Best of · Payments & protocols
Best agent wallets and spending controls
All 7 ranked agent wallets and spending controls on the Anchor benchmark, with a pick for each need and where each one falls short. Scores come from public evidence, re-checked as vendors change.
- 7 ranked
- 4 agent-ready
- 7 hosted endpoints
- Updated 9 October 2026
Top three
Picks by need
Worked out from the scores, prices and facts, so they change when the research does.
Highest score overall
BB, 76/100 on the benchmark.
Also Circle Wallets (Agent Wallets, Programmable Wallets), BB, 73.9/100.
Schema & documentation
Coinbase Developer Platform (Agentic Wallet, AgentKit, CDP MCP) BB
94/100 on schema & documentation, against 79 for the overall leader.
Agent ergonomics
Coinbase Developer Platform (Agentic Wallet, AgentKit, CDP MCP) BB
83/100 on agent ergonomics, against 77 for the overall leader.
Maintenance & community
Openfort BB
87/100 on maintenance & community, against 83 for the overall leader.
Transparency & trust
Coinbase Developer Platform (Agentic Wallet, AgentKit, CDP MCP) BB
76/100 on transparency & trust, against 72 for the overall leader.
Lowest paid price per call
Openfort BB
$0.004 per call, the lowest of the 5 listings here with a paid price in this unit (free allowances aside).
Also Coinbase Developer Platform (Agentic Wallet, AgentKit, CDP MCP), $0.005 per call.
A hosted MCP endpoint
Circle Wallets (Agent Wallets, Programmable Wallets) BB
remote MCP server, nothing to install.
The review panel's favourite
Circle Wallets (Agent Wallets, Programmable Wallets) BB
3.1/5 from 8 panel reviews.
The shortlist
| # | Tool | Grade | Best for | Price | Where |
|---|---|---|---|---|---|
| 1 | Turnkey Agentic Wallets Turnkey Global, Inc. |
BB 76 | A company that wants agents to sign from its own wallets under rules checked in an enclave, with a person co-approving large transactions, across EVM, Solana, Bitcoin, Tron and other chains. | $0.10 / call | hosted |
| 2 | Circle Wallets (Agent Wallets, Programmable Wallets) Circle |
BB 73.9 | An agent that should hold and spend USDC under limits a person sets and confirms, especially for x402 nanopayments, and for builders who want custodial-grade wallet APIs with their own controls. | 0.02% fee | hosted |
| 3 | Coinbase Developer Platform (Agentic Wallet, AgentKit, CDP MCP) Coinbase Developer Platform |
BB 71.2 | Giving a personal agent a USDC wallet with hard caps in two commands, and for builders who want policy-bound server wallets and x402 on both sides. | $0.005 / call | hosted and local |
| 4 | Openfort Openfort (Alamas Labs Inc.) |
BB 70.1 | A team that wants server-held wallets for agents on EVM chains and Solana with enclave signing, a free start and a CLI an agent can drive. | $99 / mo | hosted and local |
| 5 | Privy Wallets (server wallets, agent wallets, policy engine) Privy (Stripe) |
B 69.9 | Builders who need fine-grained, enclave-enforced spending rules on programmatic wallets, or who want an agent to sign for a person's wallet with a revocable scoped signer. | $299 / mo | hosted |
| 6 | Agentcard Agentcard Corporation |
C 56.5 | A company building a shopping or purchasing agent that needs users to pay with their own cards under passkey approval, or needs capped virtual Visa cards per task. | $0.15 / call | hosted |
| 7 | Sponge Wallet Sponge Inc. |
E 43.2 | A developer who wants an agent to hold stablecoins and pay x402 or MPP endpoints within minutes, with cards, bank rails and Hyperliquid or Polymarket trading behind the same key. | Free | hosted |
How to choose
- Who holds keys or fundsCheck whether the wallet service or the operator holds the keys or funds, since custody decides who can move money if the agent is compromised.
- Per-transaction and daily limitsCheck that limits apply per transaction and per day, enforced by the wallet rather than the agent's prompt, so a misbehaving agent cannot exceed them.
- Allow-lists for payeesCheck whether payments can be restricted to approved merchants or addresses, since an open payee list lets an agent send funds to any destination it is given.
- Revoking an agent's accessCheck how an operator revokes access and whether the change takes effect at once, since a delayed revocation leaves the agent able to spend after it should stop.
Each one in detail
Turnkey Agentic Wallets
BB 76/100Turnkey's signing API gives an AI agent its own non-root user and P-256 key over a company wallet. Policies evaluated in secure enclaves set what the agent may sign, and can require a person's approval.
Verdict An agent gets a non-root user that can sign nothing until a policy allows it, with DENY rules taking precedence and human co-approval available. Policies cap value per transaction only, with no daily or rolling limit found, and each organisation gets five policies below Enterprise. Signing endpoints returned elevated errors for five hours on 27 August 2026.
Choose it for A company that wants agents to sign from its own wallets under rules checked in an enclave, with a person co-approving large transactions, across EVM, Solana, Bitcoin, Tron and other chains.
Strengths
- Non-root users have no permissions until an ALLOW policy exists, and any matching DENY policy wins
- Consensus expressions can require the agent and a named person to approve before the enclave signs
- API private keys are generated by the customer and never sent to Turnkey. Keys can carry an expiry
Weaknesses
- Policy conditions cap value per transaction. No daily, rolling or cumulative spending limit was found in the policy language
- Free, Pay as You Go and Pro organisations are limited to five policies and a default of 1 to 3 requests a second
- Root users bypass the policy engine entirely, and the first user of a new organisation is root
Price $0.10 / callAuth API keyx402 partialhosted
Circle Wallets (Agent Wallets, Programmable Wallets)
BB 73.9/100Circle's wallet APIs (developer-controlled, user-controlled and modular wallets) plus Agent Wallets, a USDC wallet an agent drives through the Circle CLI with per-transaction, daily, weekly and monthly caps and address allowlists.
Verdict Agent Wallet caps per transaction, day, week and month plus recipient and contract allow and block lists, each change confirmed by email OTP. Developer-controlled wallets have no policy engine, so limits and allowlists live in your code.
Choose it for An agent that should hold and spend USDC under limits a person sets and confirms, especially for x402 nanopayments, and for builders who want custodial-grade wallet APIs with their own controls.
Strengths
- Agent Wallet caps per transaction, day, week and month plus recipient and contract allow and block lists, each change confirmed by email OTP
- User custody by 2-of-2 MPC; key shares never reach the agent and Circle says it can't move funds alone
- Required UUID idempotency keys on every mutating Wallets API request
Weaknesses
- Developer-controlled wallets have no policy engine, so limits and allowlists live in your code
- Spending policies don't work on testnet, so you can't rehearse them without real funds
- API keys have no permission scopes we could find
Price 0.02% feeAuth OAuth or keyx402 partialhosted
Coinbase Developer Platform (Agentic Wallet, AgentKit, CDP MCP)
BB 71.2/100Coinbase's wallet infrastructure for agents, with programmatic transactions, spending controls and MCP integrations.
Verdict Operator-set max per call and max per session that the agent can't change, set in the wallet UI. AgentKit on npm is 0.10.4 from December 2025, and its fix for a local file read and public upload path is unreleased.
Choose it for Giving a personal agent a USDC wallet with hard caps in two commands, and for builders who want policy-bound server wallets and x402 on both sides.
Strengths
- Operator-set max per call and max per session that the agent can't change, set in the wallet UI
- Server-wallet policy engine that rejects by default, on CDP API keys with scopes and a separate wallet secret
- Public OpenAPI with 208 operations, typed error codes and idempotency keys, and SDKs in five languages
Weaknesses
- AgentKit on npm is 0.10.4 from December 2025, and its fix for a local file read and public upload path is unreleased
- Agentic Wallet caps are amounts only; allowlists need server wallets and the policy engine
- No published rate limits or SLA for the wallet APIs
Price $0.005 / callAuth OAuth or keyx402 partialhosted and local
Openfort
BB 70.1/100Openfort is wallet infrastructure from Alamas Labs. Its REST API, Node SDK and CLI create backend wallets held in a trusted execution environment, with signing policies, session keys and gas sponsorship. It also sells embedded wallets for apps.
Verdict Backend wallets sign inside a GCP Confidential Space enclave, secret keys carry 26 scopes, and rate limits, errors and prices are published. On EVM, a backend send reaches the policy engine only as a hash, so address and value rules bind only when the caller runs the pre-flight check first.
Choose it for A team that wants server-held wallets for agents on EVM chains and Solana with enclave signing, a free start and a CLI an agent can drive.
Strengths
- Backend wallet keys are generated and used inside a GCP Confidential Space enclave with AMD SEV-SNP, wrapped by an HSM-backed Cloud KMS key
- Secret keys carry 26 named scopes, and backend signing also needs an ES256 JWT from a separate wallet secret that can be rotated
- Policy engine rejects any operation no rule matches, with account and project scopes and a pre-flight
POST /v2/policies/evaluate
Weaknesses
- An EVM backend send is evaluated only as
signEvmHash, so address, value and calldata rules do not block it unless the caller pre-flights - Signing policies cap value per transaction. No daily or rolling cap was found in the reviewed policy pages
- The CLI MCP server exposes 72 commands as tools, among them
accounts_evm_export, which returns a private key
Price $99 / moAuth API keyx402 partialhosted and local
Privy Wallets (server wallets, agent wallets, policy engine)
B 69.9/100Wallet infrastructure owned by Stripe since June 2025.
Verdict Default-deny policies with DENY precedence on recipients, values, contracts, calldata, typed data and time windows, enforced in AWS Nitro Enclaves. Database problems took API endpoints down for 71 minutes on 18 September 2026, one of 13 incidents since July.
Choose it for Builders who need fine-grained, enclave-enforced spending rules on programmatic wallets, or who want an agent to sign for a person's wallet with a revocable scoped signer.
Strengths
- Default-deny policies with DENY precedence on recipients, values, contracts, calldata, typed data and time windows, enforced in AWS Nitro Enclaves
- Agent-owned wallets or revocable scoped signers on a person's wallet, plus key quorums for m-of-n approval
- Idempotency keys on every state-changing wallet route, honoured for 24 hours
Weaknesses
- Database problems took API endpoints down for 71 minutes on 18 September 2026, one of 13 incidents since July
- Rate limits aren't published as numbers
- Rolling caps are EVM only and update after signing, so parallel requests can exceed them
Price $299 / moAuth OAuth or keyx402 partialhosted
Agentcard
C 56.5/100Agentcard gives AI agents a way to pay at card checkouts. Its Vault stores a user's own cards for approved purchases, and Issuing creates single-use or multi-use virtual Visa cards. Access is by REST API, MCP server and CLI.
Verdict Purchases need the user's passkey approval by default, cards carry spending rules, and card creation takes an idempotency key. No status page, published rate limits beyond the token endpoint, or privacy policy of Agentcard's own was found, and the Trust Centre could not be read. Issuing costs $5,000 a month.
Choose it for A company building a shopping or purchasing agent that needs users to pay with their own cards under passkey approval, or needs capped virtual Visa cards per task.
Strengths
- Vault purchases pause for the user's passkey or master password approval by default, and production card creation returns
approval_pendingwith an approval link - Presets cap spend in total and per rolling day, week and month, and restrict merchants, categories, countries, currencies, days and hours, in
strictorwatchmode POST /api/v2/cardsrequires anIdempotency-Key, andbuy_checkoutre-checks the confirmed total and address before paying
Weaknesses
- No status page or incident history was found on the site or in the docs. An SLA is listed for Enterprise plans only, with no published text
- The only rate limit with numbers is 30 requests per 5 minutes per IP on the token endpoint
- The site's Privacy Policy link opens the policy of Rain, the card issuing partner. No privacy policy of Agentcard's own was found
Price $0.15 / callAuth OAuthx402 nohosted
Sponge Wallet
E 43.2/100Sponge Wallet is a hosted wallet for AI agents. It holds stablecoins on Ethereum, Base, Tempo and Solana, pays x402 and MPP endpoints, issues virtual cards, and is reached by a REST API, an MCP server, SDKs and a CLI.
Verdict An agent can register a wallet with one unauthenticated call and pay x402 or MPP endpoints under daily, weekly and monthly limits enforced on Sponge's servers. No status page, rate limits, fee schedule, custody statement or security contact was found, the terms run to eleven short clauses, and the SDK was last published on 7 July 2026.
Choose it for A developer who wants an agent to hold stablecoins and pay x402 or MPP endpoints within minutes, with cards, bank rails and Hyperliquid or Polymarket trading behind the same key.
Strengths
POST /api/agents/registerwithagentFirstreturns an agent key at once, and a person claims the wallet later through a claim URL- Daily, weekly and monthly spending limits are set per agent and enforced server-side, with address allowlists that return 403
- One wallet pays x402 and MPP endpoints, opens MPP sessions on Tempo and creates x402 payment links
Weaknesses
- No status page, SLA or numeric rate limit was found, and the terms say the service may be offered in beta
- Who holds the wallet keys is not stated in the docs or the terms. The skill file calls the wallet managed
- The terms of 30 June 2026 are eleven short clauses that do not mention wallets, funds, custody or fees
Price FreeAuth OAuth or keyx402 partialhosted
Head to head
- Circle Wallets (Agent Wallets, Programmable Wallets) vs Turnkey Agentic Wallets BB 73.9 vs BB 76
- Coinbase Developer Platform (Agentic Wallet, AgentKit, CDP MCP) vs Turnkey Agentic Wallets BB 71.2 vs BB 76
- Openfort vs Turnkey Agentic Wallets BB 70.1 vs BB 76
- Privy Wallets (server wallets, agent wallets, policy engine) vs Turnkey Agentic Wallets B 69.9 vs BB 76
- Circle Wallets (Agent Wallets, Programmable Wallets) vs Coinbase Developer Platform (Agentic Wallet, AgentKit, CDP MCP) BB 73.9 vs BB 71.2
- Circle Wallets (Agent Wallets, Programmable Wallets) vs Openfort BB 73.9 vs BB 70.1
- Circle Wallets (Agent Wallets, Programmable Wallets) vs Privy Wallets (server wallets, agent wallets, policy engine) BB 73.9 vs B 69.9
- Coinbase Developer Platform (Agentic Wallet, AgentKit, CDP MCP) vs Openfort BB 71.2 vs BB 70.1
- Coinbase Developer Platform (Agentic Wallet, AgentKit, CDP MCP) vs Privy Wallets (server wallets, agent wallets, policy engine) BB 71.2 vs B 69.9
- Openfort vs Privy Wallets (server wallets, agent wallets, policy engine) BB 70.1 vs B 69.9
Questions
What are the highest-rated agent wallets and spending controls for AI agents?
Turnkey Agentic Wallets has the highest benchmark score of the 7 ranked agent wallets and spending controls, 76 (BB). Circle Wallets (Agent Wallets, Programmable Wallets) is second with 73.9 (BB).
How many agent wallets and spending controls are agent-ready?
4 of the 7 ranked here grade BB or better, the bar for agent-ready on the Anchor benchmark.
Which agent wallets and spending controls accept x402 payments?
None of the ranked listings here accepts x402 for its main call yet.
Which of these agent wallets and spending controls is cheapest?
By published paid prices, Openfort, at $0.004 per call, the lowest of the 5 listings here with a paid price in this unit (free allowances aside). Plans, volume tiers and free allowances change the sum, so check the listing's price table.
How is this list ranked?
By the Anchor benchmark score out of 100, a weighted mean of the scored categories minus deductions for negative events, from public evidence re-checked as vendors change. Listings cannot pay for a place. The latest assessment behind this page is from 9 October 2026.
How this list is made
The order is the Anchor benchmark score, the same number as on each listing and in the top list. Each listing is graded from public evidence against the benchmark checklist, and the picks above are worked out from those grades, prices and facts. No listing pays for its place, and paid audits or listing help never change a score.
Full ranked table · 23 head-to-head comparisons · Best tools in every category