MCP connectors

Use Oracle from the agent client you already run. Generated connector configs expose the read and prepare plane, not a wallet key or control bypass.

Every generated MCP configuration is read and prepare only.
Inspect the generated configuration before accepting it.
Signing stays in the user's wallet or an explicitly configured local self-hosted execution path.

MCP stdioRegistry listedPrepare only

Install a connector

Oracle can print or install MCP configuration for supported clients. Inspect the generated configuration before accepting it.

terminal

oracle mcp print --target claude-code
oracle mcp install claude-code
oracle mcp install codex
oracle mcp install chatgpt
oracle harness detect

Generic MCP

Oracle is listed in the official MCP registry as io.github.demi-hl/oracle. A registry-aware client can launch the read-plane stdio server directly.

stdio

npx -y -p @oracle-agent/oracle oracle-data-mcp

You can also run oracle-data-mcp from a global installation. The server communicates over stdio and expects Oracle's local data plane where required.

Supported clients

Client	Setup target	Posture
Claude Code	claude-code	Read and prepare
Claude Desktop	claude-desktop	Read and prepare
Codex	codex	Read and prepare
ChatGPT	chatgpt	Hosted, unsigned preparation
Cursor	cursor	Read and prepare
VS Code / Copilot	vscode / copilot	Read and prepare
Generic MCP	generic	Stdio read plane

Web tools in MCP

Tool	Availability	Boundary
web_fetch	Available	One public URL through SSRF checks, DNS pinning, redirect validation, response caps, and redaction
web_search	Keyless by default	Exa public search, with a custom ORACLE_SEARCH_URL override and ORACLE_SEARCH_PROVIDER=disabled opt-out

browser_exec remains standalone-only because it can click and fill public pages inside its sandbox. It is not exposed through the public MCP.

Oracle Sidecar remains extension-only and is not exposed as a generic MCP tool. Its read-only browser context requires a grant for one exact tab ID and origin. MCP cannot request Sidecar cookies, CDP, clicks, typing, signing, or broadcast authority.

Connector boundary

Every generated MCP configuration is read and prepare only. Oracle does not install a public control MCP or create a tunnel into private owner infrastructure.

Hosted clients stay keyless

A hosted client can request research, quotes, simulations, and unsigned artifacts. Signing stays in the user's wallet or an explicitly configured local self-hosted execution path.

Server credentials in 0.36.0

Public and hosted requests spend no server keys by default. The operator can opt in named providers with ORACLE_PUBLIC_ALLOW_SERVER_KEY_PROVIDERS, a comma-separated, whitespace-trimmed, case-sensitive list of canonical IDs. Empty is the default; there is no wildcard grant.

The legacy MAD_PUBLIC_ALLOW_SERVER_KEY_PROVIDERS is read only when the Oracle variable is unset or exactly empty. Any other Oracle value takes precedence, even whitespace or commas only, which then grants nothing. Source: credential sink rules (packages/oracle/src/data/http.mjs, revision 12f21dd5).

Request alias	Canonical opt-in ID
0x	zerox
1inch	oneinch
opensea	opensea-nft
magiceden	magiceden-sol

Aliases still normalize on requests, but alias entries in the operator list are refused with the canonical replacement; independent valid entries remain effective.

Voice uses openai or elevenlabs; watched portfolio RPC overrides use evm-rpc. An aggregator grant does not cover its dependencies. Sources: credential sink rules (packages/oracle/src/data/http.mjs, revision 12f21dd5), CHANGELOG (CHANGELOG.md, this source tree).

oracle public serve and the public MCP handler always apply the public allowlist policy, regardless of public-mode environment flags. Setting ORACLE_PUBLIC_ALLOW_SERVER_KEY_PROVIDERS therefore means unauthenticated callers of those surfaces can spend the listed providers' server keys; that is the operator's opt-in.

Verified local CLI/stdio owner entry points and authenticated local HTTP/app requests retain credential access. On local owner surfaces (CLI, desk, app and charts) outside public/hosted mode, an anonymous local request needs owner authentication to spend server credentials; the allowlist does not grant it there.

Missing request scope is anonymous, and HTTP listeners discard launcher authority. Public/hosted mode requires operator opt-in even with owner tokens. Existing authentication, origin checks, caps and operation restrictions still apply.

Sources: credential sink rules (packages/oracle/src/data/http.mjs, revision 12f21dd5), app authority (apps/oracle-app/lib/oracle/swap-server-keys.ts, revision 12f21dd5), public HTTP authority (packages/oracle/src/public-api/http.mjs, revision 12f21dd5), public MCP handler (packages/oracle/bin/oracle-data-mcp.mjs, revision 12f21dd5).

A configured endpoint may contain credentials in its host, path or query. Without authority, Oracle uses a reviewed built-in public default or refuses before upstream work.

Even a keyless private/loopback endpoint can fall back to a third party, exposing requested addresses there. Authenticate as local owner to retain the configured endpoint. Source: credential sink rules (packages/oracle/src/data/http.mjs, revision 12f21dd5), CHANGELOG (CHANGELOG.md, this source tree).