Agent Kit — connect any framework

Drive Sup Wallet from your own agent or app. The Agent Kit exposes prices, technical analysis, on-chain reads, owner-signable transaction construction, and Sup managed-agent execution over REST and one MCP server.

Self-custody, always. Owner actions return a portable, unsigned Sui transaction that the integrating host can present to its own connected wallet. Sup never receives the owner's key. Delegated actions are different: an explicit, wallet-bound executor key may invoke Sup's managed agent, but the transaction still has to pass the owner's on-chain service, coin, amount, and policy caps. approvalUrl remains a fallback for hosts without wallet UI.

The permissionless Marketplace publish/run surface has been retired. Supported protocol operations are exposed through the Agent Service and backend/onchain-tools-service, with the wallet or a bounded managed agent as the signing authority.

#Three presets

executor is never granted implicitly and requires walletId when the key is minted. It cannot select another vault. Administrative secrets, arbitrary signing, and owner-only policy changes remain unavailable.

Before minting an executor key, the owner must register Sup's managed agent on that vault. Do this once in Sup, or mint a draft key, call prepareAgentSetup, and sign the returned portable transaction in the host wallet. Then mint the wallet-bound executor key.

#1 · Mint an owner-scoped key

Minting a new key is currently unavailable.

Keys are authorized by the owner, which meant one of two self-custodial proofs: a wallet signature over a challenge from /api/auth/wallet/challenge (sent as an x-sup-siws header), or a logged-in Sup session. Those were the same proof twice — /api/auth/wallet/verify was the only thing that minted that session — and wallet sign-in was removed on 2026-08-25. None of the four remaining sign-in doors proves a Sui address, so POST/GET/DELETE /api/agent/v1/keys answer 401 for every caller.

A key you already hold keeps working against /api/agent/v1/* exactly as documented below — it is a separate credential and does not pass through the owner check. Restoring key management needs a server-side binding from a signed-in account to a wallet address the server has proven.

# executor assumes prepareAgentSetup has already been signed for this walletId
curl -X POST $SUP/api/agent/v1/keys \
  -H 'content-type: application/json' \
  -d '{ "presets": ["observer","draft","executor"], "walletId": "0x…", "label": "my-agent", "ttlDays": 90 }'
# → { "apiKey": "sup_…", "expiresAt": … }   shown ONCE — store it now

Keys carry a TTL (default 90 days; ttlDays: 0 = no expiry, discouraged), record last-use, and are listable / revocable:

GET    /api/agent/v1/keys           # list (plaintext-free; status active|expired|revoked)
DELETE /api/agent/v1/keys/{id}      # revoke now (audit row kept)

#2 · Call tools over REST

Use the key as Authorization: Bearer sup_… against /api/agent/v1.

GET  /api/agent/v1/tools                 # list callable tools + JSON Schemas (scoped to the key)
POST /api/agent/v1/tools/{name}          # invoke one with JSON args

curl -X POST $SUP/api/agent/v1/tools/getTokenPrice \
  -H "authorization: Bearer $SUP_AGENT_API_KEY" \
  -H 'content-type: application/json' -d '{"ticker":"SUI"}'

Responses are { tool, result } on success, or denial-as-data { tool, error, suggestion } (HTTP 200) for a policy/cap rejection — so a calling LLM can self-correct instead of crashing.

An owner-signable result can include:

{
  "encoding": "sui-transaction-json",
  "transaction": "{ ... }",
  "network": "mainnet",
  "sender": "0xOWNER",
  "requiresOwnerSignature": true,
  "signingMode": "host_or_fallback",
  "approvalUrl": "https://www.supwallet.app/app?approval=…"
}

Deserialize with Transaction.from(result.transaction), simulate/review it, then call the host wallet's normal sign-and-execute API. An executor result instead carries transactionStatus: "executed" | "failed" and execution: { ok, digest?, events, error? }.

#3 · The MCP server (one server, every framework)

@workspace/sup-mcp is a stdio MCP server that proxies the REST surface. Point any MCP host at it — Claude Desktop, Cursor, Claude Code — and every agent framework with an MCP client gets Sup for free.

{
  "mcpServers": {
    "sup-wallet": {
      "command": "node",
      "args": ["/abs/path/to/packages/sup-mcp/dist/bin.js"],
      "env": { "SUP_AGENT_API_KEY": "sup_…", "SUP_AGENT_API_URL": "https://www.supwallet.app" }
    }
  }
}

Env: SUP_AGENT_API_KEY (required), SUP_AGENT_API_URL, and SUP_AGENT_INCLUDE_TOOLS (CSV to narrow the exposed tools).

#4 · The sup CLI

@workspace/sup-cli is a thin client over the same surface.

sup config set-key sup_…     # or export SUP_AGENT_API_KEY
sup keys mint --scope observer,draft,executor --wallet-id 0x… --ttl-days 90 --label my-agent
sup keys list                 # id / scope / status / expiry   — 401: see §1
sup keys revoke <id>          #                                — 401: see §1
sup tools                     # what this key can call
sup call getTokenPrice '{"ticker":"SUI"}'
sup mcp-config                # print an MCP host config block

#5 · Framework integrations

Build the server once (bun run --cwd packages/sup-mcp build) and connect its MCP client. Full runnable files live in packages/sup-mcp/examples/.

LangChain (JS) — @langchain/mcp-adapters

import { MultiServerMCPClient } from "@langchain/mcp-adapters";
const client = new MultiServerMCPClient({
  mcpServers: { sup: { transport: "stdio", command: "node",
    args: [SUP_MCP_BIN], env: { SUP_AGENT_API_KEY: process.env.SUP_AGENT_API_KEY } } },
});
const tools = await client.getTools();   // → createReactAgent({ llm, tools })

OpenAI Agents SDK (JS) — @openai/agents

import { Agent, run, MCPServerStdio } from "@openai/agents";
const sup = new MCPServerStdio({ name: "sup-wallet", command: "node",
  args: [SUP_MCP_BIN], env: { SUP_AGENT_API_KEY: process.env.SUP_AGENT_API_KEY } });
await sup.connect();
const agent = new Agent({ name: "Sup user", model: "gpt-4.1-mini", mcpServers: [sup] });

Mastra — @mastra/mcp

import { MCPClient } from "@mastra/mcp";
const mcp = new MCPClient({ servers: { sup: { command: "node",
  args: [SUP_MCP_BIN], env: { SUP_AGENT_API_KEY: process.env.SUP_AGENT_API_KEY } } } });
const agent = new Agent({ /* … */, tools: await mcp.getTools() });

CrewAI (Python) — crewai-tools[mcp]

from crewai_tools import MCPServerAdapter
from mcp import StdioServerParameters
params = StdioServerParameters(command="node", args=[SUP_MCP_BIN],
    env={**os.environ, "SUP_AGENT_API_KEY": os.environ["SUP_AGENT_API_KEY"]})
with MCPServerAdapter(params) as tools:
    Agent(role="Sup user", tools=tools, ...)

Agno (Python) — agno.tools.mcp

from agno.tools.mcp import MCPTools
async with MCPTools(command=f"node {SUP_MCP_BIN}", env=env) as tools:
    Agent(model=OpenAIChat(id="gpt-4.1-mini"), tools=[tools], ...)

Vercel AI SDK — direct REST (no MCP process)

Wrap SupClient (@workspace/sup-mcp) tools with jsonSchema() — see packages/sup-mcp/examples/vercel_ai_sdk.ts.

For browser/desktop hosts, inspect a tool result before returning it to the model:

import { Transaction } from "@mysten/sui/transactions";

if (result.encoding === "sui-transaction-json" && result.requiresOwnerSignature) {
  const transaction = Transaction.from(result.transaction);
  await wallet.signAndExecuteTransaction({ transaction });
}

MCP agents with an executor key do not need a human signature for runAgent*: Sup executes through the bound managed agent and returns the digest. The owner's previously signed delegation remains the authority boundary.

No Python SDK is needed: CrewAI / Agno / LangChain-py / OpenAI-Agents-py all speak MCP, so the one server above covers them too.

#Skill

Loadable playbook for an agent integrating the kit: sup-agent-kit-dev (quickstart · mcp-server · framework-integrations · rest-api).