Overview

The Maestro MCP (Model Context Protocol) Server exposes a secure RPC gateway for managing Bitcoin nodes and wallets using the Maestro RPC API. It acts as a lightweight proxy and policy layer in front of Bitcoin Core (or compatible RPC endpoints), enabling authenticated and auditable access to wallet operations, transaction broadcasting, and blockchain queries from client applications or automation systems.

This server is useful when you need centralized, programmatic control over Bitcoin infrastructure without exposing raw node credentials directly to each client. Typical uses include delegating limited RPC access to services, integrating Bitcoin operations into backend systems, and adding monitoring, rate limiting, and access controls around node RPC calls.

Features

Secure RPC forwarding to Bitcoin Core or compatible RPC backends
Token/API-key based authentication and optional TLS
JSON-RPC and REST-friendly endpoints for common Bitcoin operations
Request logging and optional structured audit trails
Rate limiting and basic access control lists (ACLs)
Connection pooling and configurable RPC timeout/retry settings
Metrics endpoint for integration with Prometheus or monitoring tools
Docker-ready for simple deployment

GitHub: https://github.com/maestro-org/maestro-mcp

Installation / Configuration

You can run the Maestro MCP server via Docker or build from source. Below are example configurations and environment variables commonly used.

Run with Docker (example):

docker run -d \
  --name maestro-mcp \
  -p 8080:8080 \
  -e BITCOIN_RPC_URL="http://user:password@bitcoin-node:8332" \
  -e MCP_API_KEY="replace-with-secure-key" \
  -e MCP_PORT=8080 \
  -e MCP_TLS=false \
  maestroorg/maestro-mcp:latest

Example docker-compose.yml:

version: "3.7"
services:
  maestro-mcp:
    image: maestroorg/maestro-mcp:latest
    ports:
      - "8080:8080"
    environment:
      BITCOIN_RPC_URL: "http://user:password@bitcoin-node:8332"
      MCP_API_KEY: "replace-with-secure-key"
      MCP_PORT: "8080"
      MCP_TLS: "false"
    restart: unless-stopped

Common environment variables

BITCOIN_RPC_URL: URL to the Bitcoin Core RPC endpoint (including credentials)
MCP_API_KEY: API key used to authenticate client requests
MCP_PORT: HTTP port the MCP server listens on (default 8080)
MCP_TLS: enable/disable TLS (boolean)
MCP_TLS_CERT_PATH / MCP_TLS_KEY_PATH: paths to TLS certificate and key when TLS enabled
RPC_TIMEOUT: request timeout for forwarded RPC calls (seconds)
RATE_LIMIT_RPS: optional requests-per-second rate limit

Building from source (Go example):

git clone https://github.com/maestro-org/maestro-mcp.git
cd maestro-mcp
go build ./cmd/maestro-mcp
./maestro-mcp --config ./config.yaml

Example config.yaml (partial):

server:
  port: 8080
  tls:
    enabled: false
auth:
  api_keys:
    - "replace-with-secure-key"
backend:
  bitcoin_rpc_url: "http://user:password@bitcoin-node:8332"
  timeout_seconds: 30
limits:
  rate_rps: 10
logging:
  level: info
metrics:
  enabled: true
  path: /metrics

Available Resources

Maestro MCP GitHub repository: https://github.com/maestro-org/maestro-mcp
Bitcoin Core RPC documentation: https://developer.bitcoin.org/reference/rpc/
Metrics: /metrics endpoint (Prometheus format) when enabled
Health: /health or /ready endpoints for orchestration probes
Audit logs: configurable structured logs (JSON) written to stdout or a file

The server typically exposes a single RPC proxy endpoint and several helper REST endpoints. Check the repo README or /help endpoint for an up-to-date list.

Use Cases

Automated transaction broadcasting: backend services can construct and sign transactions client-side, then call Maestro MCP to broadcast via the node’s sendrawtransaction without exposing node credentials.

Example: broadcast a signed tx via curl

curl -X POST https://mcp.example.com/rpc \
  -H "Authorization: Bearer <API_KEY>" \
  -H "Content-Type: application/json" \
  -d '{"method":"sendrawtransaction","params":["<hex>"], "id":1, "jsonrpc":"2.0"}'

Read-only blockchain queries: analytics or monitoring systems query getblockcount, getblockhash, or getblock for chain state with rate-limited access.
Wallet orchestration: centralize wallet-related RPCs (listunspent, createfundedpsbt, walletprocesspsbt) behind ACLs, enabling safe multi-service access patterns.
CI / integration tests: ephemeral test suites can use MCP as a predictable gateway to a regtest node with RBAC and metrics for observability.

Example Endpoint Mapping

MCP Endpoint	Description	Notes
POST /rpc	Generic JSON-RPC proxy to Bitcoin RPC methods	Requires API key
GET /metrics	Prometheus metrics	Optional
GET /health	Health check for orchestration	Ready and liveliness probes

Note: Exact endpoints may vary by release. Refer to the repository README or /help endpoint after deployment.

Best Practices

Use TLS and strong API keys in production
Limit allowed RPC methods for less-privileged keys via ACLs
Enable monitoring (metrics + logs) to track usage and errors
Place MCP behind an API gateway or firewall for an additional security layer

For more details and latest usage patterns, see the project on GitHub: https://github.com/maestro-org/maestro-mcp.

Maestro MCP Server for Bitcoin RPC API