Sui MCP server

Sui MCP

Sui MCP is a local-first Sui review and evidence layer for AI clients.

It turns a supported Sui action into an internal Review card where you inspect verified transaction facts and a PTB graph, then request approval in your own wallet. The backend builds or verifies the material, binds the reviewed account and digest, and uses WalletConnect for a sign-only request. It verifies the wallet's returned bytes and signature before one submission to Sui mainnet.

The AI and card never receive executable transaction bytes or signatures. Neither a review nor a wallet connection is standing transaction permission. Only an explicit user action and that transaction's wallet approval authorize the request. Lost replies are resolved by reading the known digest; they do not cause another signing or submission request. Request failures and unknown outcomes are separate from independently observed chain success/failure.

Account, Receipt and Chart cards provide read-only evidence independently of signing. Connect and Review also run inside the MCP host. Settings currently uses a local token page. Human-readable review is not a guarantee of safety or of complete interpretation of every transaction detail; the raw PTB structure and addresses remain inspectable.

Users can ask ordinary questions:

• "Can I cover a 1000 dollar payment with my assets?"
• "How much are my USD-denominated assets together?"
• "What is the shortfall?"

This document describes @zktx.io/sui-mcp@0.5.1. Confirm that version is published before using npm installation commands. For a local build, follow Developer Checkout Setup.

Product Scope in Two Layers

• Implemented: Sui mainnet read evidence, non-signable external proposal review, and account-bound DeepBook swap review using protocol-agnostic adapters. Five internal cards use the same SQLite state and permission model. The backend verifies stored material, ownership, quote/policy provenance, human-readable facts, simulation and PTB evidence before an explicit user request. WalletConnect carries bytes only between the backend and wallet; ordinary MCP responses expose facts, request status and observed execution results. Settings remains a local token page; an internal Settings card is not implemented.
• Never (permanently unsupported at every layer): no private-key custody, no MCP or AI autonomous execution, no forwarding of opaque external transaction bytes to a wallet, no silent settlement-token or route choice, no fiat cash-out, no P&L, no peg guarantee.

DeepBook provides the current scoped Sui conversion, price, and orderbook evidence through the shared protocol adapter contracts. Wallet and Sui balance reads describe held assets. They do not define the whole product.

Sui MCP does not custody funds, hold private keys, or autonomously trade on behalf of users. By current design, it does not rank venues, choose routes, make best-price recommendations, or silently choose settlement tokens for users.

Account-bound transaction building, signing requests and chain observation stay in the local backend. The Review card displays evidence and current permitted actions. Public review JSON, model-facing card data and backups never contain transaction bytes, signatures, SDK keys or signing permission. Reopening a card reads its stored state and never replays a financial request.

The current release flow is:

The user states an intent in natural language.
Sui MCP resolves the supported Sui mainnet evidence surface.
The AI answers only from returned evidence and boundaries.
Supported swap transaction material build is an account-bound review step, not
part of the natural-language intent evidence answer.

Shortened. The full README is on GitHub.