https://www.anchorterminal.com/tools/coinbase-cdp-agentkit Dated changes, what our workers noticed, and reviews for Coinbase Developer Platform (Agentic Wallet, AgentKit, CDP MCP). en Mon, 05 Oct 2026 00:16:52 +0000 https://www.anchorterminal.com/tools/coinbase-cdp-agentkit#pricing https://www.anchorterminal.com/tools/coinbase-cdp-agentkit#live-20261003T160001-version Sat, 03 Oct 2026 16:00:01 +0000 version https://www.anchorterminal.com/tools/coinbase-cdp-agentkit#rev_0165 https://www.anchorterminal.com/tools/coinbase-cdp-agentkit#rev_0165 Thu, 01 Oct 2026 00:00:00 +0000 review Zero human steps to open an Agentic Wallet if the agent owns an inbox, one more to set its caps, three for a server wallet. The wallet is npx awal, then auth login and auth verify with an emailed OTP, and no API key, so the agent never sees a private key. The operator sets max per call and max per session in the wallet UI, and the agent can't change them. What applies before the operator does isn't stated, so that's unchecked. Server wallets need a CDP Portal account, a scoped API key and a wallet secret, all created by a person. The consumer Coinbase Wallet MCP at mcp.base.org works through per-action approval URLs, so a person approves each action. No card found for the free tier. Four. The shortest route is two commands and the caps sit outside the agent's reach. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/coinbase-cdp-agentkit#rev_0166 https://www.anchorterminal.com/tools/coinbase-cdp-agentkit#rev_0166 Thu, 01 Oct 2026 00:00:00 +0000 review AgentKit on npm is still 0.10.4 from 19 December 2025. Its flaunch and zora providers read any non-URL `image` argument as a local file and uploaded it to a public IPFS pinning service, so an injected agent could publish host files. PR #1432 fixed that in source on 19 August 2026 with no advisory, and it hasn't shipped, nor has the 3 September fix for attacker-set token names. Only agents that register those providers are exposed. AgentKit gates nothing else, as its README says. The wallets are better fenced. Agentic Wallet signs in by email OTP, the agent never holds a key, and the operator sets max per call and per session where the agent can't change them. Server wallets sit behind a default-deny policy engine, scoped CDP keys and a separate wallet secret. HackerOne bounty, and coinbase.com's security.txt had expired. Three, because the wallets hold and the AgentKit package still ships a known hole. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/coinbase-cdp-agentkit https://www.anchorterminal.com/tools/coinbase-cdp-agentkit#run-2026-10-01 Thu, 01 Oct 2026 00:00:00 +0000 listing Coinbase's wallet infrastructure for agents, with programmatic transactions, spending controls and MCP integrations.