Cowrie Research

secret-key-labs

4 min read

Secret Key Labs Limited

  • Name: Secret Key Labs Limited
  • URL: https://www.xverse.app/
  • Category: wallet-and-access-stack operator / hosted Bitcoin data and MCP company / release-and-admission boundary around Xverse
  • Tags: bitcoin-ecosystem stacks-ecosystem
  • Summary: Secret Key Labs belongs in companies/ because the useful question is not only what can Xverse the wallet and access stack do? but which named operator ships the app, controls the legal and privacy shell, issues API access, runs the hosted MCP and data endpoints, and packages machine-payments access around that stack? The project note explains the wallet, Sats Connect, API, and agent-wallet surfaces; this entity note is for the named company boundary that turns those surfaces into a hosted release, admission, pricing, and support shell.
  • What it does:
    • Operates Xverse as a self-custodial wallet plus developer-access stack spanning the wallet app, Xverse API, Sats Connect, Xverse Agent Wallet, and the hosted MCP server
    • Maintains the legal and privacy perimeter for the application, with first-party policy and terms materials explicitly naming Secret Key Labs Limited as the company behind the Xverse app
    • Issues API access through an Xverse dashboard and controls the official hosted endpoints at api.secretkeylabs.io, api-signet.secretkeylabs.io, and mcp.secretkeylabs.io
    • Packages machine-payable API access over Lightning / MPP, which means the company shapes not only endpoint access but also the commercial and agent-facing entry path around the stack
    • Maintains the public code and repo boundary through the secretkeylabs GitHub organization, which exposes Xverse libraries, Sats Connect, the browser extension, and related tooling under the company namespace
  • Key claims:
    • The Xverse privacy policy explicitly names Secret Key Labs Limited as the company behind the app, which is the clearest first-party signal that the operator boundary matters separately from the product note
    • The Xverse terms say the application is licensed, not sold, and frame the agreement as one between the user and Secret Key Labs Limited, which makes the company the legal shell around the wallet and related services
    • The developer docs say the infrastructure behind it is now open to developers and split that stack into Xverse API, Sats Connect, Xverse Agent Wallet, and MCP Server, which is a strong first-party sign that this is a company-run access platform rather than only a wallet app
    • The API docs say the official endpoints are https://api.secretkeylabs.io and https://api-signet.secretkeylabs.io, direct developers to the Xverse dashboard for API keys, and also expose pay-per-request machine-payments access, which makes admission and pricing a company-shaped control surface
    • The MCP docs say the server is centrally hosted at https://mcp.secretkeylabs.io/mcp and reuses the same Xverse API key, which ties agent-facing workflow directly to the company-run API admission layer
    • The security page says Xverse is self-custodial, open source, and regularly audited, which matters because Secret Key Labs still controls the release, audit-publication, and documentation shell users are asked to trust
    • The public GitHub organization continues to expose Xverse libraries, Sats Connect, agent skills, and the browser extension under secretkeylabs, reinforcing that the company boundary remains visible in maintenance and repo authority even when the user-facing brand is Xverse
  • Whitepaper: No separate company whitepaper is the point here. The strongest primary materials are the focused source capture in ../whitepapers/secret-key-labs-primary-sources-2026-08-08.md, plus the Xverse site, security page, developer docs, and public GitHub organization.
  • Sources:

Internal linkages

  • Product-layer note: xverse.
  • Useful wallet-and-access company contrasts: alby, chainapsis, and hiro.
  • Keep the sharper product-layer read on xverse when the question shifts back from the hosted operator shell to wallet and access-stack capabilities.

Protocol / company boundary

  • Keep xverse on the product and access-stack surface: wallet UX, Sats Connect methods, Xverse API capabilities, the agent-wallet packaging, and the Bitcoin-adjacent rails the product bundle makes easy to use.
  • Keep this note on Secret Key Labs Limited as the named operator that ships releases, controls the privacy and legal shell, issues API access, runs the hosted API and MCP endpoints, and defines the machine-payments and support boundary around the stack.
  • That split matters because what can Xverse expose to users, apps, and agents? and which organization controls the easiest hosted, authenticated, and supported path around that stack? are related but not identical questions.

Control surface

  • Practical authority sits in app release workflow, legal and privacy policy, API-key issuance, hosted endpoint operation, MCP availability, pay-per-request pricing, documentation, and the public repo boundary developers treat as canonical.

  • Even when the wallet remains self-custodial, builders and agents can still inherit a strong Secret Key Labs dependency through the dashboard, hosted data plane, MCP tools, and the machine-payments access model wrapped around them.

  • Read the durable risk here as who controls the release and hosted access shell around Xverse?, not only as is the wallet self-custodial?

  • Last reviewed: 2026-08-12 UTC

Graph View

Backlinks