The Agent Builds the Bytes. Your Wallet Still Presses Send.

A ghostwriter who drafts the cheque is not the person who signs it. Hedera’s hosted MCP is that ghostwriter. MCP is just the plug that lets a chat agent talk to Hedera’s servers the way it already talks to files and browsers. The docs now put the pen in your wallet.

The endpoint is https://agentic-testnet-mcp.hedera.com/mcp. Claude, Cursor, Codex, ChatGPT Desktop, or anything else that speaks OAuth 2.1 can attach. Hedera is a public proof-of-stake ledger with hashgraph consensus. Their docs ask you not to call it a blockchain. Fine. The custody pattern is what matters.

The mechanism

Current model, from the live docs — this supersedes the July 2026 blog, which had the server handing raw bytes back to the client:

1. You sign in with HashPack or Kabila over WalletConnect. The old x-hedera-account-id header is ignored. The account is whatever the wallet session says.
2. The agent asks for something that changes state. The server builds the transaction, freezes it, ships it to the wallet, and returns a requestId. It does not submit. It does not hold keys. It never sees the signature.
3. The agent polls check_signing_status. You will see awaiting_approval

   Limits that should scare you a little: the hosted box is testnet only. Mainnet means you self-host the Agent Kit MCP. Single-key accounts only — threshold and key-list accounts cannot even sign in. No spend caps, no daily limits, no recipient allowlists. The wallet prompt is the entire control surface.

   What the numbers mean

   July’s blog launched hosted MCP under a different signing story. Current docs retire that path. Do not draw one architecture out of both. The sentence that survives both eras: the server never signs, never submits, never holds keys.

   There is no public count of how many wallet-approved MCP transactions have actually cleared testnet. Evaluate the split — agent proposes, human spends — not a throughput brag.

   The operator lesson

   Put this next to Coinbase for Agents and Binance Agent OS when those ship. Those shops ring-fence a sub-account: the bot can trade inside the pen, it cannot send funds out the door. Hedera’s hosted MCP is the other pattern. The bot may write every byte. You still press send.

   If you wire it: stay on testnet, expect three minutes, treat unverifiable contract calls as “trust the summary,” and do not pretend a wallet popup is a spending policy. Caps are your problem until Hedera ships them — or until you self-host with your own rules on mainnet.

   The bank sentence is shorter than at the exchanges: the agent drafts; you sign.

   Sources

   • Hedera docs, “Network MCP Server” (hosted, current wallet-sign model) — https://docs.hedera.com/solutions/ai/hosted-mcp-server
   • Hedera blog, “Hedera MCP & Agent Skills,” 7 July 2026 — https://hedera.com/blog/hedera-mcp-agent-skills/ (launch context; signing model superseded)
   • Related CW: Coinbase for Agents / Binance Agent OS drafts — ring-fence vs propose-vs-spend

   , confirming, executed, rejected, failed, expired, needs_reauth.

4. executed means the mirror node confirmed it. Not “the wallet claimed it broadcast.”

You have about 180 seconds, which is Hedera’s usual validity window. Miss it, rebuild. For contract calls and file ops, walletVerifiable is false — the wallet screen is not an independent check of what those transactions actually do. Read the tool’s summary before you tap approve, or you are signing a paragraph you did not read.