Tools
Picnic agents exposes eleven tools in two groups. Each call requires explicit scope approval.
Read tools
These return account state. They never move funds.
get_balances— token balances across the user's smart accounts. Each balance includes a CAIPassetId, contract address, symbol, decimal-formatted amount, and value in USD/EUR/BRL.get_transactions— paginated transaction history. Per-flowassetId+formattedAmount; per-txreceipts: [{chainId, txHash}]. Card purchases include merchant, MCC, and billing fields. Type-specific blocks for ramps, swaps, investments, and card purchases.get_profile— userId, email, currency-keyedramps(BRL/EUR onboarding KYC across BRLA/Avenia/Monerium with normalizednone|pending|approved|rejectedstatus), andcardsarray (Gnosis Pay).get_card— Picnic card details: status, balances, allowances, period; per-currency token assetId and decimal-formatted amounts. Virtual cards inherit balances from the physical sibling.get_smart_accounts— list of smart accounts (picnic + gnosisPay) controlled by the user's passkey, with chain ID and account type.get_action_status— read the current state of any action byaction_id. Use as a polling fallback when your MCP client doesn't rendernotifications/resources/updatedfrompicnic://action/{action_id}.
Action tools
Each tool is atomic: one MCP call covers proposal, signing handoff, and execution. The tool returns a sign_url for the user to authorize via passkey and a resource_uri (picnic://action/{action_id}) you can subscribe to for live status updates. Execution kicks off server-side as soon as the user signs — there is no separate execute step.
transfer— send a token from the user's smart account to a 0x address or ENS name.swap— swap between two CAIPasset_ids (same-chain or cross-chain). Optionalslippageandprovider. The sign page shows a slippage banner at ≥1%.card_freeze— freeze the user's Picnic (Gnosis Pay) card. Off-chain — signature is verified via EIP-1271 SIWE.card_unfreeze— symmetric counterpart tocard_freeze.card_limit— change the card's daily spending limit. Goes through Picnic's delay-module + scheduled-tx pattern (not 4337). Daily only.
Action lifecycle
proposed → signed → submitted → broadcast → executed
Other terminal states: failed (on-chain revert), expired (TTL elapsed before signing), rejected (user denied at the sign page).