Private payments.
Clear controls.

Choose how to run Ringside

The two modes share the MCP tool surface. They differ in where the agent key is held and how you connect.

Set up a local agent

Use Node 24 or newer and pnpm 11. Clone the repository with its upstream submodules, then build the packages.

git clone --recurse-submodules https://github.com/mayorXBT/Ringside-MCP.git
cd Ringside-MCP
pnpm install --frozen-lockfile
pnpm build

Set a Helius devnet API key and initialize a dedicated agent wallet. init prints the public funding address. Keep the key file out of Git and give it mode 600.

export HELIUS_API_KEY='your-devnet-key'
node packages/mcp/dist/index.js init --owner YOUR_OWNER_WALLET_ADDRESS

Run the privacy stack locally

Helius’s localnet guide uses zolana dev start to run a test validator, Photon indexer, and prover. Ringside selects these endpoints when RINGSIDE_NETWORK=localnet. Use this for repeatable development and swap or escrow fixture testing.

cargo install --git https://github.com/helius-labs/zolana --tag v0.3.0-alpha zolana-cli
zolana dev start

export RINGSIDE_NETWORK=localnet
# RPC: 127.0.0.1:8899 · indexer: 127.0.0.1:8784 · prover: 127.0.0.1:3001
node packages/mcp/dist/index.js init --owner YOUR_OWNER_WALLET_ADDRESS

The example CLI installation comes from Helius’s guide; the Ringside repo can also use its checked-out Zolana source. Localnet balances and transaction signatures are separate from devnet. Never treat a localnet pass as a devnet pass.

Connect your agent

Add the stdio server to Claude Desktop with absolute paths. Replace the API key and key file path with your own values. The same command and environment work in Claude Code and Cursor.

{
  "mcpServers": {
    "ringside": {
      "command": "node",
      "args": ["--use-env-proxy", "/absolute/path/Ringside-MCP/packages/mcp/dist/index.js"],
      "env": {
        "HELIUS_API_KEY": "your-devnet-key",
        "RINGSIDE_KEYPAIR": "/absolute/path/agent.json"
      }
    }
  }
}

Restart your MCP client after saving its configuration. Ask it for wallet_info, then register_private_wallet. Registration is required before private transfers. The server has 25 registered tools; spending tools are marked destructive so clients can request confirmation.

How private state moves

Ringside is an MCP layer over the Helius Zolana client. The agent signs Solana transactions with its own wallet. A Helius-compatible RPC, indexer, and prover support the private operations; the Solana Privacy Program verifies proofs on-chain.

Helius calls these outputs Private Solana Token Accounts. Its guides use a view tag to find encrypted outputs; finding an output is different from decrypting it. Ringside’s syncWallet call handles fetching and decryption for the balance and history tools. On localnet, zolana dev start supplies a validator, Photon indexer, and prover.

Move public funds into a private balance

Use deposit after wallet registration and public funding. Ringside builds a deposit to the agent’s shielded address, submits it, and returns a transaction signature and slot. The deposit itself needs no ZK proof; the private balance it creates is encrypted.

For an SPL mint that has no private interface yet, use deposit_with_interface_setup with mint, amount, and source_token_account. That helper creates the interface when needed, then deposits. The current helper uses the standard SPL Token Program; do not assume Token-2022 interface setup works through that shortcut.

Pay another private wallet

private_transfer takes recipient, asset, and amount. Ringside resolves the recipient’s registered private address, checks owner policy, syncs spendable notes, builds the transfer, requests a proof, and submits the transaction. An unregistered recipient is rejected before submission.

For the permissionless default confidential Ring, Helius documents encrypted asset and amount, with sender and recipient public. Custom anonymous Rings have different visibility, but Ringside’s current default flow does not claim anonymous sender or recipient addresses. The chain still exposes a transaction signature and timing.

Return funds to a public wallet

withdraw takes asset, amount, and an optional recipient. If no recipient is given, Ringside withdraws to the agent’s own public address. The tool syncs private state, requests a proof, and submits the withdrawal after policy checks.

The withdrawal reveals its asset, amount, and recipient on-chain. The remaining private balance stays encrypted. Helius documents this distinction explicitly: moving funds out of a private balance is a public exit, not a hidden payment.

Read a private balance

Call get_private_balance or its alias sync_balance after a deposit or payment. Ringside syncs encrypted outputs from the indexer and decrypts them with the agent key. The result lists each asset, a formatted amount, base units, and the number of spendable notes.

The indexer does not return a plaintext balance to arbitrary callers. Helius’s guide shows a view tag locating matching encrypted outputs and a local decryption step producing spendable balances. Ringside wraps those steps through the pinned Zolana client. A stale or unavailable indexer can delay a new balance appearing even when a transaction is confirmed.

Read private activity

get_private_history and read_history accept an optional limit from 1 to 500; the default is 50. Ringside syncs encrypted transactions and returns recent decrypted entries with signature, slot, kind, direction, status, asset, and amount.

History sync belongs in wallet restore, reconnect, and gap recovery paths, not only after a payment. Helius separates balance decryption from history decryption because a balance snapshot alone does not explain the activity behind it. A viewing key can authorize read access; browser-side viewing-key decryption in Ringside’s auditor view remains unverified.

From funding to payment

1. 01

   Register and fund

   Register the agent wallet, send devnet SOL to its public address, then call deposit to move funds into its private balance. The funding and deposit amounts remain public on-chain.

2. 02

   Sync the private balance

   Call get_private_balance to see the decrypted balance available to this agent. The agent reads its own private notes locally or in the hosted request context.

3. 03

   Pay a registered recipient

   Call private_transfer with the recipient, asset, and amount. Ringside checks the kill switch, recipient registration, allowlist, and spend caps before submission.

4. 04

   Read or withdraw

   Use get_private_history for activity, or withdraw to return funds to a public wallet. Withdrawal details are public.

Rules run before funds move

Ringside enforces per-transaction, session, and rolling 24-hour caps. Owners can restrict recipients, make an agent read-only, or stop all spending with a kill switch. The agent has get_policy for inspection, but no tool to change its own policy.

The owner dashboard requires a wallet signature for policy changes. Self-hosted policy and pairing data remain on the agent machine. Hosted mode stores the agent key encrypted at rest and enforces a durable spend reservation before sending a transaction. These defaults are for devnet test funds, not a guarantee against loss.

One MCP surface, 25 tools

Names below are the names your MCP client discovers. Aliases are listed so prompts can use either wording.

Fields ending in ? are optional. Amounts are decimal strings. The nine swap and escrow tools are discoverable but return an unavailable error in this release.

Request. Pay. Verify. Serve.

A seller can request payment for a resource, the buyer agent can pay privately, and the seller can verify the resulting receipt before returning data. The demo API responds with HTTP 402 until verification passes; replayed receipts are rejected.

The SOL seller flow passed on localnet. The request nonce is held by the verifier and has a short expiry; it is not yet bound to an on-chain memo. The verifier also rejects payments older than the request.

Know what the chain reveals

“Private” describes the payment fields hidden by the default ring transfer. It does not make every part of a transaction invisible.

Funding is public; payments are private. A public observer may infer relationships from timing and visible addresses. In self-hosted mode the agent key remains local. In hosted mode Ringside holds an encrypted agent key and can access it to execute authorized requests.

What works today

This table reflects the Oct 12, 2026 devnet release. STATUS.md is the detailed, updated record of checks, blockers, and next steps.

When something stops