Madhouse Wallet MCP

The problem

AI agents are starting to execute real-world tasks, and payments are the obvious next step — pay this invoice, settle this contributor, refund this customer. The question isn't whether agents will move money; it's whether the tool layer they use is built by people who think adversarially about it.

Madhouse Wallet MCP is a Model Context Protocol server exposing USDC payout operations — transfers, balance queries, recipient management — as typed tools any MCP-compatible assistant can call.

Design decisions

• Tools are narrow on purpose. There is no execute_arbitrary_transaction tool. Each tool does one auditable thing with explicit, validated parameters. An LLM holding a footgun will eventually fire it; the fix is to not hand it one.
• Human-readable confirmation surfaces. Tool results return amounts, recipients, and fees in plain language so the assistant can show the user exactly what's about to happen before anything irreversible does.
• Idempotency keys on every mutation. Agents retry. Networks fail mid-call. Every payout call carries a client-generated idempotency key so a retried tool call can never become a double-spend.
• Spending boundaries live server-side. Limits, allowlists, and rate caps are enforced in the server, not in the prompt. A jailbroken model can't talk its way past a config file.

My role

Sole author. I built it open source because the pattern — financially consequential MCP tools designed with a security engineer's assumptions — matters more than the specific wallet behind it. The repository is the reference implementation of how I think this layer should be built.

Outcomes

• Open source under MIT at GideonDevRel/Madhouse-Wallet-MCP.
• Used as the working example in my KCA University lectures on agent-payment security — the tool definitions double as a syllabus on what can go wrong.