@hinkal/mcp

Private crypto from any MCP client (Claude Desktop, Claude Code, Cursor, ...) powered by Hinkal. Shield tokens into a private balance, unshield, pay other Hinkal users with no on-chain trace, or send to any address with no link back to you - on every Hinkal-supported chain. Ask your assistant to list chains for the current list.

Nothing to sign, no wallet to connect: a wallet is created automatically on first use and held server-side by Hinkal. Your machine keeps only an access key.

Install

Recommended - install globally (fast startup, explicit updates), then register the hinkal-mcp command with your client:

npm i -g @hinkal/mcp

Claude Code:

claude mcp add hinkal -- hinkal-mcp

Claude Desktop - add to claude_desktop_config.json:

{
  "mcpServers": {
    "hinkal": { "command": "hinkal-mcp" }
  }
}

Alternative - no install, run through npx (note: npx caches versions - see Updating):

claude mcp add hinkal -- npx -y @hinkal/mcp

{
  "mcpServers": {
    "hinkal": { "command": "npx", "args": ["-y", "@hinkal/mcp"] }
  }
}

Any other MCP client: use hinkal-mcp (or npx -y @hinkal/mcp) as a stdio server command. Requires Node.js 18+. No configuration needed.

First use

1. Ask your assistant for your wallet addresses. The wallet starts empty.
2. Send the tokens you want to shield plus the chain's native gas token to the address for your chain.
3. Back up the wallet: ask to export the wallet key and store the output somewhere safe. It is the only recovery - Hinkal cannot restore a lost key.
4. Go: "deposit 10 USDC", "show my balances", "send 5 USDC privately to 0x...".

Tools

Your assistant picks the right one - just say what you want. What each does:

Balances

| Tool | What it does | | --- | --- | | get_all_balances | Public and private (shielded) balances on every supported chain in one call | | get_balances | Private (shielded) balances on one chain | | get_public_balances | Regular on-chain balances of any wallet (defaults to yours) | | get_stuck_balances | Funds from private sends whose payout leg never completed |

Moving funds (shielded)

| Tool | What it does | | --- | --- | | deposit | Shield your own funds: public balance -> your private balance. Gas only, no Hinkal fee | | withdraw | Unshield: private balance -> any public address. Fee on top | | deposit_for_other | Shield into another Hinkal user's private balance (gift/fund them privately) | | private_transfer | Pay another Hinkal user shielded-to-shielded - no on-chain trace of sender, recipient, or amount | | private_send | Pay one or more public addresses with no on-chain link back to you; payouts complete asynchronously | | check_private_send_status | Poll a private_send payout by its scheduleId until it completes | | recover_stuck_funds | Withdraw the stuck UTXOs of one token (from get_stuck_balances) to a public address |

Account

| Tool | What it does | | --- | --- | | get_wallet_status | Is the wallet set up, and its addresses if known | | get_wallet_addresses | Your public EVM/Tron/Solana addresses - fund these before depositing | | export_wallet_key | Reveal the wallet's private access key for backup. Sensitive: full wallet control |

Plain public wallet actions (visible on-chain, no privacy)

| Tool | What it does | | --- | --- | | wallet_send | Normal token transfer from your wallet | | wallet_approve | Set an ERC-20/TRC-20 allowance for a spender contract | | wallet_execute | Arbitrary contract call (EVM calldata or Tron selector) | | wallet_sign_message / wallet_sign_typed_data | Sign a message / EIP-712 data; nothing is broadcast | | wallet_solana_execute | Sign and broadcast a prepared Solana transaction | | tron_freeze / tron_unfreeze | Stake/unstake TRX for energy or bandwidth (cheap Tron transactions) | | tron_delegate_resource | Lend staked energy/bandwidth to another Tron address |

Info

| Tool | What it does | | --- | --- | | list_chains / list_tokens | Browse supported chains and tokens (rarely needed - tools accept symbols directly) | | ping | Check the Hinkal API is up | | get_contract_addresses | Deployed Hinkal contract addresses per chain | | get_enclave_public_key / get_enclave_attestation | Verify the API runs in a genuine secure enclave |

Configuration (optional)

Everything works with zero configuration. Override via a CLI flag on the server command (e.g. hinkal-mcp --dir ~/wallets) or an environment variable; the flag wins when both are set:

| Flag | Env variable | What it's for | | --- | --- | --- | | --dir | HINKAL_DIR | Data directory for the keystore; defaults to ~/.hinkal (%APPDATA%\hinkal on Windows) | | --keystore | SIGNER_KEYSTORE_PASSPHRASE | Passphrase that encrypts the keystore at rest; must then be provided on every launch |

Backup and restore

Your wallet identity is one file: mcp-identity.json in the data directory. It survives updates and reinstalls; it does not survive deleting the file or losing the machine.

Restore on any machine by recreating that file from your export_wallet_key backup (then chmod 600):

{"stampSeed":"<stampPrivateKey>","organizationId":"<organizationId>","userId":"<userId>"}

Your wallet and shielded balances are back on the next tool call.

Updating

npm i -g @hinkal/mcp@latest

Restart your client afterwards. If you use npx instead of a global install, also clear its cache (rm -rf ~/.npm/_npx) - npx pins cached versions and prefers global installs. Updates never touch your wallet.