MCP Scopes - Finrock

AI connectors, such as the Claude connector, connect through Finrock sign-in instead of an API key and signed JWT. The access you approve on the sign-in screen gives the connector MCP scopes, which decide which endpoints it can call. Each endpoint page shows the MCP scope it needs. This page applies only to AI connectors. Requests signed with your API key and private key aren’t limited by scopes.

Scopes

Scope	Access level on the approval screen	What it allows
`dac.read`	Read	View balances, wallets, addresses, transactions, invoices, fees and settings.
`dac.write`	Read and create	Create wallets, deposit addresses and invoices. Moves no funds.
`dac.funds`	Not offered	Send, sweep or stake funds, and change wallet, address or security settings.

dac.funds can’t be granted yet, so AI connectors can’t move funds or change security settings. If it’s offered in future, withdrawals will still need their usual approvals, set in the dashboard or by your spending rules.

How access is decided

A GET endpoint that isn’t listed below needs dac.read.
Any other method (POST, PATCH, DELETE) that isn’t listed below is refused for AI connectors. New write endpoints stay closed to connectors until they’re added to this list.
Some endpoints are blocked for AI connectors and are refused whatever scopes the connector has.

All paths below are under https://api.finrock.io/dac/v1/.

Read: `dac.read`

Endpoint	What it does
`GET assets`	Supported assets
`GET wallets`	List wallets
`GET addresses`	List addresses
`GET transactions`	Transaction history
`GET network-fee-rates`	Network fee rates
`GET estimate-fee`, `POST estimate-fee`	Fee estimate
`GET gas-tanks`, `GET gas-tank-bal`	Gas tanks and gas tank balance
`GET exchange-accounts`, `GET exchange-balance`	Exchange accounts and balances
`GET prepaid-fee`	Prepaid fee balance
`GET tron/stake-txns`	TRON staking history
`GET aml`	AML settings
`GET frozen-addresses`	Frozen addresses
`GET invoice`	Invoices. AI connectors must pass `id` or `memo`.
`GET webhook`	Get the webhook URL. Also allowed with `dac.write`.

Other GET endpoints, such as Validate Address and List Spending Rules, also need dac.read.

Write: `dac.write`

Creates things but moves no funds.

Endpoint	What it does
`POST wallet`	Create a wallet
`POST generate-address`, `POST try-generate-address`	Create a deposit address
`POST remove-addr-label`	Remove an address label
`POST invoice`	Create an invoice
`POST webhook`, `DELETE webhook`	Add or delete the webhook URL
`POST spending-rule`, `DELETE spending-rule`	Create or delete a spending rule. The change only takes effect once the owner, or at least 2 admins, approve it.

Funds: `dac.funds` (not available yet)

Endpoint	Why it needs this scope
`POST transaction`	Withdrawals and transfers
`POST bump-fee`	Spends a higher fee
`POST invoke-sweep`	Moves funds and spends gas
`POST tron/stake`, `POST tron/unstake`, `POST tron/release-unstaked`	Moves or locks TRX
`PATCH wallet`	Sets forwarding and freezes wallets
`PATCH address`	Changes omnibus, auto-refill and AML settings
`POST aml`	Changes AML settings
`POST unfreeze-address`	Security setting

Scopes

How access is decided

Read: dac.read

Write: dac.write

Funds: dac.funds (not available yet)

Read: `dac.read`

Write: `dac.write`

Funds: `dac.funds` (not available yet)