# Onchain Agent Wallets (npm · @three-ws/onchain-agent-wallets)

Give an AI agent a Solana spending allowance instead of your key. Chain-enforced cap, x402.

- Trust score: 76/100 (medium)
- Change this week: +1
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-09-20

## Components

- npm · `@three-ws/onchain-agent-wallets`: 76/100 (this document), [markdown](https://verifymcp.io/servers/nirholas-onchain-agent-wallets/three-ws-onchain-agent-wallets.md), [page](https://verifymcp.io/servers/nirholas-onchain-agent-wallets/three-ws-onchain-agent-wallets)

## Channel facts

- Registry: `npm`
- Package: `@three-ws/onchain-agent-wallets`
- Version: `0.1.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-09-20.

- **Supply Chain Security**: 90/100
  - No malware found by supply-chain analysis.
  - CVE check failed: a known high-severity CVE affects uuid 8.3.2, reached via @solana/web3.js > jayson > uuid. A fixed version is available.
  - No install/post-install scripts declared.
  - 54 of 197 dependencies flagged as unhealthy (2 deprecated).
- **Provenance & Transparency**: 32/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - License check failed: the license (SEE LICENSE IN LICENSE) isn't a recognized OSI-approved license.
  - Actively maintained (last published 8 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 70/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 2768 tokens (~197/item across 14 items; 14 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 83/100
  - Stability observed for 25 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - All 6 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.
  - An AI judge read all 15 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### How do I install the Onchain Agent Wallets MCP server?

Onchain Agent Wallets runs locally as an npm package, launched with npx -y @three-ws/onchain-agent-wallets. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add nirholas-onchain-agent-wallets -- npx -y @three-ws/onchain-agent-wallets
```

### Cursor

```json
{
  "mcpServers": {
    "nirholas-onchain-agent-wallets": {
      "command": "npx",
      "args": [
        "-y",
        "@three-ws/onchain-agent-wallets"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "nirholas-onchain-agent-wallets": {
      "command": "npx",
      "args": [
        "-y",
        "@three-ws/onchain-agent-wallets"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add nirholas-onchain-agent-wallets -- npx -y @three-ws/onchain-agent-wallets
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "nirholas-onchain-agent-wallets": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@three-ws/onchain-agent-wallets"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add nirholas-onchain-agent-wallets --command npx --arg -y --arg @three-ws/onchain-agent-wallets
```

### Hermes

```yaml
mcp_servers:
  nirholas-onchain-agent-wallets:
    command: "npx"
    args: ["-y", "@three-ws/onchain-agent-wallets"]
```

### Netclaw

```json
{
  "McpServers": {
    "nirholas-onchain-agent-wallets": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "@three-ws/onchain-agent-wallets"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add nirholas-onchain-agent-wallets -t stdio -c npx -a -y @three-ws/onchain-agent-wallets
```

### Other

```json
{
  "mcpServers": {
    "nirholas-onchain-agent-wallets": {
      "command": "npx",
      "args": [
        "-y",
        "@three-ws/onchain-agent-wallets"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-09-20 (score 76, −2)

- [functional] Stability: pass → 0.83

### 2026-09-19 (score 78, 0)

- [security] Stability: 0.97 → pass

### 2026-09-18 (score 78, +1)

No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-16 (score 77, +1)

No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-14 (score 76, +1)

No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-12 (score 75, +1)

No change was recorded against any check on this day. Stability & Change Management went from 73 to 77. That category is still filling its 30-day observation window: 22 days of observed history at the previous scan, 23 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-10 (score 74, +1)

No change was recorded against any check on this day. Stability & Change Management went from 67 to 70. That category is still filling its 30-day observation window: 20 days of observed history at the previous scan, 21 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-08 (score 73, +1)

No change was recorded against any check on this day. Stability & Change Management went from 60 to 63. That category is still filling its 30-day observation window: 18 days of observed history at the previous scan, 19 at this one. The score rises as the window fills, whether or not the server changes.

## MCP tools (14)

### `create_agent_wallet` (~549 tokens)

Give an agent a wallet with an on-chain spending limit

Create an agent wallet on Solana. Generates a fresh keypair for the agent, creates a vault token account that YOU own (derived deterministically from your address plus the agent id), and delegates a capped allowance over it to the agent. The SPL Token program enforces that cap: the agent cannot spend past it, and every spend decrements it. You keep custody, you can revoke in one instruction, and you can withdraw the balance without the agent. Set guardrails (per_tx, daily, allowlists, expiry) in the same call. Signs with OWNER_SECRET_KEY if configured, otherwise returns an unsigned transaction for Phantom, Solflare, Backpack, or a Ledger. Requires confirm:true to broadcast.

Input parameters:

- `agent_secret` (string): Reuse an existing agent keypair (base58 or JSON array) instead of generating one.
- `allow_hosts` (array): Guardrail: only these hosts may be paid over x402. Subdomains included. Empty means unrestricted.
- `allow_recipients` (array): Guardrail: only these addresses may receive funds. Empty means unrestricted.
- `allowance` (string, required): The on-chain ceiling, in whole tokens (e.g. "100"). The agent can never spend more than this without a new approval.
- `confirm` (boolean): Set true to actually build and broadcast. Without it you get the summary only.
- `confirm_over` (string): Guardrail: spends above this amount need an explicit confirm:true from a human.
- `daily` (string): Guardrail: maximum spend per rolling 24 hours, in tokens.
- `expires_at` (string): Guardrail: ISO timestamp after which every spend is refused.
- `fee_sol` (string): SOL to send the agent so it can pay its own transaction fees. Default "0.02". This is the only value the agent itself holds.
- `id` (string, required): Short slug naming the agent, lowercase letters/digits/hyphens. Becomes the on-chain vault seed.
- `label` (string): Human-readable name for your own reference.
- `mint` (string): SPL mint to spend. Defaults to USDC (EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v on mainnet).
- `owner` (string): Your wallet address. Omit to use the configured OWNER_SECRET_KEY. Pass it to keep the key off this machine and sign in your wallet.
- `per_tx` (string): Guardrail: maximum single spend, in tokens.
- `secret` (string): Owner secret key for this call only, overriding OWNER_SECRET_KEY.

### `fund_agent_wallet` (~148 tokens)

Top up an agent's vault, and its fee SOL

Move tokens from your wallet into the agent vault, and optionally send the agent a little SOL for its own transaction fees. The vault stays owned by you; funding it does not raise the delegated allowance, so the agent still cannot spend past its ceiling. Requires confirm:true to broadcast.

Input parameters:

- `amount` (string): Tokens to move into the vault, in whole units (e.g. "50").
- `confirm` (boolean): Set true to broadcast.
- `id` (string, required): The agent wallet to fund.
- `secret` (string): Owner secret key for this call only.
- `sol` (string): SOL to send the agent for transaction fees (e.g. "0.02").

### `approve_agent_allowance` (~137 tokens)

Set the agent's on-chain spending ceiling

Set how much the agent may spend from the vault, enforced by the SPL Token program. This REPLACES the existing allowance, it does not add to it: passing "50" leaves the agent with exactly 50 regardless of what it had before. Use it to raise, lower, or refill an allowance. Requires confirm:true to broadcast.

Input parameters:

- `allowance` (string, required): The new total allowance in whole tokens. "0" is equivalent to a revoke.
- `confirm` (boolean): Set true to broadcast.
- `id` (string, required): The agent wallet.
- `secret` (string): Owner secret key for this call only.

### `set_guardrails` (~275 tokens)

Change an agent's spending rules

Set the rules this server enforces before it signs a spend: per-transaction cap, rolling 24h cap, allowed recipients, allowed x402 hosts, an expiry, a confirm-above threshold, and a pause switch. Takes effect immediately, costs nothing, and needs no transaction. Only the fields you pass change; pass null to clear one. Empty allowlists mean unrestricted. These sit ON TOP of the on-chain allowance, which no software here can raise: to change that ceiling use approve_agent_allowance, and to cancel it entirely use revoke_agent_wallet.

Input parameters:

- `allow_hosts`: Only these hosts may be paid over x402, subdomains included. Empty or null means unrestricted.
- `allow_recipients`: Only these addresses may receive funds. Empty or null means unrestricted.
- `confirm_over` (string|null): Spends above this need an explicit human confirm:true. null clears it.
- `daily` (string|null): Maximum spend per rolling 24 hours. null clears it.
- `expires_at` (string|null): ISO timestamp after which every spend is refused. null clears it.
- `id` (string, required): The agent wallet.
- `paused` (boolean): true stops every spend immediately. false resumes.
- `per_tx` (string|null): Maximum single spend, in tokens. null clears it.

### `agent_pay` (~154 tokens)

Let the agent send tokens inside its limits

Send tokens from the agent vault to a recipient, signed by the agent as the on-chain delegate. Every guardrail is checked first (per-transaction cap, rolling daily cap, recipient allowlist, expiry, pause) and the SPL Token program enforces the remaining allowance underneath. A refusal explains which rule stopped it. Requires confirm:true to broadcast.

Input parameters:

- `amount` (string, required): Amount in whole tokens (e.g. "1.25").
- `confirm` (boolean): Set true to broadcast.
- `id` (string, required): The agent wallet spending the money.
- `memo` (string): Note recorded in the local spend log.
- `to` (string, required): Recipient wallet address. Their associated token account is created if needed.

### `pay_x402` (~223 tokens)

Let the agent pay for an x402 API out of its allowance

Call an HTTP endpoint that charges with x402, paying from the agent allowance on Solana. The price is read from the unpaid 402 response first, so the guardrails (per-transaction cap, daily cap, host allowlist, expiry, pause) see the real amount before anything moves. The agent is topped up for exactly that amount from the vault, pays, and is left empty. If the endpoint is not charging, the content comes back with no payment at all. Requires confirm:true when the price is above the confirm threshold or confirmation is on.

Input parameters:

- `body` (string): Request body, for POST/PUT/PATCH.
- `confirm` (boolean): Set true to authorize payment.
- `headers` (object): Extra request headers.
- `id` (string, required): The agent wallet paying.
- `max_price` (string): Refuse if the resource asks for more than this, in whole tokens. A ceiling for this call only.
- `method` (string): HTTP method. Default GET.
- `url` (string, required): The resource to call.

### `withdraw_from_vault` (~121 tokens)

Move funds out of an agent vault back to the owner

Withdraw tokens from an agent vault back to your own wallet. The vault is yours, so this always works, with or without a live delegation, and the agent cannot block it. Leaves the allowance untouched: lowering the balance already limits what the agent can spend. Requires confirm:true to broadcast.

Input parameters:

- `amount` (string): Tokens to withdraw. Omit to withdraw the entire balance.
- `confirm` (boolean): Set true to broadcast.
- `id` (string, required): The agent wallet.
- `secret` (string): Owner secret key for this call only.

### `revoke_agent_wallet` (~169 tokens)

Revoke the agent's spending authority on-chain

Cancel the agent's delegation on-chain. After this the SPL Token program refuses every transfer the agent signs, permanently, until you approve a new allowance. Pass withdraw:true to also sweep the vault balance back to your wallet in the same transaction. For an instant free stop that needs no transaction and no SOL, use set_guardrails with paused:true instead: that blocks this server, while revoke blocks the chain itself. Requires confirm:true to broadcast.

Input parameters:

- `amount` (string): Withdraw only this much instead of the whole balance.
- `confirm` (boolean): Set true to broadcast.
- `id` (string, required): The agent wallet to revoke.
- `secret` (string): Owner secret key for this call only.
- `withdraw` (boolean): Also move the vault balance back to your wallet. Default false.

### `agent_wallet_status` (~94 tokens)

Live status of an agent wallet

Show an agent wallet as it actually stands on-chain: vault balance, how much of the delegated allowance is left, what it can spend right now, its fee SOL, the guardrails in force, spend totals for the last 24 hours, and any warnings (revoked, expired, paused, out of fee SOL, allowance unbacked by balance). Read-only.

Input parameters:

- `id` (string, required): The agent wallet.

### `list_agent_wallets` (~50 tokens)

Every agent wallet on this machine

List the agent wallets configured here, each with its live vault balance, remaining on-chain allowance, and guardrails. Read-only.

Input parameters:

- `owner` (string): Only agents belonging to this owner address.

### `spend_log` (~125 tokens)

An agent's spend history, including refusals

The audit trail for one agent: every spend that went through and every one the guardrails refused, with the amount, destination, transaction signature, and the rule that decided it. Refusals are recorded on purpose, so you can see what an agent tried to do. Read-only.

Input parameters:

- `id` (string, required): The agent wallet.
- `limit` (integer): How many entries to return, newest first. Default 50.
- `only` (string): Filter by outcome. Default all.
- `since` (string): ISO timestamp: only entries at or after this time.

### `deploy_agent_onchain` (~263 tokens)

Publish the agent on-chain with its payment address

Mint the agent an on-chain identity in the Metaplex Agent Registry on Solana, carrying its EIP-8004 registration document, an x402Support flag, and on-chain attributes naming its payment address, its vault, and the token it accepts. After this the agent is discoverable on metaplex.com/agents and any counterparty can read where to pay it. Costs about 0.007 SOL and needs an owner signing key (set OWNER_SECRET_KEY or pass `secret`); to mint from Phantom or a Ledger instead, use prepare_agent_mint in @three-ws/metaplex-agent-mcp. Requires confirm:true to broadcast.

Input parameters:

- `confirm` (boolean): Set true to broadcast.
- `description` (string): What this agent does.
- `id` (string, required): The agent wallet to publish.
- `image` (string): Image URL for the asset.
- `model_url` (string): GLB avatar URL, rendered on metaplex.com/agents.
- `name` (string): On-chain name. Defaults to the agent label or id.
- `secret` (string): Owner secret key for this call only.
- `services` (array): Endpoints this agent serves, e.g. its own x402 API.

### `export_agent_runtime` (~139 tokens)

Export an agent wallet as a runnable MCP config

Produce the config that puts this agent wallet in front of a model: an mcp.json block, the equivalent claude mcp add command, the agent identity card (payment address, vault, token, limits), and the x402 details a counterparty needs to bill it. By default no key material is included, so the output is safe to paste into a repo or a ticket. Pass include_secret:true only when moving the agent to another machine.

Input parameters:

- `id` (string, required): The agent wallet to export.
- `include_secret` (boolean): Include the agent's secret key. Anyone holding it can spend up to the allowance. Default false.

### `send_signed_transaction` (~118 tokens)

Broadcast a transaction your wallet signed

Broadcast a base64 transaction that Phantom, Solflare, Backpack, or a Ledger already signed, and wait for confirmation. This is how the owner side works without any secret key on this machine: any tool that returns "prepared_for_wallet" hands you a transaction_base64 to sign and pass here. Blockhashes expire in about 60 seconds, so if this reports an expired blockhash, re-run the tool that prepared it.

Input parameters:

- `signed_transaction` (string, required): The signed transaction, base64-encoded, as your wallet returned it.

## Diagnostics

Captured diagnostic sections: Provenance, Vulnerabilities, Dependencies. The full working is on the page: https://verifymcp.io/servers/nirholas-onchain-agent-wallets/three-ws-onchain-agent-wallets#diagnostics

## Score history

- 2026-09-20: 76
- 2026-09-19: 78
- 2026-09-18: 78
- 2026-09-17: 77
- 2026-09-16: 77
- 2026-09-15: 76
- 2026-09-14: 76
- 2026-09-13: 75
- 2026-09-12: 75
- 2026-09-11: 74
- 2026-09-10: 74
- 2026-09-09: 73
- 2026-09-08: 73
- 2026-09-07: 72
- 2026-09-06: 72
- 2026-09-05: 71
- 2026-09-04: 71
- 2026-09-03: 71
- 2026-09-02: 70
- 2026-09-01: 70
- 2026-08-31: 69
- 2026-08-30: 69
- 2026-08-29: 68
- 2026-08-28: 68
- 2026-08-27: 67
- 2026-08-26: 64
- 2026-08-25: 62
- 2026-08-24: 62
- 2026-08-23: 62
- 2026-08-22: 62

## Common questions

### What is the Onchain Agent Wallets MCP server?

Onchain Agent Wallets is an MCP server listed in the public MCP registry as io.github.nirholas/onchain-agent-wallets. Give an AI agent a Solana spending allowance instead of your key. Chain-enforced cap, x402. This page covers its npm package (@three-ws/onchain-agent-wallets).

### Is the Onchain Agent Wallets MCP server safe to use?

Onchain Agent Wallets scores 76 out of 100 on VerifyMCP. We recorded 3 known advisories against it as of 20 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Onchain Agent Wallets MCP server expose?

Onchain Agent Wallets exposes 14 tools: create_agent_wallet, fund_agent_wallet, approve_agent_allowance, set_guardrails, agent_pay, and 9 more. Their descriptions and schemas cost roughly 2,565 tokens of context every time the server is loaded.

### Is the Onchain Agent Wallets MCP server still maintained?

Onchain Agent Wallets is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- npm package: https://www.npmjs.com/package/@three-ws/onchain-agent-wallets
- Socket report: https://socket.dev/npm/package/@three-ws/onchain-agent-wallets
- Repository: https://github.com/nirholas/onchain-agent-wallets
- Website: https://three.ws/
- Changelog RSS feed: https://verifymcp.io/servers/nirholas-onchain-agent-wallets/three-ws-onchain-agent-wallets.xml
- Changelog JSON feed: https://verifymcp.io/servers/nirholas-onchain-agent-wallets/three-ws-onchain-agent-wallets.json
- HTML version of this page: https://verifymcp.io/servers/nirholas-onchain-agent-wallets/three-ws-onchain-agent-wallets