AgentWallet MCP Lets Agents Sign Locally or Hosted — With Per-Tx Caps and x402 Autopay Limits

Most “AI wallets” hand the model a hot key and hope for manners. AgentWallet’s MCP server makes you pick a custody mode out loud — and refuses to quietly route a Solana transfer through a hosted signer when you only configured an EVM key.

Per the published agentwallet-mcp README (npm / GitHub hifriendbot/agentwallet-mcp, verified 18 Sep 2026), the server exposes ~31 MCP tools across EVM + Solana: create wallets, transfer native/ERC-20/SPL, approve, wrap, pay and accept x402, pause/unpause (hosted), and wallet_mode so the agent (and you) can see which mode is live.

The mechanism

Two modes (table from the README):

| | Local (self-custody) | Hosted (custodial) | |—|—|—| | Who holds the key | You, in-process (AGENTWALLET_PRIVATE_KEY / keyfile) | Encrypted on AgentWallet servers | | Freeze | Nobody can freeze a local wallet | Server pause exists on purpose | | Guards | Env caps you set before signing | Daily USD caps, gas protection, pause, rate limits |

Local guards that matter: AGENTWALLET_MAX_TX_NATIVE, AGENTWALLET_MAX_TX_TOKEN (covers transfer/transferFrom/approve — because native caps miss ERC-20 calldata amounts), AGENTWALLET_MAX_TX_SOL, AGENTWALLET_MAX_AUTOPAY (default 1 unit for x402 auto-pay). The README is blunt: an unset cap means no limit.

x402: pay_x402 fetch→402→pay→retry with hard max_payment (falls back to MAX_AUTOPAY). Also create/list paywalls so an agent can accept USDC for a resource. API fees themselves can be paid in USDC via 402 when free tier is exceeded — company claim of differentiation vs CDP/Circle/MoonPay card billing.

Hard refusal rule: an operation with no matching local key is refused, never silently hosted. That is the custody story IronWallet-style “never shares the seed” pitches skip when the default path executes without a confirm UI.

Pricing published: $0.00345/op, 6,000 free ops/month, $0.0005 per x402 verification, 1,000 free verifications/month. Treat as vendor price list, not a CW endorsement.

What the numbers mean

• 31 tools / multi-chain — surface area for an agent that can drain you if caps are wrong.
• Default MAX_AUTOPAY = 1 — one USDC-shaped unit ceiling on automatic 402 pays unless you raise it.
• 3 GitHub stars (as of scout) — small project; ship as mechanism brief, not “category winner.” Prefer the README’s verifiable guard design over market-share claims.

Operator takeaway

Local keys plus explicit caps are the credible path for a treasury agent: the process can sign, but the environment defines the blast radius. Hosted mode is useful when you need pause, rate limits, and a revocable control plane — but it is custodial.

For builders: mount the MCP server with only the mode and caps you can monitor. For operators: inspect wallet_mode at session start, keep MAX_AUTOPAY low, cap token amounts separately from native gas, and route every high-value action through a human approval layer.

Two modes. Local key never leaves your process. Hosted can pause. Either way, unset caps mean no limit.