Agentcard vs Agent Vault by Self

Agentcard

Purchases need the user's passkey approval by default, cards carry spending rules, and card creation takes an idempotency key. No status page, published rate limits beyond the token endpoint, or privacy policy of Agentcard's own was found, and the Trust Centre could not be read. Issuing costs $5,000 a month.

Agent Vault by Self

Scoped, revocable keys, OAuth on the hosted MCP server, spending caps, approvals and a documented threat model are designed to keep real card numbers and passwords out of the agent's context. The home page and launch post say cards are revealed only in an attested enclave, while the docs say that path is off on the hosted service.

Agentcard

1. Mint a platform token with POST /api/v2/oauth/token and cache it for its one hour. The endpoint allows 30 requests per 5 minutes per IP
2. Send the same Idempotency-Key on every retry of POST /api/v2/cards, and the same idempotency_key on every retry of buy_checkout
3. Pass source: "issued" to the MCP create_card tool for a card number. Without it the tool may start Vault setup and return a link
4. Call get_card_details only at the payment form and never log the result. Each read notifies the member and may return approval_required
5. Treat transaction.authorized and order.* webhooks as the record of a payment, and deduplicate deliveries on the event id

Agent Vault by Self

1. Pass the session handle from each hosted MCP result on every later call. Without it a page tool is refused or a new signed-out browser opens
2. On a pending answer, call get_pending_result with its wait id in the same turn. Repeating the original call starts a second one
3. Tell the user when waiting_on_owner is true. A first fill on a new site waits up to 15 minutes for the holder's approval
4. Before retrying a fill after an unknown outcome, check the merchant's order state or get_run_report. Some failures keep a recorded spend
5. Ask the holder to add an agent card to every card the agent may use. A card marked No limits accepts any amount on authorised sites