Integrate FloFi
MCP Integrations
Give an agent structured discovery and composition tools while keeping authorization in FloFi.
On this page
Connect a configured deployment
The gateway is POST /api/mcp on the FloFi web deployment, using Streamable HTTP. The operator enables FLOFI_MCP and, for consumer clients, FloFi OAuth with durable PostgreSQL state and an exact FLOFI_PUBLIC_ORIGIN. These are server-side settings.
Tools follow explicit scopes
| Scope | Tools |
|---|---|
| flofi.strategy | get_supported_networks, get_supported_assets, get_capabilities, plan_strategy, compose_strategy, validate_strategy, review_strategy, simulate_strategy |
| flofi.approval | request_user_approval, get_approval_status; approval-session tools are app-only |
| flofi.runs | get_execution_status, get_evidence for wallets linked on FloFi |
Inputs use closed JSON Schemas. The same StrategySpec and workflow hash are used by the app, API and MCP. Supported sequences use the existing sequential runner when the deployment enables workflow runs; each step waits for reconciliation of the preceding step.
Keep the approval in FloFi
- Discover current capabilities and compose a supported strategy.
- Validate and optionally obtain a read-only simulation preview.
- Request an approval handoff for the exact strategy hash.
- The owner uses the signing surface inside MCP Apps when their host and wallet support it, proves their wallet, reviews the fresh simulation and confirms in their wallet. Opening the FloFi signing page is an optional external fallback; Canvas is optional.
See the primary operator guide linked below for deployment variables and the full client connection procedure.
What happens inside each chat
The MCP App can embed the existing signing surface in the conversation. This requires the host to allow its FloFi frame and the wallet to expose a compatible provider there. A model message never grants financial authority. Actual host and wallet support must be verified; an external fallback is not completion inside chat.
| Surface | In-chat composition | In-chat simulation | In-chat progress | Signing path | Networks and actions |
|---|---|---|---|---|---|
| ChatGPT (MCP) | Yes. Your assistant interprets the request; compose_strategy, validate_strategy and review_strategy build and check the canonical workflow. | Yes. simulate_strategy runs the flow’s read-only preview for a public address you name: nothing is stored and it grants no authority. | Yes. The FloFi panel follows the approval and its runs and reports status and evidence to the conversation; without MCP Apps, ask for get_approval_status. | Your own wallet through the existing signing surface, embedded in MCP Apps when the host allows the FloFi frame and the wallet exposes a compatible provider there. Open FloFi is an optional external fallback; Canvas is optional. Live host/wallet acceptance must be verified. | Asked live with get_supported_networks and get_capabilities; mainnet handoffs only for networks the operator lists. |
| Claude (MCP) | Yes. Your assistant interprets the request; compose_strategy, validate_strategy and review_strategy build and check the canonical workflow. | Yes. simulate_strategy runs the flow’s read-only preview for a public address you name: nothing is stored and it grants no authority. | Yes. The FloFi panel follows the approval and its runs and reports status and evidence to the conversation; without MCP Apps, ask for get_approval_status. | Your own wallet through the existing signing surface, embedded in MCP Apps when the host allows the FloFi frame and the wallet exposes a compatible provider there. Open FloFi is an optional external fallback; Canvas is optional. Live host/wallet acceptance must be verified. | Asked live with get_supported_networks and get_capabilities; mainnet handoffs only for networks the operator lists. |
| Telegram | Yes. Exact commands always; natural language when the deployment’s Copilot interpreter is enabled (FLOFI_CHANNEL_COPILOT). | Yes, when enabled (FLOFI_CHANNEL_SIMULATION): a read-only preview before the link if it needs no account or the strategy names the one to read. | STATUS at any time; “loaded”, “started” and “reconciled” notices after you share run status in FloFi (off by default). | Your wallet, in FloFi. Open FloFi shows the workflow on the Canvas; Telegram has no wallet signer, and no message (“yes”, “confirm”) authorizes anything. | The shared strategy grammar; channel policy decides test funds and mainnets (none unless the operator lists them). |
| Yes. Exact commands always; natural language when the deployment’s Copilot interpreter is enabled (FLOFI_CHANNEL_COPILOT). | Yes, when enabled (FLOFI_CHANNEL_SIMULATION): a read-only preview before the link if it needs no account or the strategy names the one to read. | STATUS at any time; “loaded”, “started” and “reconciled” notices after you share run status in FloFi (off by default). | Your wallet, in FloFi. Open FloFi shows the workflow on the Canvas; WhatsApp has no wallet signer, and no message (“yes”, “confirm”) authorizes anything. | The shared strategy grammar; channel policy decides test funds and mainnets (none unless the operator lists them). |
Private capabilities and recovery
Private approval URLs are delivered to the client UI in tool metadata under _meta["flofi/approval"]. Model-facing text and structured results receive a nonsecret /approve#apr_… reference, usable only with the creating OAuth account’s authenticated browser session. Do not copy a private capability into a prompt or server log.
The signing window provides private fallback and mobile wallet actions. A consumed-session recovery restores authoring only and still requires fresh simulation, explicit Manifest review and owner authorization. See Wallet Authorization for the shared journey.
These guides summarize the repository’s current contracts. Detailed evidence and engineering history stay in their original records.
docs/deploy/MCP.md docs/deploy/UNIVERSAL-SIGNING.md docs/STATUS.md apps/reference-dapp/src/app/api/mcp/route.ts apps/reference-dapp/src/platform/channel-capabilities.ts