Is Coinbase CDP Server Wallets safe to connect to an AI agent?
Can trade unattended. Safety 35%
What an AI agent can do
- Live vs paper: live and testnet (the quickstart runs on Base Sepolia with CDP Faucets) source
- Order approval: server wallets for agents and backends: Coinbase keeps private keys inside a Trusted Execution Environment and your server controls the accounts with API keys; a Policy Engine accepts or rejects each operation by destination address, value and network before signing; no human-approval step in the policy docs source
- Markets: EVM networks (e.g. Base)
- Pricing: first 5,000 wallet operations per month free, then $0.005 per operation
Safeguards that exist
- Paper, demo or testnet mode: Paper, demo or testnet mode available source
- Scoped keys, permission scopes or IP whitelisting: Secret API keys support IP allowlists and granular permission restrictions; a separate Wallet Secret is required for wallet write operations (official docs) source
Safeguards that are missing
- Can it place live orders unattended?: Can place live orders with no documented approval step source
- Order approval or confirmation options: No approval or limit option in our listing source
- Withdrawal permission needed or allowed: Requests are allowed when no policy rule matches; the Policy Engine can allowlist destination addresses and cap value (official docs) source
- Open source or audited: No public source code in our listing source
Safety score
| Input | From our listing | Points |
|---|---|---|
| Can it place live orders unattended? | Can place live orders with no documented approval step | 0 / 25 |
| Order approval or confirmation options | No approval or limit option in our listing | 0 / 15 |
| Paper, demo or testnet mode | Paper, demo or testnet mode available | 15 / 15 |
| Withdrawal permission needed or allowed | Requests are allowed when no policy rule matches; the Policy Engine can allowlist destination addresses and cap value (official docs) source | 0 / 15 |
| Scoped keys, permission scopes or IP whitelisting | Secret API keys support IP allowlists and granular permission restrictions; a separate Wallet Secret is required for wallet write operations (official docs) source | 10 / 10 |
| Open source or audited | No public source code in our listing | 0 / 10 |
| Sourced and verified facts | Facts from the vendor's official docs | 10 / 10 |
| Total | 35% of the points we could check | 35 / 100 |
Sources
- https://docs.cdp.coinbase.com/server-wallets/v2/using-the-wallet-api/policies/overview
- https://docs.cdp.coinbase.com/api-reference/v2/authentication
Full listing: Coinbase CDP Server Wallets ยท How the score works: Safety score method