DOCSEARCHbyAlgolia
Submit Docs

Core Wallet Documentation

website·Indexed 35 days ago

https://docs.core.app/

Documentation for Core, a non-custodial crypto wallet for managing digital assets and decentralized applications across Avalanche (C, X, and P-Chain) and other supported networks. Includes guides for integrating dapps via Core Extension, Core Web, and Core Mobile, as well as the Core MCP Server for providing AI agents controlled access to wallets using the Model Context Protocol.

Tokens
20.7K
Snippets
56
Records
171
Agent score
53%

What's inside Core

  1. Overview of Core Wallet integration surfaces

    Core provides three primary ways for developers to integrate wallet functionality into their applications:

    1. Core Extension: Injects an EIP-1193 provider into web pages and uses EIP-6963 for discovery. Developers can detect the provider and request accounts to establish a connection.
    2. Core Mobile: Does not use injection; instead, it connects to decentralized applications (dapps) via the WalletConnect protocol.
    3. Core MCP Server: Designed for AI agents. It uses a trust model based on pre-authorized, wallet-signed policies rather than requiring per-transaction approval from the user.

  2. Overview of the Core MCP Server

    The Core MCP Server enables AI agents (such as Claude or ChatGPT) to interact with a Core wallet using the Model Context Protocol (MCP). Unlike standard provider APIs that require human approval for every transaction, the MCP server uses a signed, pre-authorized policy. This policy defines the specific accounts, networks, spend limits, and recipients the agent is permitted to use. The agent can list accounts, read balances, and submit transactions for signing, provided they fall within the limits of the user-signed policy.

  3. Overview of Core Web for developers

    Core Web is a browser-based version of the Core wallet that requires no installation. For developers, it serves three primary functions:

    1. Protocol Interaction: It allows users to execute swaps, staking, lending, and NFT views against public contracts directly within the wallet interface.
    2. Agent Policy Management: It is the configuration surface for the Core MCP Server, where permissions (accounts, networks, spend limits, and recipients) are managed via AI connectors settings.
    3. Transaction Signing: It supports signing via seed-phrase accounts, seedless (social-login) accounts, Core Extension, and hardware wallets, utilizing the standard approval pipeline and Blockaid screening.

  4. Use the Core MCP Server for AI agent integration

    The Core MCP Server is a non-user-facing platform that allows AI agents to operate a wallet. Agents are authenticated using the user's core.app identity and must operate under a signed policy.

  5. Understand the Core MCP security boundary

    The Core MCP security model allows software to move funds without per-transaction human approval. It relies on three layered mechanisms to protect assets:

    1. Custody (CubeSigner): Private keys are stored in CubeSigner's hardware-backed signing service. They are never stored on the MCP server or within the agent's context, preventing key exfiltration even if an agent is compromised.
    2. Authorization (Signed Policy): Every request is validated against a signed policy (covering accounts, networks, spend limits, and recipients). The server rejects any policy that fails signature verification from the user's wallet.
    3. Identity (OAuth): Per-user and per-client tokens bound to the core.app identity are used for authentication and can be revoked by either party.

  6. Connect to Core Mobile via WalletConnect

    Core Mobile connects to dapps using the WalletConnect protocol. It is not an injected wallet, meaning it cannot be detected via extension detection methods and window.avalanche is not available in mobile browsers. The connection flow involves the dapp displaying a QR code (desktop) or deep link (mobile), which the user approves within the Core Mobile app to establish a session for sending requests like eth_sendTransaction and personal_sign.

  7. Swap tokens using Core Web's aggregator

    Core Web provides a swap interface that aggregates quotes across integrated liquidity sources on the active network to execute trades against the best available price. For token teams, no manual listing is required; the aggregator automatically routes to any pool that has available liquidity. Token approvals follow the standard ERC-20 pattern, requiring an allowance to the router. Users can audit or revoke these allowances using the revoke-access tool.

  8. Provide a high-quality security vulnerability report

    To ensure efficient triage, security reports should include the following three components:

    1. Impact: A single sentence describing what an attacker gains from the vulnerability.
    2. Reproduction: Clear steps or a Proof of Concept (PoC). It is recommended to use a local fork or testnet; Fuji network combined with 'testnet mode' is suitable for reproducing most wallet flows safely.
    3. Environment: Details including the product and version (e.g., extension version, OS, browser), the network used, and any relevant policy or permission states.

  9. Understand how Predictions markets work in Core Web

    Predictions allow users to take positions on real-world event markets (such as prices, sports, and other outcome-based markets) directly within Core Web.

    Key operational details:

    • Market Structure: Each market is framed as a question with outcome shares. Buying a side creates an on-chain position linked to the user's account.
    • Settlement: Winnings are settled based on the market's resolution source and are claimable by the account that held the position.
    • Visibility: Open prediction positions are displayed in the user's portfolio alongside other DeFi positions.

  10. Manage AI agent permissions via AI connectors

    The AI connectors settings page (Settings → AI connectors) serves as the control panel for the Core MCP Server. It allows users to govern what AI agents can perform with their wallet. Key management capabilities include:

    • Policy Control: Manage the master enable/disable switch, set spend limits, define allowed networks, and specify accounts. Every policy change must be signed by the user's wallet.
    • Recipient Management: Maintain an allowlist of approved addresses and add custom recipient addresses individually.
    • Activity Monitoring: Access an audit log of all agent calls, including those that were refused.

  11. Integrate Ledger hardware wallets with Core Extension

    Core Extension supports Ledger hardware wallets using WebUSB/WebHID and the Avalanche Ledger app. The Ledger device securely holds the private keys and requires physical user confirmation on the device screen to sign transactions. Core builds the transactions and provides context, but cannot sign them without the physical device.

  12. Choose a connection transport for Core

    Core connects to dapps using three different transports depending on where the user is running the Core client. The transport is determined by the user's environment, not the dapp's technology stack:

    • Core Extension: Uses an injected EIP-1193 provider. Discovery is handled via EIP-6963, requiring no Core-specific integration.
    • Core Mobile: Uses WalletConnect. Integration requires a WalletConnect client (e.g., Reown AppKit).
    • Core Web: The wallet acts as the application itself; no external integration is required.