Is Coinbase AgentKit safe to connect to an AI agent?
Can trade unattended. Safety 60%
What an AI agent can do
- Live vs paper: live and testnet source
- Order approval: open-source toolkit giving an AI agent its own wallet (CDP, Privy or keypair providers) with transfer, swap and custom actions; use testnets and spending limits first source
- Markets: EVM chains, Solana
- Pricing: free, open source; CDP usage may be billed
Safeguards that exist
- Paper, demo or testnet mode: Paper, demo or testnet mode available source
- Withdrawal permission needed or allowed: Can't withdraw or move your funds (you sign or withdrawals stay off) source
- Scoped keys, permission scopes or IP whitelisting: CDP Secret API keys used by AgentKit can be restricted to specific IP addresses (official docs) source
- Open source or audited: Open source source
Safeguards that are missing
Safety score
| Input | From our listing | Points |
|---|---|---|
| Can it place live orders unattended? | Can place live orders with no documented approval step | 0 / 25 |
| Order approval or confirmation options | No approval or limit option in our listing | 0 / 15 |
| Paper, demo or testnet mode | Paper, demo or testnet mode available | 15 / 15 |
| Withdrawal permission needed or allowed | Can't withdraw or move your funds (you sign or withdrawals stay off) | 15 / 15 |
| Scoped keys, permission scopes or IP whitelisting | CDP Secret API keys used by AgentKit can be restricted to specific IP addresses (official docs) source | 10 / 10 |
| Open source or audited | Open source | 10 / 10 |
| Sourced and verified facts | Facts from the vendor's official docs | 10 / 10 |
| Total | 60% of the points we could check | 60 / 100 |
Sources
- https://github.com/coinbase/agentkit
- https://docs.cdp.coinbase.com/get-started/authentication/security-best-practices
Full listing: Coinbase AgentKit ยท How the score works: Safety score method