TON MCP 2026: blockchain interface for LLM agents

Model Context Protocol (MCP) is an open standard from Anthropic for connecting language models to external tools. As part of TON Toolset 2026, TON MCP ships — the TON blockchain-side implementation. Any LLM (Claude, GPT, local models) can now work with TON through a standardised interface.

Let’s unpack what this does and who needs it.

Why an LLM needs blockchain access

Before, to make an LLM “work with crypto”, a developer had to:

1. Write custom tool functions for every operation (read_balance, send_transfer, get_quote).
2. Serialise the tools to the format a specific LLM understands (OpenAI function-calling, Claude tool-use, etc.).
3. Manage secrets and signatures by hand.
4. Rebuild the whole thing for every new LLM.

With MCP, this unifies: the LLM connects to an MCP server, which exports its tools in a standardised format. Any MCP-compatible model works out of the box.

TON MCP server

mcp.ton.org is the public TON MCP server. Connecting an LLM agent (e.g., Claude):

import { TonMcpClient } from '@ton/mcp';

const client = new TonMcpClient({
  endpoint: 'https://mcp.ton.org',
  walletAddress: agentAddress, // if the LLM works on behalf of a specific wallet
});

// MCP exports tools in the standard format:
const tools = await client.listTools();
// [
//   { name: 'getBalance', description: 'Get TON balance for an address', schema: {...} },
//   { name: 'getJettonBalance', description: '...', schema: {...} },
//   { name: 'transfer', description: 'Send TON', schema: {...} },
//   { name: 'swap', description: 'Get DEX quote and swap', schema: {...} },
//   ...
// ]

From there, Claude / ChatGPT / any MCP-compatible model sees this tool list and can call them.

Available operations (read-only)

• getBalance(address) — TON balance.
• getJettonBalance(address, jettonMaster) — jetton balance.
• getTransactions(address, limit) — operation history.
• getJettonInfo(jettonMaster) — jetton info (name, symbol, decimals, supply).
• getDexQuote(from, to, amount) — best route + expected output from STON.fi/DeDust.
• resolveDns(name) — .ton/.t.me → canonical address.
• getStakingInfo(protocol) — APY and protocol parameters.

Available operations (write — require a key)

• transfer({to, amount, comment}) — send TON.
• transferJetton({to, jettonMaster, amount}) — send a jetton.
• swap({from, to, amount, slippage}) — execute a swap.
• stake({protocol, amount}) — stake.
• unstake({protocol, amount}) — unstake.

Write operations require either:

• MCP token with signature — user gives the LLM a scoped token (can’t go beyond limits).
• Agentic Wallet — LLM works via Agentic Wallet, which bounds operations on-chain (e.g., max $50/day).

Pre-built skills

Beyond low-level tools, TON MCP provides “skills” — high-level compositions:

• buyJetton({jetton, ton_amount}) — find the best DEX, execute the swap, verify execution.
• dollarCostAverage({asset, daily_amount, days}) — set up periodic purchases.
• stakingDashboard(address) — collect data across all staking positions into one object.

Skills make the LLM agent immediately useful without manually orchestrating low-level operations.

Example: ask Claude to buy USDT

With TON MCP this works straight in Claude:

User: Buy me USDT for 50 TON via the best DEX. Slippage no more than 1%.

Claude through MCP:

1. Calls getDexQuote(from='TON', to='USDT', amount='50') → STON.fi gives 105.20 USDT.
2. Verifies slippage is within bounds (1.5% → fits).
3. Asks the user for confirmation (if write-op requires).
4. Calls swap(...) via Agentic Wallet.
5. Returns txHash and confirms.

Without MCP this would be a custom flow per LLM. With MCP — the same command works in Claude, ChatGPT, local Llama.

Security model

Read-only: safe for any MCP token. Public data.

Write via Agentic Wallet: safe by design:

• Agentic Wallet has a budget (e.g., max $50/day).
• If the LLM is “malicious” and tries to drain the wallet — the limit stops it.
• The user can revoke the agent one-click on-chain.

Write via direct key (without Agentic Wallet): dangerous. LLM agent with a direct key = full custody. Don’t do this outside of dev environments.

When to use TON MCP

Good:

• Building an AI agent that works with TON.
• Want to give users “ask the LLM about my portfolio” functionality.
• Prototyping AI × crypto ideas.

Stop:

• Security-critical → use read-only or via Agentic Wallet.
• Production-critical operations → also validate on the backend, don’t trust the LLM only.

What’s next

• Docs: docs.ton.org/overview/ai/mcp.
• Site: mcp.ton.org.
• NPM: @ton/mcp.
• GitHub: ton-connect/kit (shared monorepo).

Pairing with Agentic Wallet — our Agentic Wallet piece. Bigger picture of AI × TON — our AI agents on TON piece.

Full TON Toolset context — TON Foundation overview.