Back to Browse

Agent Wallet Demo MCP Server

FinanceUse Caution4.2MCP RegistryLocal
Free

Server data from the Official MCP Registry

Governed USDC wallet for AI agents — policy gates, spending caps, and Ed25519-signed receipts.

About

Governed USDC wallet for AI agents — policy gates, spending caps, and Ed25519-signed receipts.

Security Report

4.2
Use Caution4.2High Risk

This is a demonstration client for the dingdawg-agent-wallet MCP server package. The code is well-structured, contains no hardcoded secrets, and properly uses environment-based package invocation via StdioClientTransport. No malicious patterns detected. Minor concerns around input validation in the demo scripts and lack of error handling for edge cases do not significantly impact the score given the educational nature of the code. Supply chain analysis found 2 known vulnerabilities in dependencies (0 critical, 2 high severity). Package verification found 1 issue (1 critical, 0 high severity).

4 files analyzed · 7 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

HTTP Network Access

Connects to external APIs or services over the internet.

env_vars

Check that this permission is expected for this type of plugin.

process_spawn

Check that this permission is expected for this type of plugin.

Unverified package source

We couldn't verify that the installable package matches the reviewed source code. Proceed with caution.

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "io-github-dingdawg-agent-wallet": {
      "args": [
        "-y",
        "agent-wallet-demo"
      ],
      "command": "npx"
    }
  }
}

Documentation

View on GitHub

From the project's GitHub README.

dingdawg-agent-wallet — live demo

Shows governed agent wallet enforcement in action: allow, deny, step-up, allowlist — all in 5 seconds. No API keys. No blockchain required.


What it demonstrates

▶ provision_wallet
  wallet_id:    demo-wallet-abc123
  daily_cap:    $200 USDC
  per_call_cap: $100 USDC

▶ governed_spend — $25 USDC (allowed)
  ✓ AUTHORIZED
  receipt_id:      6aba84a6-...
  daily_remaining: $175 USDC
  next_step:       wallet.sendToken({ assetId: "usdc", amount: "25", destination: "0xVendorABC123" })

▶ governed_spend — $150 USDC (exceeds per-call cap)
  ✗ DENIED
  reason:      Amount 150 USDC exceeds per-call cap 100 USDC
  receipt_id:  cd7a7aa8-... (denial is logged too)

▶ governed_spend — $75 USDC (step-up required)
  ⚠ STEP-UP REQUIRED
  reason: Amount 75 USDC > step-up threshold 50 USDC — MFA required
  fix:    Pass approval_token from your authorization flow

▶ governed_spend — unknown recipient (not in allowlist)
  ✗ DENIED
  reason: Recipient 0xUnknownAddress not in allowlist

▶ wallet_audit
  chain_verified: true ✓
  total_receipts: 5
  [17:02:18] DENY  $10 USDC    governed_spend
  [17:02:18] DENY  $75 USDC    governed_spend
  [17:02:18] DENY  $150 USDC   governed_spend
  [17:02:18] ALLOW $25 USDC    governed_spend
  [17:02:18] ALLOW              provision_wallet

Every action — allow AND deny — produces an immutable receipt. chain_verified: true means the full chain is tamper-evident — any modification is detectable.


Run it

git clone https://github.com/DingDawg/agent-wallet-demo
cd agent-wallet-demo
npm install
node demo.mjs

The package

dingdawg-agent-wallet — 5 MCP tools that wrap any agent wallet with policy enforcement and an immutable audit trail.

npm install dingdawg-agent-wallet
ToolWhat it does
provision_walletCreate wallet with spend policy (daily cap, per-call cap, allowlist)
governed_spendPolicy check → authorize → immutable receipt
governed_receiveAccept payment with tamper-evident receipt
wallet_policyUpdate limits and allowlists at runtime
wallet_auditFull receipt chain — chain_verified: true

Coinbase AgentKit gives your agent a wallet. DingDawg gives it a conscience.


Why this matters

AI agents can now hold USDC and spend autonomously. The infrastructure exists. What doesn't: who enforces what the agent is allowed to spend, on what, for whom — and proves it happened correctly.

  • governed_spend authorizes then returns the exact agentkit_call SDK method to execute on-chain
  • Every denial is logged — you can prove what your agent didn't do
  • chain_verified: true means the audit trail is tamper-evident — any modification is detectable

npm · DingDawg

Reviews

No reviews yet

Be the first to review this server!