Cowrie Research

secret-key-labs-primary-sources-2026-08-08

4 min read

Secret Key Labs primary-source snapshot

Last reviewed: 2026-08-08 UTC

Why this snapshot exists

  • Xverse already had a strong product-layer source snapshot under xverse-primary-sources-2026-04-29.md.
  • This addendum is narrower: it captures the company boundary around Secret Key Labs Limited, especially where legal identity, API admission, hosted endpoints, and centrally operated agent tooling become the practical control surface.

Key primary-source takeaways

  • URL: https://www.xverse.app/privacy
  • Key takeaways:
    • The privacy policy explicitly names Secret Key Labs Limited as the company behind the Xverse app.
    • The policy says the company may collect usage, device, and account-related information while still emphasizing that it does not hold users’ private keys.
    • The page also makes the organizational boundary explicit for support and legal process handling, including the contact path hello@secretkeylabs.com.

2) Terms / EULA boundary

  • URL: https://www.xverse.app/terms
  • Key takeaways:
    • The Xverse application EULA is a binding agreement between the user and Secret Key Labs Limited.
    • The terms say the application is licensed, not sold, and reserve broad rights in the application and related content/services to the company and its licensors.
    • The terms also describe company-controlled feature surfaces such as the non-custodial wallet shell, website-hosted content/services, and fee-bearing app features like stacking-pool access fees.

3) Developer platform framing

  • URL: https://docs.xverse.app/
  • Key takeaways:
    • The docs homepage says the infrastructure behind it is now open to developers, which is the clearest first-party signal that Xverse is not just an app but a company-run infrastructure stack.
    • It splits the operating surface into Xverse API, Sats Connect, Xverse Agent Wallet, and MCP Server.
    • The same page points developers at the secretkeylabs GitHub organization, reinforcing that the company boundary is not hidden behind the Xverse brand.

4) API admission and endpoint control

  • URL: https://docs.xverse.app/api/get-started.md
  • Key takeaways:
    • The official API endpoints are https://api.secretkeylabs.io and https://api-signet.secretkeylabs.io.
    • The docs direct developers to api-dashboard.xverse.app/login to start a free trial and obtain API keys.
    • The same page says every endpoint also supports pay-per-request access via Lightning over the Machine Payments Protocol, which means admission and pricing are company-shaped even when API keys are bypassed.

5) Hosted data/API operator boundary

  • URL: https://docs.xverse.app/api/xverse-api.md
  • Key takeaways:
    • Xverse says the APIs are production-grade services already used by the Xverse wallet itself and now opened to outside developers.
    • The company packages Bitcoin RPC, indexing, market data, swap aggregation, inscription workflows, and cross-layer data access behind one vendor endpoint surface.
    • The docs explicitly market machine-payable access at 1 sat per call, which is a strong clue that Secret Key Labs is shaping not just infrastructure but the commercial access model around it.

6) Centrally hosted MCP boundary

  • URL: https://docs.xverse.app/api/mcp-server.md
  • Key takeaways:
    • The MCP docs say the server is centrally hosted at https://mcp.secretkeylabs.io/mcp.
    • Authentication reuses the same Xverse API key, tying agent access directly to the company-run API admission layer.
    • The docs say the MCP server exposes 54 read-only tools across Bitcoin, Ordinals, Runes, BRC-20, Spark, and swaps, which makes the company boundary relevant for AI-agent-facing workflow too.

7) Security and release-trust posture

  • URL: https://www.xverse.app/security
  • Key takeaways:
    • Xverse says it is self-custodial, keeps keys encrypted on-device, and supports Ledger and multisig via Asigna.
    • The security page also says the code is open source and regularly audited, which matters because Secret Key Labs controls the release, audit-publication, and documentation shell users are asked to trust.

8) Public code footprint

  • URL: https://github.com/secretkeylabs
  • Key takeaways:
    • The public org continues to be the company-facing code and repo boundary for Xverse libraries and related tooling.
    • Even where the brand shown to users is Xverse, the public maintenance and repo authority still sit under secretkeylabs.

Research notes

  • The company split clears the bar because the useful question is not only what can Xverse do? but which named operator ships the app, issues API access, runs the hosted MCP and data endpoints, and defines the legal/privacy/support shell around that stack?
  • Keep projects/xverse on the product and access-stack surface.
  • Use companies/secret-key-labs for the operator boundary around release workflow, hosted infrastructure, API admission, pricing model, and agent-facing packaging.

Graph View