MCP Server
Connect an AI assistant to your ether.fi Cash account. Read-only, scope by scope, approved with your passkey.
Coming soon. The ether.fi Cash MCP server is not yet available to the public. This page describes the connector ahead of its release.
ether.fi Cash exposes an MCP server that lets an AI assistant read your account: your transactions, your cards, your balances and holdings. Ask Claude or ChatGPT what you spent on groceries last month, or what your spending power is today.
The connector URL is:
https://mcp.ether.fi/mcpThe connector is read-only. There is no write path anywhere in the system, so no assistant can spend, borrow, repay, withdraw, or change your cards through it.
Supported assistants are limited to a registry ether.fi maintains. Today that is Anthropic (Claude, including Claude Code) and OpenAI (ChatGPT).
1. Connecting an assistant
Open Settings → AI Connections in the Cash app to copy the connector URL and manage your connections.
Copy the URL. One connector covers every Cash account you hold.
Add it in your assistant. Open its settings and look for connectors, apps, or plugins, then add one by URL and paste.
Approve with your passkey. You return to the Cash app to pick an account and choose what the assistant can read.
2. What an assistant can read
Access is split into three scopes. All three default to off, and you choose which to grant when you approve.
transactions:read
Your transactions and merchants
Card purchases and on-chain activity: merchant, amount, date, category. Includes top-ups, withdrawals, borrows, repayments, and cashback.
cards:read
Your cards
Card nickname, network, and last four digits. Never the full number, CVC, or expiry.
balances:read
Your balances, holdings, and vault address
Available balance, credit limit, amount borrowed, and the assets in your vault with quantity and dollar value. Includes your vault address.
Your vault address is a permanent public identifier. Anyone holding it can look up all of the account's on-chain activity, including after you revoke the connection.
Five tools sit behind those scopes. A tool only exists for an assistant whose grant carries the matching scope.
list_transactions
transactions:read
Card and on-chain activity, filterable by date, category, and merchant
list_cards
cards:read
Nickname, type, last four digits, status, currency
get_main_account
balances:read
Spending power, credit limit, amount borrowed, vault address
get_portfolio
balances:read
Per-asset holdings: quantity, dollar value, whether it backs spending, yield
get_deposit_address
balances:read
Deposit address and the networks and assets it accepts
3. What an assistant cannot do
Four boundaries hold at every scope, for every assistant.
No writes. No spending, borrowing, repaying, withdrawing, or card management. A write scope would be a different threat model, so none exists.
No card secrets. The full card number, CVC, and expiry are not readable through the connector at any scope. list_cards returns the same fields the app's card list shows without stepping up authentication.
No choosing an account. The account is never a tool parameter. It lives inside the signed token issued for the connection and is re-derived on every request. One connection reads exactly one account, and an assistant cannot ask for a different one.
No figures ether.fi did not compute. There is no spending-total tool. Every number the connector returns is one your own app screen also shows, so anything an assistant quotes can be checked against a row you can open. Totals are the assistant's arithmetic over transactions you can see.
4. Consent
Every connection is approved on an ether.fi screen, in your browser, with a passkey. On it you:
Pick the account. If you hold more than one, they are labelled distinctly.
Choose the scopes. Switches default to off. Granting nothing is a valid outcome.
See existing connections. If that assistant is already connected to that account, approving adds a second connection rather than replacing the first.
Prove presence with a passkey. That signature binds the grant to you and to the account you picked.
Everything the screen says about who is asking comes from ether.fi's own registry: name, icon, developer, and verified legal entity are all fields ether.fi controls. None of it comes from what the client asserts about itself, because a name a client picks is a name an attacker can pick. This is what makes consent phishing survivable, and it is why the screen also shows where you will be returned to.
One grant covers one assistant on one account. Connecting the same assistant to a second account creates a second grant with its own scopes.
5. Lifetime and revocation
A grant lives for 90 days. Within that window the assistant holds a one-hour access token and quietly renews it, so you are not asked to re-approve hourly.
Connections are listed under Settings → AI Connections with the account each one reads, the scopes it holds, and when it expires. Disconnect sits on every connection behind one confirmation, and takes effect on the assistant's next request. Access is re-checked on every read, so revocation never waits for a token to expire.
You only re-approve when a grant hits its 90-day expiry or you disconnect it.
6. How it works
Two things about that split are worth naming. The connector never mints tokens: it serves the MCP transport and forwards the OAuth endpoints, while the Cash backend is the authorization server and signs tokens with keys held in a KMS. And account reads never cross the public internet, because the routes the connector calls are reachable only from inside ether.fi's own network.
Further reading
Technical Documentation, how Cash accounts, vaults, and settlement work
🔒 Vault, the non-custodial key and ownership model behind your account
Model Context Protocol, the open standard the connector implements
Last updated