Coinbase Gives AI Agents a Trading Sub-Account — No External Withdrawals

A hotel keycard that opens the minibar but not the front door is not a bank. It is a scoped permission. Coinbase for Agents is that keycard, wired into Advanced Trade.

The docs are blunt. Point an AI harness at https://agents.coinbase.com/mcp (or use the CLI), sign in, pick a portfolio, and the model can preview and place orders inside what you funded. Supported today: ChatGPT, Grok, Perplexity Computer, Claude, Claude Code. Codex is listed as coming soon. Other or custom harnesses get the CLI path.

The mechanism

Isolation is the product, not the chatbot. Create a separate Advanced portfolio. Fund it with only what you are willing to lose. Scope the agent — OAuth portfolio selection on remote MCP, or API-key account scope on the CLI — to that book. Blast radius is the balance you put in the drawer, not the whole Coinbase relationship.

What the agent can touch, per Coinbase’s own overview: spot on 900+ pairs; US Derivatives CFM dated futures; S&P 500 equities on Advanced Trade; portfolio reads and management; instant zero-fee USDC/USD conversions. Isolated agent portfolios are called out as spot-scoped to the selected book; US Derivatives sit only in the default portfolio if you include it in the key.

The hard fence is transfer policy. Enable Trade and Transfer on a CDP key and Transfer still means move funds between your portfolios only. It does not allow withdrawals to external blockchain addresses. That is the same containment pattern we keep seeing across venues: trade yes, egress no, human still owns the off-ramp.

x402 pay-per-request inside Coinbase for Agents is listed as coming soon (alongside prediction markets and more asset classes). Agents that need paywalled research, data APIs, or compute settlement today are pointed at Agentic Wallet — a separate surface — not at this trading MCP. Do not conflate the two.

What the numbers mean

Nine hundred-plus spot pairs and an equities sleeve sound like a full desk. They are not a custody redesign. The agent never becomes a Coinbase customer of record. The disclaimer says what compliance teams already know: AI agents can err, misinterpret, or invent; Coinbase does not guarantee accuracy of agent actions; the user is solely responsible for reviewing and authorizing trades, transfers, and account changes made through agentic workflows.

Hosted chat clients add friction of their own. High-reasoning modes sometimes draft an order and stop. Claude often previews and asks; ChatGPT may fire in one turn; Claude Desktop refuses many orders the web client would create. Lower-tier models can pick the wrong product ID. The docs’ remedy is boring and correct: specify type, size, asset, and portfolio in one instruction or use the CLI when you need consistent execution.

The operator lesson

Treat Coinbase for Agents like a trading sub-ledger with a chat front-end, not like an autonomous treasury. Fund a dedicated portfolio. Cap the float. Prefer preview-then-authorize until you trust the harness. Do not expect x402 machine payments from this MCP until Coinbase ships them; use Agentic Wallet if pay-per-request is the job.

The bank pitch is still a sentence: you authorize. The interesting engineering is the ring-fence separate book, inter-portfolio transfer only, no external withdrawals. That is how exchanges let software press buttons without rewriting who holds the liability.

Sources

• Coinbase Developer Platform, “Coinbase for Agents” / Coinbase MCP overview — https://docs.cdp.coinbase.com/coinbase-for-agents/overview
• Remote MCP endpoint — https://agents.coinbase.com/mcp