Summary

Keyless by design; the guardrails are guards, not enforcement.

The design choice worth understanding is where signing happens: the server builds a bounded order with the receiver pinned and hands it back, and your agent signs it. That means a compromised or prompt-injected server cannot move funds. The README then says the harder thing out loud — those off-chain helpers are guards, not enforcement, and a prompt-injected agent can ignore them. For an agent signing with no human in the loop it points you at where policy actually has to live: a Safe account, a deterministic policy gate, spend caps, and the same policy checked again at ingestion.

What it is

The agent-facing side of Ophis, an intent-based DEX aggregator forked from CoW Protocol with a natural-language layer on top. It is a hosted Streamable-HTTP MCP server deployed as a Cloudflare Worker. Orders settle in a batch auction where every trade in the batch clears at one uniform price, so sandwiching and front-running are structurally absent rather than mitigated.

What you get

14 tools covering intent parsing, canonical token resolution, chain discovery, quoting, bounded order build and validation, submission, rebate and integrator lookups, balances, portfolios, gas, charts, and expected-surplus comparison
`build_order` returns a bounded, ready-to-sign EIP-712 order with the receiver pinned to the owner; the agent signs locally with its own key and submits — the server never holds a key and never signs
`list_chains` to resolve settlement per chain rather than assuming, since Ophis-operated and CoW-hosted chains have different settlement contracts and orderbook hosts
Live across 13 EVM chains, with Ophis-operated settlement on Optimism (chain 10), Unichain (130) and Robinhood Chain (4663), and CoW-hosted settlement elsewhere
Non-custodial by construction: every order is signed in your own wallet with EIP-712 or ERC-1271, and Ophis cannot move, freeze or recover funds — the signature is the only trust boundary
Machine-readable discovery manifests under `https://ophis.fi/.well-known/` — `mcp.json`, `ai-plugin.json`, agent skills and an RFC 9727 API catalog, plus root-served `auth.md`, `llms.txt` and `openapi.json`

Requirements

No account, no auth, no API key. Point any MCP client at `https://mcp.ophis.fi/mcp`, which speaks Streamable-HTTP. A bare request without an `Accept: text/event-stream` header returns HTTP 406 — that is the transport negotiating, not an outage. To actually trade you need a wallet that can sign EIP-712 or ERC-1271, since the agent signs locally. Fees are a 0.01% base plus a capped share of improvement over the reference quote. Agents building orders directly can install `@ophis/sdk`, which encodes four fork details that fail silently if guessed — the per-chain orderbook host, the EIP-712 domain with the correct verifying contract, the CIP-75 partner-fee fragment, and a receiver-pinning assertion. GPL-3.0.