Who it's for: Builders letting an AI agent pay for things (cards, stablecoins, pay-per-request APIs) who want spending limits and approvals enforced outside the agent, not in its prompt.
What can this agent do with your money? We score how much an AI agent could lose if it is wrong, hacked or prompt-injected, from official docs only. How we score it · Incident tracker
| Tool | Agent Risk Score | Points | Section | Missing inputs |
|---|---|---|---|---|
| Link agent wallet | Agent risk 84% (partial, 6 of 7 inputs) | 76 / 90 | Agent payments | preview |
| Agent Payments Protocol (AP2) | Agent risk 69% (partial, 3 of 7 inputs) | 24 / 35 | Agent payments | custody, limits, withdraw, preview |
| Stripe Issuing for agents | Agent risk 56% (partial, 6 of 7 inputs) | 50 / 90 | Agent payments | preview |
| Lightning Agent Tools | Agent risk 52% (partial, 4 of 7 inputs) | 31 / 60 | Agent payments | approval, withdraw, preview |
| x402 | Agent risk 52% (partial, 3 of 7 inputs) | 21 / 40 | Agent payments | custody, approval, withdraw, preview |
| Coinbase Agentic Wallet | Agent risk 51% (partial, 6 of 7 inputs) | 46 / 90 | Agent payments | preview |
| Tool | Safety and access | Live / paper | Pricing | Visit |
|---|---|---|---|---|
| spend limits per authorization or over a period (for example monthly) and allowed merchant categories, set per card or cardholder and applied by Stripe at authorization; real-time authorization webhooks let your own code approve or decline every charge (2-second default timeout, then the card's default rules apply); single-use cards are invalidated after use; a card can be frozen at any time | live, by application (apply in the Stripe Dashboard; platforms contact Stripe); the agents page doesn't mention a test mode | not stated on the agents page | Visit Stripe Issuing for agents | |
52x402 | open protocol (Apache-2.0): the buyer signs every payment payload and a facilitator that alters it fails signature checks; the exact scheme requires the exact amount and upto signs a maximum, but the protocol has no spending budget of its own; Coinbase's x402 client adds client-side spend controls (max per payment, a cumulative cap per time window, allowed networks; TypeScript only); the CDP facilitator declines payments involving sanctioned or high-risk addresses | live on Base and Solana mainnet; testnets on Base Sepolia and Solana Devnet | free open protocol; Coinbase's CDP facilitator: first 1,000 onchain transactions a month free, then $0.001 each | Visit x402 |
| private keys stay in Coinbase infrastructure (TEEs), never exposed to the agent's prompt or LLM; a max per call and a max per session are set in the wallet UI and agents can't change them; KYT and OFAC screening block high-risk or sanctioned transfers; no approval per transaction once limits are set; the send command takes any address or ENS name | live; the CLI also supports Base Sepolia and Solana Devnet | Agentic Wallet MCP, wallet creation and gas (sponsored) are free; x402 services set their own prices; Coinbase Onramp standard fees | Visit Coinbase Agentic Wallet | |
| you approve the amount of every purchase in the Link app (requests expire after 10 minutes); each payment gets a new one-time-use card or single-use Shared Payment Token, valid for 12 hours, so your real card details aren't exposed; service limits of $5,000 per request, $5,000 a day and $20,000 per 30 days; controls for spending without approval are listed as coming soon; pays MPP merchants with link-cli mpp pay | live; US Link accounts only (link-cli README); link-cli can issue test Shared Payment Tokens for a Stripe sandbox | not stated | Visit Link agent wallet | |
| the default setup splits the node into a watch-only instance on the agent machine and a signer holding the keys on a separate machine; macaroon-bakery issues pay-only, invoice-only, read-only and other scoped credentials ('never hand out admin.macaroon in production'); the lnget client takes a --max-cost cap per request; read-only access over Lightning Node Connect writes no credentials to disk | mainnet, plus regtest and testnet setups (local-key mode is meant for testnet, regtest and small-value mainnet) | not stated (open-source toolkit) | Visit Lightning Agent Tools | |
| user intent and authorization travel as signed, tamper-evident mandates: a Checkout Mandate shared with the merchant and a Payment Mandate shared with the credential provider and networks; the open Payment Mandate captures constraints such as budget and allowed instruments for autonomous purchases, the closed stage authorizes a specific amount; human-present and human-not-present flows; the page doesn't say who enforces the constraints | specification, SDK and code samples (v0.2); not a hosted payment service | free open protocol (Apache-2.0) | Visit Agent Payments Protocol (AP2) |
Required: Link agent wallet. Optional: Agent Payments Protocol (AP2). Each tool page links the vendor's docs for the approval setup.
Link agent wallet, Stripe Issuing for agents, Coinbase Agentic Wallet. Limits that live only in a client library get 5 of 20 points: Lightning Agent Tools, x402.
Not by themselves. x402 has no spending budget in the protocol; Coinbase's x402 client adds client-side caps per payment and per time window. AP2's open Payment Mandate records constraints such as a budget, but the protocol page doesn't say who enforces them. Pair either with a wallet or card that enforces limits.