MPC Wallets for AI Agents, Compared (2026)

Last updated: 21 October 2026

Think of a safe that opens only when two keys turn together. One of those keys stays on a machine you control.

An MPC wallet for AI agents is a vault that signs with a threshold. The key is split into shares on devices you control, and no single key is ever assembled. A transaction completes only when enough shares join. The agent requests the signature. It does not hold a key.

Accountability sits with the person who funded the agent

On 14 October 2026, Chainalysis published the North America chapter of its Geography of Cryptocurrency report. The line that matters: "Accountability must trace to whoever deployed and funded the agent, not the agent itself." Beside it: "The compliance logic shifts from screening each payment to screening the setup, the destination, and the pattern."

A spend limit is not a gate. It is a rule wrapped around whoever can finish the signature. If a provider can complete that signature without a share on your device, the limit is a promise the server has to keep. In a Vultisig Fast Vault the split is 2-of-2. One share stays on your device. VultiServer holds the other, co-signs, and cannot sign alone, so the payment still needs the device. That is the SDK's Fast Vault, checked 20 October 2026.

The arrangement is the two-key setup. The math is DKLS23 signing, from Silence Laboratories. There is no seed phrase, because there is no single secret to copy. The SDK is open source. The public product lists 36+ native chains (vultisig.com, 20 October 2026).

A Secure Vault is the other shape. Every share sits on devices you hold, the threshold is N-of-M, and a person co-signs from a device you paired. No server share is in that path.

Four rows, not a feature list

Same order in every row: Vultisig, Coinbase Agentic Wallets, Cobo, MetaMask Guard Mode.

Who holds the signing share

• Vultisig. Fast Vault: your device and VultiServer, 2-of-2. Secure Vault: devices you hold, N-of-M.
• Coinbase Agentic Wallets. The keys stay in Coinbase infrastructure, inside a TEE, and are not exposed to the agent (Coinbase launch, 11 February 2026).
• Cobo. An unattended payment is 2-of-2 between an agent share and a share on Cobo infrastructure. Cobo states that neither share can sign alone (Cobo Agentic Wallet page, reviewed 20 October 2026).
• MetaMask Guard Mode. You hold the key. Guard Mode sets a daily spend limit and requires 2FA when a payment falls outside that policy (MetaMask agent wallet page, reviewed 20 October 2026).

What the provider can do without your device

• Vultisig. It cannot move the funds. VultiServer cannot finish a Fast Vault signature alone. A Secure Vault has no provider share.
• Coinbase Agentic Wallets. The signature does not require a share on your device. The key is in their infrastructure.
• Cobo. The Cobo share cannot sign alone. The unattended signature is the agent share plus Cobo, so the human share is not in it.
• MetaMask Guard Mode. MetaMask does not hold a signing share. Guard Mode applies the limit to a key you hold.

Where the spend policy is enforced

• Vultisig. Your device has to join a Fast Vault signature. On a Secure Vault, a person co-signs.
• Coinbase Agentic Wallets. Session caps and per-transaction limits sit on the service that holds the key (same launch, 11 February 2026).
• Cobo. Pact checks the payment. The co-signer holding the Cobo share is part of the unattended signature.
• MetaMask Guard Mode. The daily limit and the 2FA check sit in Guard Mode.

If the provider is compromised

• Vultisig. The server share, taken alone, cannot sign. A Secure Vault does not leave a share with the provider.
• Coinbase Agentic Wallets. The keys are in that infrastructure. Whoever can operate the signing environment can produce the signature.
• Cobo. The Cobo share alone cannot sign. Unattended payments still need that share to co-sign.
• MetaMask Guard Mode. The key stays with you. MetaMask's service is not a share in the signature.

The share row decides the other three.

Agents are already paying in cents

By the end of Chainalysis's 2026 reporting period, the 12 months ending 1 July 2026, more than 138 million x402 transactions had occurred on Base. Over a separate window, the 16 months ending September 2026, more than 87% of x402 payments fell between $0.0001 and $0.10. The common payment is a call, not a balance moving between treasuries. What they buy is a short list: model inference is one of the largest categories, and so are information services such as code review, financial intelligence, and data APIs. Source: Chainalysis, "North America: Inside the Growth of Agentic Commerce," 14 October 2026.

The wallets show up ready to spend. In late 2025 the median wallet was 73 days old at its first x402 payment. By the third quarter of 2026 the median was 18 minutes. In the third quarter of 2025, 4% of wallets paid within an hour of being funded. By the third quarter of 2026, 67% did. Same chapter, same date.

Repeat funding is a different cut. Chainalysis counted only wallets that sent on two or more separate days. Among those, 70.6% of wallets first funded in the third quarter of 2025 received a second funding within 30 days. For wallets first funded in the second quarter of 2026, the share was 89.3%.

How to give an agent a wallet with a hard limit

The calls below are @vultisig/sdk and @vultisig/cli as the SDK documents them, checked 20 October 2026. The builders' SDK page is the map of the two vaults.

1. Install the SDK the agent will import: npm install @vultisig/sdk. A pipeline that shells out uses npm install -g @vultisig/cli.

1. Create a Fast Vault on the machine that will run the agent. The call generates the device share. VultiServer holds the other half.

import { Vultisig, Chain } from "@vultisig/sdk";


 


const sdk = new Vultisig();
await sdk.initialize();


 


const vaultId = await sdk.createFastVault({
  name: "Agent wallet",
  email: "[email protected]",
  password,
});

password is the vault password you chose. The sample address is the one in the SDK guide.

1. Verify the email code before anything signs. code is that email code. Until verifyVault returns, the vault cannot sign.

const vault = await sdk.verifyVault(vaultId, code);

1. Pay from the device share. VultiServer co-signs. A process that only has the server cannot finish this signature. destination is the address you are paying. amount is a human-readable string.

await vault.send({
  chain: Chain.Ethereum,
  to: destination,
  amount: "0.05",
});

1. From a pipeline, create the same vault with no prompts. --ci writes JSON, refuses interactive questions, and stays quiet. Creation stops until the email code arrives, so the second command finishes it. The vault id is in the JSON from the first command.

vultisig create fast --name "Agent wallet" --email "[email protected]" --password "$VAULT_PASSWORD" --ci
vultisig verify "$VAULT_ID" --code "$EMAIL_CODE"

1. When a person has to co-sign, create a Secure Vault and pair the other devices from the Vultisig app. The SDK guide's shape is 2 of 3 devices. displayQRCode is your function. It has to show the QR the other phones scan. Keygen runs after those devices join. Shares stay on the devices. There is no server share.

await sdk.createSecureVault({
  name: "Agent wallet",
  devices: 3,
  threshold: 2,
  onQRCodeReady: (qrPayload) => {
    displayQRCode(qrPayload);
  },
});

Put the Fast Vault on the machine that will run the agent, and finish the email check before that machine signs anything. When a payment should wait for a person, pair their device into a Secure Vault.

FAQ

What is an MPC wallet for an AI agent?

A vault that signs with a threshold. The key is split into shares on devices you control, no complete key is assembled, and the agent requests a signature instead of holding one.

Can the provider sign without my device?

Not with Vultisig. A Fast Vault needs the share on your device, and VultiServer cannot sign alone. A Secure Vault has no server share. A person co-signs from a device you paired.

Where does a spend limit bind?

It binds the party who can refuse the signature. On a Fast Vault that party includes your device, because VultiServer cannot complete the signature alone.

What happens to the funds if the provider is compromised?

An attacker who takes only VultiServer still lacks the device share, and a Fast Vault will not sign. A Secure Vault does not place a share with the provider.