questions
Giving an AI agent a wallet, answered plainly
The questions people ask before they let an agent touch real money. The answers name the refusal codes you will actually meet, and say where Ava stops rather than leaving you to discover it with capital at stake.
How do I stop my AI agent from draining my wallet?
You sign a mandate before the agent runs, not after it proposes. The mandate fixes the cap, the asset, the venues and the chains, and it is signed with a key Ava never holds. Every later action is checked against that signed envelope by code. An action over the cap is refused with MANDATE_NOTIONAL_EXCEEDED rather than escalated to a prompt, because a prompt at the moment of spending is a prompt people approve.
What is a spending cap mandate?
A mandate is the authorization itself, not a setting. It states the capital ceiling, the asset, the venues and the chains an agent may touch, and it is signed as an EIP-712 payload by a user-controlled key. Ava re-derives the plan from the original request and verifies the signature against those re-derived terms before admitting it, so a plan that drifted from what was signed is not executable at all rather than partly executable.
How does the two-phase preview and execute flow work?
Call an execution tool without a preview hash and Ava refuses with POLICY_HUMAN_CONFIRMATION_REQUIRED, returning the exact artifact that would execute plus the hash of it. Only a second call carrying that hash proceeds. The agent making the call is not the person whose capital moves, so the agent cannot satisfy this step on its own: it has to hand the artifact to a human and get the hash back.
Is there an MCP server that lets Claude Code or Cursor execute on-chain transactions safely?
Ava is one. It speaks MCP at https://api.getava.xyz/mcp and works with Claude Code, Cursor, Codex and Grok. Lending on Aave and Morpho executes today. An anonymous session is enough to plan, preview and use paper mode; moving real capital additionally requires a verified principal, because a credential anyone can mint with one curl is not a person.
How are Ava receipts verified on chain?
A receipt is not the executor's own report of success. GET /v1/receipts/:ref/verify re-reads the settlement from a public RPC and states what it can prove: broadcast, inclusion, and whether the effect survived. A transaction hash proves broadcast and an included block proves inclusion, and neither proves the user asked for it. The receipt is explicit about which of those it is actually asserting.
What happens when Ava cannot do what my agent asked?
It refuses by name instead of substituting a similar action. Ava will not pick the venue or the chain if the request did not name one, will not compute what fraction of your money to move, will not decide how to split one amount across two venues, and will not infer borrow or repay from an instruction it cannot execute. A plausible wrong plan is worse than a refusal, because a preview that looks reasonable is a preview people approve.
Can Ava run unattended on a schedule?
Partly, and the gap is worth stating plainly. You can sign a standing envelope that bounds every future rotation, and the deployed scheduler evaluates live envelopes on their interval and logs per envelope whether it was due. But the pass is handed no executor, so a due envelope is reported DRIVER_DISABLED and no capital moves. Authorizing a standing envelope today is a real authorization that still produces no rotation.
Which chains and protocols does Ava actually execute on?
Ask the API rather than trusting a page. https://getava.xyz/matrix.json is the registry keyed by chain, category and venue, and every blocked route carries the reason it cannot run and the next step that would change that. Lending on Aave and Morpho is live. Every swap and bridge route reports not-executable: the executor and the adapter translation exist and are tested, but no route binds them with a funded wallet, so nothing claims they execute.
How much does it cost to run Ava as an MCP server?
Ava is hosted, so there is no server for you to run. You point your MCP client at https://api.getava.xyz/mcp and create a session with one POST. You pay chain gas for anything that settles, as you would for any transaction you sent yourself.
How is Ava different from an agent wallet SDK like AgentKit, Privy or Turnkey?
Those give an agent a key and a way to sign. The hard part is not signing, it is that nothing in an agent's output is evidence that a user wanted the action, that a retry will not do it twice, or that it actually happened. Ava sits between the proposal and the effect: authorization bound to a user-controlled key, an atomic reservation so a retry cannot double-spend, and a receipt checked against the chain instead of against the executor. It works with a signer, it does not replace one.
Do not take any of this on trust
Every capability claim above is checkable without asking anyone. The registry says which routes execute and why the rest cannot, the reference lists the endpoints and refusal codes, and a receipt can be re-read from a public RPC by someone who does not trust Ava at all.
- /matrix.json
Chain, category and venue, with the reason each blocked route cannot run
- /docs
Endpoints, the MCP tool surface, and the refusal codes
- /verify
Re-read a receipt from the chain
- /llms.txt
The same answers, written for an agent rather than a person