{"slug": "giving-an-ai-agent-a-wallet-without-giving-it-your-keys", "title": "Giving an AI agent a wallet without giving it your keys", "summary": "A developer released Purser, an MIT-licensed ERC-4337 smart account that lets AI agents hold and spend funds through session keys governed by on-chain policies rather than raw private keys. Each agent key carries per-purchase limits, budgets and an allowlist enforced in a smart contract, with over-limit payments escalating to owner co-signing and a single transaction able to revoke a key or freeze the account. The project ships 41 unit tests through a real EntryPoint plus fuzz and invariant tests, and exposes six tools via an MCP server, though it is unaudited and currently runs only on a local chain.", "body_md": "Agents are starting to pay for things. An agent buying API credits, renting a GPU for an hour or paying for a dataset is no longer a thought experiment, and x402 (HTTP `402 Payment Required` with on-chain payment) makes it a normal web request.\n\nThat leaves the question of how the agent holds money.\n\n**Give the agent a private key.** It works until a prompt injection, a bug or a leaked environment file. Then the wallet is empty, and there is nothing between the key and the funds.\n\n**Approve every payment by hand.** Safe, and it removes the reason to use an agent.\n\nWhat people actually want is what they already do with a company card: a limit per purchase, a monthly budget, a list of places it works, and a phone call for anything unusual.\n\nThe limits have to live somewhere the agent, and the machine it runs on, can't change. A smart contract is a good fit: the rules are checked by every node, and changing them needs the owner's key.\n\n[Purser](https://github.com/ahmad-codex/purser) is an ERC-4337 smart account built for this. The owner grants each agent a session key with a policy:\n\nInside the policy, the agent pays on its own. Over the limit, the payment becomes an approval request, and it runs only if the owner co-signs. One transaction revokes a key or freezes the whole account.\n\nIf the agent's key leaks, the damage is bounded: the rest of the current budget, at allowed places, until you revoke it.\n\nERC-4337 splits an operation into validation and execution, and validation is not allowed to read the clock (ERC-7562), because bundlers have to be able to simulate it reliably. A daily budget is all about the clock.\n\nSo the checks are split:\n\n`executeUserOp`, where reading the block time is fine.\nTwo smaller rules that matter: an owner approval raises the amount but never the scope, so an approved payment still has to be to an allowed place; and a revoke earlier in a bundle still stops a later operation in the same bundle.\n\nUnit tests aren't enough for this. Purser has 41 unit tests through a real EntryPoint, fuzz tests that compare random payment and time sequences against a simple model of the budget, and invariant tests that throw thousands of random calls at the account and check three properties after each one: no spending over budget without approval, no funds moved by a revoked key, no policy change without the owner. Slither runs in CI.\n\nIt's still early and not audited, which is why everything below runs on a local chain.\n\nAn MCP server exposes six tools: `wallet_status`, `send_eth`, `send_token`, `call_contract`, `get_request` and `list_requests`. Each payment returns one of three outcomes, written for the model: done with the budget left, waiting for the owner with a request id, or refused with a reason it can act on.\n\n```\ndocker run --rm -it -p 127.0.0.1:8787:8787 ghcr.io/ahmad-codex/purser:demo\n```\n\nOpen [http://localhost:8787](http://localhost:8787). The container starts a local chain, deploys everything, and plays the agent story while the console updates. Then connect your own agent:\n\n```\nclaude mcp add --transport http purser http://localhost:8787/mcp\n```\n\nand ask it to pay the merchant 0.3 ETH.\n\nThe [roadmap](https://github.com/ahmad-codex/purser/blob/main/ROADMAP.md) starts with paying x402 endpoints within the budget, a gas budget per key and EIP-7702 support. It's MIT licensed, and there are good first issues open. If you let agents spend money today, I'd like to hear how you limit it.", "url": "https://wpnews.pro/news/giving-an-ai-agent-a-wallet-without-giving-it-your-keys", "canonical_source": "https://dev.to/ahmad_shawar_de8d35d546cf/giving-an-ai-agent-a-wallet-without-giving-it-your-keys-407k", "published_at": "2026-11-01 20:41:25+00:00", "updated_at": "2026-11-01 20:51:55.879327+00:00", "lang": "en", "topics": ["ai-agents", "agent-protocols", "ai-tools", "artificial-intelligence"], "entities": ["Purser", "ERC-4337", "x402", "ERC-7562", "EIP-7702", "Slither", "Claude", "GitHub"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/giving-an-ai-agent-a-wallet-without-giving-it-your-keys", "markdown": "https://wpnews.pro/news/giving-an-ai-agent-a-wallet-without-giving-it-your-keys.md", "text": "https://wpnews.pro/news/giving-an-ai-agent-a-wallet-without-giving-it-your-keys.txt", "jsonld": "https://wpnews.pro/news/giving-an-ai-agent-a-wallet-without-giving-it-your-keys.jsonld"}}