Web3MCP is an open protocol for discovering and executing Solana program capabilities. Given a program ID, a compatible agent host reads its canonical configuration PDA through Solana RPC. The on-chain configuration describes tool arguments, accounts, and instructions; the program executes transactions on-chain. No project-specific MCP server, custom API, or external website is required.
| Component | Role in Architecture |
|---|---|
| Solana Program | Owns the canonical config PDA and executes advertised instructions on-chain. |
| Config PDA | Publishes the tool manifest, embedded Anchor IDL, and execution bindings on-chain. |
| Agent Host | Discovers tools via RPC, validates schemas fail-closed, decodes reads, and prepares writes. |
| User Wallet | Signs the reviewed transaction after explicit human approval; the LLM never signs. |
One program ID, on-demand tools
Connecting an agent host to any compatible Solana program follows a deterministic four-step discovery loop:
- 1. Derive Canonical PDA: Locate the configuration account at deterministic seeds
['web3mcp', 'config']under the target program ID. - 2. Verify Ownership & State: Confirm the account is owned by the program, holds the required discriminator, and is marked
Published. - 3. Validate Schemas: Parse the embedded Anchor IDL, Draft-07 parameter schemas, and execution bindings fail-closed.
- 4. Register Tools On-Demand: Provide validated tool descriptors to the LLM without requiring an external MCP server or custom API.
Execution boundary & trust model
Web3MCP enforces strict security boundaries between model suggestions, host validation, and transaction execution:
- Read Queries (RPC Only): Decodes on-chain account state directly via RPC with zero transaction fees and zero signatures.
- Write Instructions (Wallet Signed): The host constructs and simulates instructions, requiring explicit human wallet confirmation before signing.
- No Autonomous Agent Signing: The model proposes tool arguments but never holds private keys or signs transactions.
- Untrusted Publisher Claims: Tool descriptions and effect summaries remain untrusted publisher metadata validated by the host.