[Proposal] External spend authority for AgentKit wallets (fail-closed, signed verdicts + receipts)
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 28/100
- Issue type
- Feature
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- typescript
- Domain
- authentication, backend-api-design, security
Research direction
Start by reading the AgentKit wallet action wrapper entry points and the upstream reference implementation linked in the proposal, solana-foundation/pay#525. Trace how spend actions are exposed and determine how the proposed HTTP authority and receipt handling fit that flow. Done means spend fails closed on every response except an explicit allow, replay protection survives restarts, and each action leaves an offline-auditable signed receipt.
Written by the indexing model from the issue text.
Description
AgentKit gives agents wallets - the piece we kept missing while running our own paid MCP bridge in production is who decides the spend outside the agent's own process. Nothing externally verifiable records who approved what.
UTA is a remote spending authority over HTTP, with a fail-closed contract (reference implementation upstreamed at solana-foundation/pay#525):
- spend proceeds only on 2xx + explicit
{"decision":"allow"}; timeout / malformed / non-2xx -> deny (never fail-open) (caller_id, operation_id)replay guard, atomic across restarts- Ed25519-signed verdicts + hash-chained receipts, auditable offline
Proposal: an AgentKit action wrapper that gates wallet spend actions through an external authority, leaving signed receipts per action - the enterprise-evidence half that's hard to get from the wallet alone. We'd contribute and maintain the wrapper.
Docs: https://utalabs.tech - Edison Flores, AliceLabs
- Dominant language
- TypeScript
- Stars
- 1.3k
- Forks
- 871
- PR merge metrics
- No merged PRs in 30d
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from coinbase/agentkit
-
Python: Permit2 approval in CdpSmartWalletActionProvider.swap always reports failure (integer vs string receipt status)Possibly taken A pull request linked to this issue is open or already merged. Open
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
Maintainers usually reply within 1 day
-
Moonwell redeem fails on Base Sepolia and uses 18 decimals for cbBTCPossibly taken @sebxt claimed this 3 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
coinbase/agentkit#1578 · 1 comment ·
Maintainers usually reply within 1 day
-
ERC20 transfer reports "Transferred" when the transaction reverts (receipt status ignored)Possibly taken @AgenticFinanceGraph claimed this 12 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
coinbase/agentkit#1558 · 1 comment ·
Maintainers usually reply within 1 day
-
[TypeScript] `ViemWalletProvider` rejects a wallet client from a newer viem than the exactly pinned one (TS2345, `tokens` missing on `Client`)Possibly taken @PrabalParihar claimed this 3 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
coinbase/agentkit#1532 · 3 comments ·
Maintainers usually reply within 1 day
-
coinbase-agentkit 0.7.x fails on fresh install: imports solana.rpc.api, which solana>=0.37 removedPossibly taken @JulienKervarrec claimed this 30 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
Maintainers usually reply within 1 day
All issues in coinbase/agentkit
Similar issues
-
[Bug]: REST API URL starting with "http" but no scheme (e.g. httpbin.org/get) is not given an http:// prefixPossibly taken @ItsDeadlyProgrammer claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
appsmithorg/appsmith#42471 · 1 comment ·
Maintainers usually reply within 2 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
ehmpathy/rhachet-roles-bhrain#705 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
Maintainers usually reply within 1 day
-
Status: Triage
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
mermaid-js/mermaid#8546 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
braintrustdata/braintrust-sdk-javascript#2659 ·
Maintainers usually reply within 1 day