Skip to main content

​
MCP Setup

Legend Prime offers two MCP servers: a local server (recommended) that runs on your machine with full signing capabilities, and a remote server for read-only or shared access. The local server runs via legend-cli mcp serve and includes all tools plus local-only capabilities like plan_and_execute (create + sign + execute in one tool call).
The legend-cli binary installation paths below are planned but may not yet be available. Check legend.xyz for the latest.

​
Claude Code

# Install the CLI
cargo install legend-cli

# Add the local MCP server
claude mcp add legend -- legend-cli mcp serve
Then authenticate: 
legend-cli login
This opens your browser for Google SSO and saves a 30-day JWT to your profile. The MCP server uses this token automatically.

​
Cursor

Add to your MCP settings (.cursor/mcp.json or Settings > MCP): 
{
  "mcpServers": {
    "legend": {
      "command": "legend-cli",
      "args": ["mcp", "serve"]
    }
  }
}
Then run legend-cli login in your terminal to authenticate.

​
Team Projects (.mcp.json)

Share the local MCP config with your team: 
{
  "mcpServers": {
    "legend": {
      "command": "legend-cli",
      "args": ["mcp", "serve"]
    }
  }
}
Each team member runs legend-cli login once to authenticate with their own Google account.

​
Remote MCP Server

The remote server at https://prime-api.legend.xyz/mcp is best for read-only operations or when you don’t need local signing.
No API key needed — authenticate with your Google account.
claude mcp add --transport http legend-remote https://prime-api.legend.xyz/mcp
Then in Claude Code:
/mcp
Select “legend-remote” > “Authenticate” > sign in with Google. A Prime Account is created automatically if you don’t have one.

​
Local vs Remote: When to Use Which

Local MCPRemote MCP
SigningBuilt-in — plan_and_execute does everythingRequires separate CLI Bash call for signing
Authlegend-cli login (Google SSO, 30-day JWT)OAuth or query key
SetupInstall CLI + claude mcp addJust claude mcp add
Team sharingEach person runs their ownShared via query key
Best forAgents that execute transactionsRead-only dashboards, shared team access

​
Setting Up Signing

To execute plans (move funds), you need a P256 signing key. This is only needed if your agent will create and execute transactions — read-only operations work without it.

​
With Local MCP (easiest)

The agent can create a signing key directly via the create_account tool:
“Create a new Legend account with keygen”
The create_account tool generates a P256 key in Secure Enclave and creates the account in one step. Then plan_and_execute handles signing automatically.

​
With CLI

# Generate a P256 key (Secure Enclave on macOS) and create a sub-account
legend-cli accounts create --keygen
This single command:
  1. Generates a P256 key in your Mac’s Secure Enclave (non-exportable)
  2. Sends the public key to Legend to create a Turnkey-backed sub-account
  3. Saves the account details to a local profile

​
Sign Plan Digests (remote MCP only)

When using the remote MCP server, the agent creates a plan via MCP and gets back a digest. To execute: 
legend-cli sign 0xabc123...
# Output: 0xdef456... (the EIP-712 signature)
The CLI uses the Secure Enclave key to sign a Turnkey API request, which produces the EIP-712 signature. Your private key never leaves the hardware.

​
Add a CLAUDE.md Snippet

For Claude Code, add this to your project’s CLAUDE.md to help the agent use Legend tools effectively: 
## Legend Prime

This project uses Legend Prime for DeFi operations via MCP tools.

- **Amounts** are in smallest units: 1 USDC = 1000000 (6 decimals), 1 ETH = 1e18
- **Plans** expire after 2 minutes — execute promptly after creation
- **Folio yield_markets** keys: comet -> "compound", aave -> "aave", morpho_vault -> "morpho_vault"
- Use `plan_and_execute` for one-shot plan creation + signing + execution
- Call `list_accounts` first if you don't know the account ID
- Call `get_portfolio` to see balances and yield markets before creating plans

​
Troubleshooting

IssueFix
”401 Unauthorized”Run legend-cli login or check your query key
Tools not appearingRun /mcp to check server status
”Account not found” on tool callUse list_accounts to get valid account IDs
Plan expiredPlans last 2 minutes — create a new one and execute promptly
”No profile found” on signRun legend-cli login then legend-cli accounts create --keygen
Local MCP not connectingVerify legend-cli mcp serve runs without errors in your terminal