AnchoredIP

MCP for agents

An assistant can buy an address and bring up a tunnel without a human in the loop. The free trial is what makes it work — there is no card to ask anyone for.

The endpoint

https://api.anchoredip.com/api/mcp/

Streamable HTTP transport. One endpoint, POST JSON-RPC, answers application/json. The server is stateless: it streams nothing and holds no session, so you may send initialize and never mention it again. Protocol versions 2025-06-18, 2025-03-26 and 2024-11-05 are spoken; we answer in yours where we can.

No authentication to connect. Ordering is what needs a credential, and the credential is issued by ordering.

Adding it to a client

Claude Code

claude mcp add --transport http anchoredip https://api.anchoredip.com/api/mcp/

Claude Desktop — claude_desktop_config.json

{
  "mcpServers": {
    "anchoredip": {
      "type": "http",
      "url": "https://api.anchoredip.com/api/mcp/"
    }
  }
}

Cursor — .cursor/mcp.json

{
  "mcpServers": {
    "anchoredip": { "url": "https://api.anchoredip.com/api/mcp/" }
  }
}

anything speaking raw JSON-RPC

curl -s https://api.anchoredip.com/api/mcp/ \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

The tools

Tool	Arguments	What it does
list_plans	—	The catalogue with live prices, term lengths and which payment methods each plan accepts.
order_lease	plan, organization_name, country, billing_email	Places an order. Returns the access token — the only credential for that lease. A trial activates immediately.
lease_status	access_token	Addresses held, tunnels, expiry, what is owed.
create_tunnel	access_token, routing_mode?, transport?, label?	Provisions a peer and returns its configuration file, once.
revoke_tunnel	access_token, tunnel_id	Retires a peer and hands its slot back to the plan's allowance.
renew_lease	access_token, plan?	Invoices another term and keeps the same addresses. How a trial becomes a paying customer.
set_autorenew	access_token, enabled	Stops a card subscription charging again, or starts it. Not a cancellation — the term already paid for runs out.
set_reverse_dns	access_token, address, hostname	Publishes a PTR record. An empty hostname removes it.

Four calls, start to finish

1 — what is on offer

{"jsonrpc":"2.0","id":1,"method":"tools/call",
 "params":{"name":"list_plans","arguments":{}}}

2 — order the free trial

{"jsonrpc":"2.0","id":2,"method":"tools/call",
 "params":{"name":"order_lease","arguments":{
   "plan":"trial",
   "organization_name":"Example GmbH",
   "country":"DE",
   "billing_email":"ops@example.com"}}}

3 — check what it got

{"jsonrpc":"2.0","id":3,"method":"tools/call",
 "params":{"name":"lease_status","arguments":{"access_token":"…"}}}

4 — get a working config

{"jsonrpc":"2.0","id":4,"method":"tools/call",
 "params":{"name":"create_tunnel","arguments":{
   "access_token":"…",
   "routing_mode":"full",
   "label":"agent-provisioned"}}}

The fourth response contains the whole .conf. Write it to a file and run wg-quick up.

Notes for whoever is driving

The access token is shown once and is not recoverable from the protocol. Give it to the user in plain sight and tell them to keep it — do not summarise it away. It can be re-sent to the billing email from /leases, and that is the only route back.

The configuration contains a private key and is returned once. Write it to a file for the user in the same turn. Nothing stores it.

Choose the routing mode deliberately. source is the default and leaves the machine's default route alone, but it is written with wg-quick PostUp rules and runs on Linux under wg-quick and nowhere else. A desktop or mobile client reads it, finds no routes to install and fails to connect while logging nothing. For anything but a Linux host, ask for full.

Report the price honestly. An annual plan quotes a monthly headline like everyone else; charged_per_term_usd is what the customer actually pays, and it is twelve times bigger.

Give slots back. An agent that provisions a peer per short-lived worker and never revokes one exhausts the plan's allowance and then cannot bring the next machine up. Call revoke_tunnel when a worker is retired. Revoking the peer that holds the public address stops inbound connections to it, and no surviving machine can be promoted to take it over — a configuration is issued once, so the address moves only to a tunnel created after it.

Stopping a subscription is not a cancellation. set_autorenew with enabled: false stops the next charge; the lease runs to the end of the period already paid for and the same call turns it back on. Only a card subscription can be stopped — USDT and bank transfers are payments the customer sends us, so there is nothing of ours to cancel.

IPv6 is delegated but not yet reachable from the public internet — our upstream does not carry the announcement. It works between the customer's own machines over the tunnel today. Say so rather than offering it as an internet-facing address; anything the internet must reach needs the IPv4 on a paid plan.

Limits and safety

Every tool is throttled at the rate the website uses for the same work, because it costs us the same whichever door it comes through: ordering and renewing five an hour, tunnels and DNS writes sixty, reading a lease six hundred. Reading the catalogue and the protocol handshake are on a separate, generous budget, so an assistant exploring the tools does not exhaust anything before it can buy.

Every tool goes through the same code the website uses. There is no separate ordering path here that could allocate an address the allocator would have refused.

Requests carrying a browser Origin header from an unknown site are refused, as the specification requires. MCP clients send none and are unaffected.