ton-proof

TON Proof Authentication

Generate a signed TonConnect proof-of-ownership payload for a domain and challenge string. This proves control of the active wallet without sending a transaction.

MCP Tools

Tool	Required	Optional
generate_ton_proof	domain, payload	walletSelector
get_wallet	—	walletSelector

Workflow

1. Get the exact domain and payload from the user or the verifying service
2. Do not edit, normalize, decode, or invent the payload; it is part of the signed proof
3. Ask one short yes/no confirmation before sending; If there are tools for dialogs/confirmation available, use them instead of a free-text prompt.
4. Call generate_ton_proof with the domain and payload
5. Return the proof JSON to the user, or submit it to the service only when the user explicitly asked for that integration step

Output

The proof includes:

• address: active wallet address in raw format
• chain: TON Connect chain id (-239 for mainnet, -3 for testnet)
• walletStateInit: wallet state init in base64
• publicKey: wallet public key
• timestamp: Unix timestamp used in the proof
• domainLengthBytes and domainValue: signed domain metadata
• signature: base64 TonProof signature
• payload: original challenge payload

Notes

• TonProof is for authentication and proof of wallet ownership; it does not transfer funds
• TonProof still requires signing access. Imported read-only agentic wallets need operator key rotation completed before this tool can generate a proof
• Only generate a proof for domains and payloads the user intentionally provided or that came directly from the verifying service
• If multiple wallets are configured, pass walletSelector instead of changing the active wallet for a one-off proof
• If no wallet is configured, use the ton-create-wallet skill first