MetaMask AI Agent Wallet: What MetaMask Offers Agents Today
MetaMask offers AI agents two things. Agent Wallet, announced June 8, 2026, gives an agent its own wallet through the mm CLI, with spending limits, allowlists, and 2FA approvals enforced by MetaMask's wallet service. Separately, the Smart Accounts Kit's Advanced Permissions (ERC-7715) let an agent request scoped, onchain-enforced spending rights from a user's MetaMask smart account.
What MetaMask has shipped for agents
This page reflects MetaMask's documentation and press coverage as of November 4, 2026.
MetaMask Agent Wallet. Consensys announced it on June 8, 2026 as a self-custodial wallet for AI agents, initially in limited early access (CoinDesk, The Block). Decrypt reported a public launch on August 6, 2026, following an early-access cohort of about 200 users. Some MetaMask doc pages still mention early access, so check the quickstart for current requirements.
Agents use it through the mm CLI, backed by the @metamask/agent-sdk package, plus installable agent skills that tell the agent which commands to run and when to ask for confirmation. Coverage lists Claude Code, Codex, Cursor, OpenClaw, Hermes, and OpenCode as supported agent environments. The product is aimed at trading: swaps, perpetuals, prediction markets, and liquidity provision on EVM chains and Hyperliquid. The docs' examples include Base, and mm chains list is the authoritative chain list.
Advanced Permissions in the Smart Accounts Kit. MetaMask's developer kit for smart accounts (earlier docs call it the Delegation Toolkit) implements ERC-7715. A dapp or agent calls wallet_requestExecutionPermissions, the user sees a readable confirmation in the MetaMask extension, and approves a scoped permission, for example spending 10 USDC per day for a month. The docs require MetaMask v13.23.0 or later and a user upgraded to a MetaMask smart account. Supported permission types today are ERC-20 and native token permissions.
How Agent Wallet bounds an agent
Agent Wallet has two wallet modes, chosen at mm init.
Server-wallet. Keys are managed server-side in a trusted execution environment, and the agent gets a dedicated wallet with no access to the user's main one. Requests go to MetaMask's wallet service, which evaluates the user's policies before signing. Jobs that need approval enter an awaiting-MFA state and are approved in MetaMask Mobile or by email.
Bring your own wallet. The user supplies a BIP-39 mnemonic, typically through the MM_MNEMONIC environment variable, and requests are signed locally. The docs describe outflow limits and trading modes as server-wallet features and label policy-based 2FA for this mode as coming soon.
On top of that sit two trading modes. Guard Mode, the default, enforces threat scanning, network and address allowlists, a token recipient allowlist, and a rolling 24-hour outflow limit, with 2FA for anything outside them. Beast Mode keeps only threat scanning, with 2FA reserved for transactions flagged as malicious or risky.
Every path includes transaction simulation and Blockaid-powered threat scanning. A gasless relay using EIP-7702 can deduct fees from the ERC-20 being moved, so an agent does not need the chain's native token. MetaMask also offers Transaction Protection of up to $10,000 per month for eligible transactions, as part of its Transaction Shield subscription.
What the docs say about outflow tracking
The outflow limit is estimated from simulation and added to the 24-hour total after submission. MetaMask's docs note that tracking can be imprecise for transactions not submitted through its backend and that signatures such as Permit2 are excluded. Treat the limit as a strong guardrail on the paths it covers, not as a guarantee on every possible signature.
Compared with session keys
A session key is a separate key registered on a smart account with limits the account contract enforces: a spending cap, allowed assets and recipients, an expiry. The agent holds only that key. If it leaks, the loss is bounded by the contract, regardless of what any offchain service does.
Advanced Permissions are this pattern, standardised. The session account holds no tokens. It redeems permissions against the user's smart account through ERC-7710 delegations, and the limits are enforced onchain by the delegation framework. The improvement over hand-rolled session keys is the wallet-level request flow and a readable confirmation the user can adjust.
Agent Wallet in server-wallet mode is a different model. Enforcement lives in MetaMask's service and TEE. That buys threat scanning, simulation, 2FA escalation, and loss coverage that a bare contract cannot offer. It also means the limit holds only as long as that service evaluates it correctly and stays available, and the policies are MetaMask's to define.
Bring-your-own mode is closest to a raw key. A mnemonic in an environment variable can sign anything the account can do, and the docs do not yet describe policy enforcement for it.
The practical rule: know which layer enforces the cap, and assume the layer above it can be manipulated. Agents read untrusted input, so the boundary should sit somewhere the agent's own reasoning cannot reach.
Choosing for a payments workload
Agent Wallet targets agents that trade across DeFi, where simulation, threat scanning, and protocol allowlists earn their keep. An agent that mostly pays for API calls and data has a narrower need: a small float in one stable asset, a fixed set of recipients, and fast settlement.
For that shape, onchain-enforced scope is the property to require. Advanced Permissions provide it inside MetaMask. CryptoCadet provides it as a payment rail: non-custodial, Base-only, USDC by default, with the agent spending from a session-key-bounded float, the session key held in the OS keychain, and support for ERC-20 subscriptions and x402-style pay-per-call.
Frequently asked questions
- Does MetaMask have an AI agent wallet?
- Yes. MetaMask Agent Wallet was announced on June 8, 2026 in early access, and Decrypt reported a public launch on August 6, 2026. Agents operate it through the mm CLI and agent skills, with Guard Mode policies such as allowlists, a rolling 24-hour outflow limit, and 2FA approval for transactions outside those rules.
- Is MetaMask Agent Wallet self-custodial?
- MetaMask describes it as self-custodial. In server-wallet mode the keys are held server-side in a trusted execution environment and MetaMask's service evaluates policies before signing; in bring-your-own-wallet mode the user supplies a mnemonic and signing happens locally. Read the wallet modes reference to decide which trust model fits your agent.
- What are MetaMask Advanced Permissions?
- They are MetaMask's implementation of ERC-7715 in the Smart Accounts Kit. A dapp or agent calls wallet_requestExecutionPermissions, the user approves a readable, adjustable permission such as a daily USDC allowance, and a no-balance session account redeems it later through ERC-7710 delegations. The docs require MetaMask v13.23.0 or later and a smart account.
- How does MetaMask Agent Wallet compare to session keys?
- Session keys and Advanced Permissions enforce limits in the smart account contract, so they hold even if offchain components fail. Agent Wallet's server-wallet mode enforces limits in MetaMask's service and TEE, adding simulation, threat scanning, and 2FA. Bring-your-own mode signs from a local mnemonic, and its policy-based 2FA is still listed as coming soon.