You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
agent-wallet-sdk is designed for enterprise environments where AI agents need autonomous spending power with hard compliance boundaries. The SDK runs in your infrastructure - no third-party custody, no shared key management service, no data leaving your network.
473
+
474
+
**Deployment options:**
475
+
476
+
-**Self-hosted node service:** Run the SDK as a microservice behind your API gateway. Each agent gets its own ERC-6551 wallet with organization-wide SpendingPolicy enforcement.
477
+
-**Embedded in agent runtime:** Import directly into your agent's Node.js/TypeScript process. Wallet keys stay in your process memory, never transmitted.
478
+
-**Containerized (Docker/K8s):** Production-ready with environment variable configuration. Secrets via mounted volumes or your existing secrets manager (Vault, AWS Secrets Manager, GCP Secret Manager).
479
+
480
+
```bash
481
+
# Docker deployment
482
+
docker run -e WALLET_PRIVATE_KEY_FILE=/secrets/key \
483
+
-e RPC_URL=https://mainnet.base.org \
484
+
-v /path/to/secrets:/secrets:ro \
485
+
agentwallet-sdk:latest
486
+
```
487
+
488
+
### Network Requirements
489
+
490
+
- Outbound HTTPS to your chosen RPC provider (Base, Ethereum, Arbitrum, etc.)
491
+
- No inbound ports required
492
+
- Compatible with corporate proxies (standard HTTPS_PROXY env var)
493
+
- Air-gapped deployment supported for key generation; RPC access needed only for transaction broadcast
494
+
495
+
### High Availability
496
+
497
+
- Stateless design: wallet state lives on-chain, not in application memory
498
+
- Multiple SDK instances can share the same wallet address safely (nonce management handled)
499
+
- Recommended: run behind a load balancer with health checks on the `/health` endpoint
500
+
501
+
## Compliance Checklist
502
+
503
+
Use this checklist when evaluating agent-wallet-sdk for regulated environments.
504
+
505
+
### Data Residency
506
+
-[x] All wallet keys generated and stored locally - no external key management service
507
+
-[x] No telemetry, analytics, or usage data transmitted to any third party
508
+
-[x] Transaction data stays on public blockchain (Base, Ethereum, etc.) - no proprietary data store
509
+
-[x] SDK source code is open source (MIT) - full audit capability
-[x] Every transaction recorded on-chain with block number, timestamp, and gas cost
519
+
-[x] SpendingPolicy changes are on-chain events - immutable audit log
520
+
-[x] ERC-8004 reputation feedback is on-chain - tamper-proof performance history
521
+
-[x] No off-chain state that could be modified without detection
522
+
523
+
### Key Management
524
+
-[x] Non-custodial: the organization holds all private keys
525
+
-[x] Compatible with HSMs via standard Ethereum signing interfaces (EIP-712)
526
+
-[x] Key rotation: deploy new ERC-6551 wallet, transfer NFT, old keys become inert
527
+
-[x] No shared secrets between SDK instances or between organization and vendor
528
+
529
+
## Procurement FAQ
530
+
531
+
**Q: Is agent-wallet-sdk a SaaS product?**
532
+
No. It's an open-source SDK (MIT license) that you install and run in your infrastructure. There's no hosted service, no subscription, no vendor lock-in. You own the deployment.
533
+
534
+
**Q: What are the costs?**
535
+
The SDK itself is free. Costs are blockchain gas fees for transactions (typically $0.001-0.01 on Base L2) and your chosen RPC provider. No per-seat, per-agent, or per-transaction licensing fees.
536
+
537
+
**Q: How does licensing work?**
538
+
MIT license. Use it in commercial products, modify it, distribute it. No copyleft restrictions. No license changes planned - the license is in the git history.
539
+
540
+
**Q: Who maintains it?**
541
+
AI Agent Economy (https://github.com/up2itnow0822/agent-wallet-sdk). Active development since 2025. Community contributions welcome.
542
+
543
+
**Q: Can we get a support agreement?**
544
+
Enterprise support packages are available. Contact [email protected] for SLA terms.
545
+
546
+
**Q: Is there vendor lock-in risk?**
547
+
No. The SDK uses standard Ethereum tooling (viem, ERC-6551, ERC-8004). If you stop using the SDK, your wallets, keys, and on-chain identity continue to work with any Ethereum-compatible tool.
548
+
549
+
**Q: Does it work with our existing agent framework?**
550
+
Yes. The SDK is framework-agnostic. It works with OpenClaw, NanoClaw, LangChain, CrewAI, AutoGPT, Anthropic Claude tool-use, OpenAI Assistants, or any Node.js/TypeScript environment. agentpay-mcp adds MCP protocol support for Claude and other MCP-compatible clients.
551
+
552
+
**Q: What chains are supported?**
553
+
17 chains via CCTP bridging. Primary: Base (recommended for low gas costs), Ethereum, Arbitrum, Polygon, Optimism. See Supported Chains table above.
|**CC6.1** Logical access security | SpendingPolicy on-chain enforcement, ERC-6551 NFT-based access control | Access revocation is cryptographic via NFT transfer |
560
+
|**CC6.2** System component access | Non-custodial - no vendor access to keys or wallets | Organization controls all secrets |
561
+
|**CC6.3** Access removal | NFT transfer = instant revocation of all agent permissions | No "forgot to deprovision" risk |
562
+
|**CC7.1** System monitoring | All transactions on-chain with block explorer visibility | Real-time alerting via standard blockchain monitoring tools |
563
+
|**CC7.2** Anomaly detection | SpendingPolicy caps prevent anomalous spend automatically | Over-limit transactions queue for human review |
564
+
|**CC8.1** Change management | Open-source - all changes in public git history | Audit any version, diff any release |
565
+
|**A1.2** Recovery objectives | Stateless SDK + on-chain state = recovery is re-deploy + import keys | No database backups needed |
566
+
|**C1.1** Data confidentiality | No data transmitted to vendor, no telemetry, local-only operation | Private keys never leave your infrastructure |
### What SOC 2 Auditors Will Ask (And Your Answers)
570
+
571
+
**"How do you control what the AI agent can spend?"**
572
+
SpendingPolicy smart contracts enforce per-transaction limits, daily caps, and approved token lists on-chain. The agent cannot bypass these limits - they're enforced by the blockchain, not by application code.
573
+
574
+
**"What happens if an agent is compromised?"**
575
+
The agent can only spend up to its SpendingPolicy limits. Worst case: one day's approved budget. Transfer the NFT to revoke all access immediately. No waiting for key rotation, no certificate revocation lists.
576
+
577
+
**"Where are the private keys stored?"**
578
+
In your infrastructure. The SDK never transmits keys. Compatible with your existing secrets management (Vault, AWS Secrets Manager, Azure Key Vault, GCP Secret Manager, or local encrypted storage).
579
+
580
+
**"Can the vendor access our wallets?"**
581
+
No. Non-custodial means we never have your keys. There's no "admin backdoor," no support override, no recovery mechanism that bypasses your key ownership.
0 commit comments