Every AI-initiated  Solana spend:
gated, capped, confirmed on chain.

The problem

An MCP server that can move money hands the model a signing key

The assistant decides, and the transaction is on chain before a human reads about it.

Nothing in the protocol makes the model pause. Nothing bounds what one misunderstood instruction can spend.

The mechanism

Seven stages between an instruction and a signature

Every write goes through this, in order. The model cannot skip a stage — only you can, explicitly, in configuration.

• Hard caps: 0.1 SOL per transaction, 1.0 SOL per session — by default.
• Writes are mainnet-only; the default network is devnet, so an unconfigured install cannot spend real money.
• If the RPC cluster disagrees with BAGS_NETWORK, the server refuses to start.

The gate, live

The first call to a write tool signs nothing

⚠️  CONFIRMATION REQUIRED — nothing has been signed or sent.

Action:  Swap 0.05 of So1111…1112
         for       EkJuyY…dBAGS
         expect    4823917722 (min 4679199990)
         slippage  3%
         network   🔴 MAINNET — real funds

Spend:   0.05 SOL
Caps:    0.1 SOL/tx · 0/1 SOL used this session

To execute, call bags_execute_trade again with the identical arguments plus:
  confirm: "kR3nT9xQm2vP"

Why that token is safe

Fingerprinted, single-use, five minutes

• Fingerprinted to the exact arguments. A token issued for a 0.01 SOL swap cannot authorize a 10 SOL one.
• Expires in 5 minutes and is consumed on every outcome, so it cannot be replayed.
• Confirmed means on chain. Success comes with a real signature and explorer link — never a success message for a transaction that did not land.

What ships

14 tools, and the numbers behind them

The honest slide

v1.x claimed success for transactions that never existed

The whole thesis of this product is not overclaiming. So:

Install

One command, or one config block

# anywhere
npx bagos-mcp-server

# Claude Code
claude mcp add bagos --env BAGS_API_KEY=your-key-here -- npx -y bagos-mcp-server

A Bags API key from dev.bags.fm enables the read tools. Writes stay off until you configure mainnet, a keypair, and the gating token.