--- name: keyban-admin description: Act for the signed-in Keyban user through the hosted Keyban admin MCP, and walk a new user from their fresh account to an installed agent wallet MCP. Use when an assistant is connected to the Keyban admin MCP, or when the user wants to set up, configure or inspect anything in their Keyban organization, from applications and agent wallets with their spending policies to the x402 catalogue, webhooks and quotas. --- # Keyban admin MCP The Keyban admin MCP is hosted at `https://mcp.keyban.io/mcp` (OAuth 2.1). It acts as the signed-in Keyban user, inside the one organization chosen at sign-in: every tool call runs with that user's rights, in that organization, and shows under their name in the audit log. It manages the organization and its applications, agent wallets with their spending policies and destination rules, the x402 service catalogue, webhooks, events and quotas. It never spends and never approves a payment. Money moves through the separate agent wallet MCP (`npx -y @keyban/cli@latest mcp`), installed per wallet from the dashboard, which this guide hands over to once the wallet exists. Tools are written `server:tool` with the default server names: `keyban` for this server, `agent-wallet` for the agent wallet MCP. If the user gave the servers other names, use theirs. ## The two guides - `keyban:get_instructions` returns this guide. With `skill: "keyban-agent-wallet"` it returns the agent wallet guide, which matters before that server is installed. - `agent-wallet:get_instructions` returns the agent wallet guide from the agent wallet MCP itself. - Published copies: https://docs.keyban.io/.well-known/agent-skills/keyban-admin/SKILL.md and https://docs.keyban.io/.well-known/agent-skills/keyban-agent-wallet/SKILL.md - Connecting this server to a client: https://docs.keyban.io/reference/set-up-mcp-server ## Working with this server - Identifiers are UUIDs. Resolve an application from its name with `keyban:lookup_application_id` before an application-scoped tool; when several applications match, the server asks the user to pick one. - Lists are paginated: send `currentPage` and `pageSize`, read `data` and `total`. - Two values are write-once: the organization's display currency (`preferredCurrency`) and an application's `network`. State the exact value and get the user's yes before each write. - A tool that deletes, sends, certifies or publishes acts for real in the user's organization: restate what it will do and get a yes first. - No tool here needs a secret from the user. API keys, invite keys and wallet configurations are handed out by the dashboard, never through the conversation. ## From a new account to a working agent wallet The user has created their Keyban account (there is a free plan at https://www.keyban.io/en/pricing/agent-wallet/) and connected this server. Do the steps in order. A **human** step needs the user in a browser: give the exact link and wait for them to confirm. 1. **Currency and network — agent, after confirmation.** Both values are write-once: state the exact value and get the user's yes before each write. - Display currency of the organization: `keyban:update_organization`, `preferredCurrency` (`EUR`, `USD` or `JPY`). - Network of the application: `keyban:update_application`, `network` — `BaseMainnet` or `XdcMainnet` for real funds, `BaseSepolia` for tests. `keyban:create_application` does not take a network. The plan already created a first application: find it with `keyban:list_applications`. 2. **Create the wallet — agent.** `keyban:create_wallet` with the application, a label, the application's network and a `policy`. Policy amounts are integer strings in the smallest unit of the policy `currency` (`"5000"` is 50.00 EUR). Always set `maxAmountPerMonthRef`, and set `requireHumanAboveRef` to the amount above which the user wants to approve each payment. Ask the user for every amount and confirm them before the call: never pick a limit yourself. 3. **Destination rules and shared budgets — agent, optional.** To limit where money can go: `keyban:set_wallet_destination_rule`, or the `application` and `organization` variants. Rules at all three scopes apply together. To cap what every wallet of an application or organization spends together per day, week or month: `keyban:set_application_shared_budget` or `keyban:set_organization_shared_budget`. Ask the user for every amount: never pick a limit yourself. 4. **Install the agent wallet MCP — human.** This server cannot do this step: the configuration carries the wallet's keys, and no MCP tool hands it out. Send the user to `https://admin.keyban.io/app//agent-wallets/wallets/?mcp=1`: the dialog asks which agent will use the wallet and guides the install for it — a `.mcpb` bundle for Claude Desktop, a message to paste into a new conversation of a chat agent, or a configuration file for an agent on a server or an AgentCore runtime. **Never ask for that configuration or any of its values in this conversation**: it holds the wallet's API key and a one-shot invite key. 5. **Hand over to the agent wallet MCP.** Once the client is back, check the connection with `agent-wallet:get_account_info`, then follow the agent wallet guide (`agent-wallet:get_instructions`) for funding, payments and approvals. From here on, this server serves to change the wallet's policy and destination rules, and to read what the organization holds. An existing wallet shows its state through `keyban:list_wallets` and `keyban:get_wallet`; the same wallet page (`?mcp=1`) reinstalls its MCP on another machine. ## Prepaid organization Only when `keyban:get_organization` reports `agentWalletMode: "prepaid"`; otherwise skip this section. The agents of such an organization have accounts with no address, no network to pick and no key to install, and pay from a credit in euros that Keyban settles. The mode is read-only for the user. On such an organization: - Skip the network of the application in step 1 (the currency stays): Keyban sets the network of each account itself, and writing one on the application could make `keyban:create_wallet` refuse the application for good. Call `keyban:create_wallet` without `network` (step 2), and the account is ready at once. - The configuration of the agent wallet MCP (step 4) comes from the same dialog, with no address and no invite key. - No tool of either server buys the credit: a human buys it in the dashboard. Never try to pay the invoice yourself. A payment refused for lack of credit is covered by `agent-wallet:get_instructions`. ## Pending approvals A payment above the wallet's approval threshold waits in the inbox, `https://admin.keyban.io/app//inbox?intent=`. Only the user's own session can approve it: no tool of either server can. `keyban:list_wallet_payments` lists what is waiting, optionally for one wallet (`walletId`). An intent with `sponsored: true` is paid by the Keyban welcome offer: approving it does not debit the agent wallet. ## Missions Missions, the budget and the brief an agent gets for one task, are driven from the agent wallet MCP: drafting, trials, publication and runs. This server has no mission tool; the agent wallet guide covers them (`agent-wallet:get_instructions`, or `keyban:get_instructions` with `skill: "keyban-agent-wallet"`). ## Beyond the agent wallet The same server also manages webhooks, reads the organization's events and quotas, and converts amounts to fiat. The tool descriptions say what each one does; the product documentation is at https://docs.keyban.io/ and the full tool reference at https://docs.keyban.io/reference/mcp-tools.