Everything the Vertalo MCP Server does, it does through the same GraphQL API our clients have integrated for years. This page is for builders who want to know exactly what's underneath — and when to call it directly.
Your agent speaks MCP: it discovers tools, asks clarifying questions, and acts under a delegated role. The server translates every tool call into the same typed GraphQL operations, under the same role model and row-level authorization the API has always enforced. Nothing about your tenant's security posture changes based on which door you walk through.
Vertalo’s MCP server gives your engineering team a programmatic surface for building real-world asset management, investor onboarding, and tokenization applications on top of our platform. Access is machine-to-machine only: your backend authenticates via an OAuth client-credentials flow against AWS Cognito, exchanging the client ID and secret we issue for a short-lived access token, then presents that token as a Bearer credential alongside your account-scoping header on every request over Streamable HTTP.
Because these credentials authenticate your application rather than an individual user, they must never be embedded in browser code, mobile binaries, or any client-side context — store them in a secrets manager and confine the token exchange to a middleware or backend service you control, minting tokens on demand rather than persisting them. From there, connect using the MCP client library of your choosing to compose our curated operations into your own onboarding flows, cap table views, and issuance workflows, with your application handling user authentication and authorization at its own layer.
Supported clients. Vertalo’s MCP server is designed for server-to-server integration. Credentials issued to your organization must be used from a backend service under your control; interactive agent and desktop assistant clients are not a supported configuration.
| You're doing | Use | Because |
|---|---|---|
| Exploring, prototyping, agent workflows, back-office automation | MCP Server | Discovery is built in — your agent reads what's possible and acts under supervision, with delegation records for every write |
| High-volume, deterministic production integration | GraphQL API | Typed schema, predictable contracts — the same operations the MCP server uses, without the conversation |
| Most clients, honestly | Both | Agents to build and operate; the API for what runs every day. Same tenant, same register |
200+ operations across the full entity model — issuers, assets, rounds, allocations, holders, documents — so an integration is weeks, not months, with no disruption to the systems you already run.
One golden source for the cap table and everything attached to it.
The VSP keeps the register authoritative while representing holdings on the chain each deal calls for — Ethereum, Tezos, Aptos, and counting.
Hosted · Dedicated · 1st Party (your own AWS). Same API at every tier.
In January 2026, the SEC's divisions set out the taxonomy of tokenized securities. Vertalo supports every model in it — operating as an SEC-registered transfer agent at the center of the issuer-sponsored approach.
The master securityholder file lives on-chain; a token transfer is the security transfer. Vertalo's home base as a registered TA.
Records stay off-chain; the token effects and notifies the transfer on the master securityholder file.
A third party tokenizes a security held in custody; the token evidences the holder's interest.
A token giving synthetic exposure to a referenced security, issued by a third party.
A security-based swap formatted as a token, for eligible contract participants.
SEC Divisions' Statement on Tokenized Securities → · Jan 28, 2026. A staff statement, not a rule.
The corpus behind the taxonomy above — summarized in plain language, linked to the official text.
MCP and GraphQL are both data planes: tools in, JSON out. What you build against them — your portal, your product, your customer experience — is yours, and every client build is a reference, not an IP dispute. Vertalo's platform, schema internals, and resolvers stay on Vertalo's servers.
There's no SDK with embedded logic to maintain, and no Vertalo code in your stack to audit.
The process, the regulations, and the options behind tokenizing on Vertalo — drawn from enacted law, jurisdiction by jurisdiction. Steps marked in teal are the ones Vertalo handles as your SEC-registered transfer agent and tokenization platform.
One assistant for the whole site — tap a question to open it, or use the button in the corner any time.
Alongside the register, an agent can pull market context from The Token Playbook — the digest, the news wire, the regulatory corpus. This is that call, running live on this page.
Sandbox access is open — bring your agent or your integration team. Same tenant, same register, either door.
Tell us who you are and what you hold. A person reads every request.
✓ Request received
A person, not a queue, reads every request. We’ll come back to you within one business day.
30 minutes, no hard sell. We typically respond within one business day.
No spam. We reply within one business day.
We'll be in touch within one business day.