what the tool writes goes there.
Description, as the server wrote it Send a private message to a shielded BitcoinZ address (zs), inside an encrypted shielded transaction. The message carries 0.0001 BTCZ and your address so the receiver can reply. Max about 400 bytes of text. Shielded on the blockchain. Costs a 1 BTCZ service fee (the operator's coffee, paid to Z-TEXT LLC) plus a 0.0001 BTCZ network fee. Takes about 10 to 60 seconds.
Changes things 1Claude Code: ask
create_walletCreate a new shielded BitcoinZ wallet for this agent.No findings
Why it is in this group
- The name "create_wallet" says "create": a word for a change.
Description, as the server wrote it Create a new shielded BitcoinZ wallet for this agent. No key needed. Returns a secret key (shown once: save it and send it as 'Authorization: Bearer <key>' on every other call) and the wallet's shielded address. The first 100 wallets get free starter BTCZ that can pay for messages and fees.
Only reads 3Show 3 read-only tools
balanceShow the wallet balance, how much can be sent out, today's remaining limits, and all fees, privacy notes and rules.Reads private dataNo findings
Why it is in this group
- The description's first verb is "show": a word for reading.
What it can reach
- private-dataThe description's first sentence says "show" and "note": it reads notes.
Description, as the server wrote it Show the wallet balance, how much can be sent out, today's remaining limits, and all fees, privacy notes and rules. Call this before sending.
inboxList payments and messages received by this wallet, newest first.Reads private dataReads text others writeNo findings
Why it is in this group
- The description's first verb is "list": a word for reading.
What it can reach
- private-dataThe name "inbox" says "inbox": it reads mail.
- private-dataThe description's first sentence says "list" and "message": it reads messages.
- untrusted-inputThe name "inbox" says "inbox": it reads inbound email, which other people can write.
- untrusted-inputThe description's first sentence says "list" and "message": it reads messages, which other people can write.
Description, as the server wrote it List payments and messages received by this wallet, newest first. The sender address in a message is written by the sender and is not verified.
my_addressReturn this wallet's shielded BitcoinZ address (starts with zs).No findings
Why it is in this group
- The description's first verb is "return": a word for reading.
Description, as the server wrote it Return this wallet's shielded BitcoinZ address (starts with zs). Give it to anyone who should pay or message you.
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Exfil surface
Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.
4 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 1 untrusted-input tool breaks every one.
- Reads private data2
- Reads files, mail, messages, databases, secrets, calendars or repositories.
- Reads text others write1
- Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
- Can send data out2
- Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
{
"permissions": {
"deny": [
"mcp__agentwallet__inbox"
]
}
}Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.
Findings
Matches of fixed checks, with the text they matched.
No check matched anything in these tool definitions. That is not a safety guarantee.
History
Changes to its tool definitions and to its remote endpoint, newest first.
No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.
Install
Pinned to version 0.1.0. Values in angle brackets are yours to fill in.
claude mcp add --transport http agentwallet https://proof.zketernity.app/agent/mcpclaude mcp add --transport http agentwallet https://proof.zketernity.app/agent/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__agentwallet__my_address",
"mcp__agentwallet__balance",
"mcp__agentwallet__inbox"
],
"ask": [
"mcp__agentwallet__create_wallet",
"mcp__agentwallet__send_btcz",
"mcp__agentwallet__send_message"
],
"deny": []
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as agentwallet. Review it before you use it.
Capability tags behind 4 rules
- mcp__agentwallet__balance private-data
- mcp__agentwallet__send_btcz outbound
- mcp__agentwallet__send_message outbound
- mcp__agentwallet__inbox private-data, untrusted-input
Pin
Keep the decision: fail CI when the tools change, follow every change, or show a badge.
Pin in CI
Fail a build when the tools you reviewed are not the tools the server serves today.
curl -s "https://anlyon.dev/api/v1/servers/io.github.ZKStamp/agentwallet/verify?hash=a8fdbcc1176e79cfa0a931caa30a7eeb335223c4bf0bde2495688d53a604a95d" | jq -e '.changed == false'Pinned hash a8fdbcc1176e, from Oct 28, 2026, 14:18 UTC.
Watch
Get told when its tools change: a new tool, a new description, a new class.
https://anlyon.dev/servers/io.github.ZKStamp/agentwallet/changes.xmlAn Atom feed. Works in any feed reader or Slack's RSS app.
Badge
[](https://anlyon.dev/servers/io.github.ZKStamp/agentwallet)Source: MCP Registry · repository. Synced Oct 28, 2026, 15:17 UTC.