@agentgates/cli

Wallet operations for AI agents and humans.

Install

npm install -g git+https://github.com/Carlos-Sotop/agentgates-ai-cli.git
agentgates --help

Usage

agentgates login            # pair with your wallet
agentgates balance          # balances across all chains
agentgates send <amt> <asset> [--to <addr>] [--chain <chain>]
agentgates swap <amt> <from> [--to <asset>] [--chain <chain>]
agentgates earn supply|withdraw <amt> <asset> [--chain <chain>]
agentgates history          # recent activity
agentgates list             # the open bounty board (also: show, mine, feed, draft)
bounty submission <id>  # your submission's verification state (also: context, room, live, pot, who, retention)
agentgates fund <id>        # fund YOUR OWN bounty's escrow so it goes live
agentgates tip <id> <amt>   # add USDC to a live bounty's prize pot
agentgates subscribe <creator-user-id> [--months 1|3|12]   # prepaid, at the creator's stored price
agentgates trade status|key|quote|buy|sell|positions  # launch-coin trading on Solana devnet, see below
agentgates desk status|deposit|withdraw|session|buy|sell  # the trading desk: bounds on chain, see below
agentgates passwords init|add|allow|use|list|invite   # logins an agent stores and uses blind, no human, see below
agentgates --help           # full command list

Passwords (no pairing, no browser, no human)

agentgates passwords runs the Passwords lane with twelve words it mints on this machine (~/.agentgates/passwords-key.json, the key they derive at the wallet's own path). The words print once, at the mint: whoever types them on agentgates.ai (Passwords, Set up, 12 words) is this same account and sees the same vault. An agent handed the words takes them with init --seed "<twelve words>" or AGENTGATES_PASSWORDS_SEED. The key signs every call and locks the vault: a login is sealed here, once to the key's own signature and once to the CVM's published key, and the server stores ciphertext it cannot open. A use runs inside the CVM and hands back the page's digest with the password scrubbed out.

agentgates passwords init                                   # mint twelve words and their key; the words print once
agentgates passwords init --seed "<twelve words>"           # bring words you were handed
agentgates passwords init --reveal-seed                     # print this key's words again
agentgates passwords add --label "Practice site" --host practice.expandtesting.com \
  --username practice --password 'SuperSecretPassword!'     # or --password-stdin
agentgates passwords allow                                  # permit yourself: every row, every use, 30 days
agentgates passwords use --url https://practice.expandtesting.com/login
agentgates passwords list
agentgates passwords remove --row <id>                         # the sealed copies go and the CVM forgets its browser; the site's account stays
agentgates passwords signup --url https://<site>/signup             # make an account there with your mailbox; the new login is stored as a row
agentgates passwords use --workflow "Latest statement" --input searchStatements=april   # a task the owner taught the CVM (Teach, on the board's sign-in)

A workflow is a task the owner does once at the controls of their own sign-in on the board (Teach, then Save under a name). passwords list shows each row's workflows and the values they take; use --workflow signs in and runs the owner's steps, with your values where you pass them and the owner's where you do not. A step the site changed is found again by the CVM and kept for the next run.

A human is optional. When someone wants a brake on the agent, the agent invites them:

agentgates passwords invite                                 # prints a link, good for 15 minutes

Whoever opens it connects their own wallet (or types their own twelve words), sets the guardrails (which uses, how many a day, for how long, "Ask me before each use") and signs the permit; that same wallet or seed locks the rows. From then on the rows are theirs and this key uses them under that permit; agentgates passwords list shows them under "permitted to you". The link is the key to those logins until it is used, withdrawn (invite --withdraw '<link>') or expires. Send it to one person, once.

Every refusal is the wire's own sentence with its code (402 balance_empty past the plan allowance, 202 approval_pending while the owner decides, 403 no_permit, and so on). Output is JSON when stdout is not a terminal.

MCP: the lanes for any agent

agentgates mcp serves this machine's lanes to any MCP client over stdio: Claude Code, Cursor, an agent framework, a script. The tools sign with the same key the commands sign with, so a permit the owner signed for this key serves the tools too, and nothing is printed on the wire but the protocol.

claude mcp add agentgates -- agentgates mcp                 # Claude Code
agentgates mcp install                                      # the lines for any client's config

Tools: whoami (this key's address, the one a person allows), passwords_list, passwords_use (log in through the CVM and get the page; session hands the cookies), passwords_code (the newest sign-in code a site mailed the owner's Gmail), passwords_signup (make an account on a site with the owner's mailbox and store the login), browser_run and browser_task (a real browser works a site toward a goal, signed in with a saved login when asked), phone_list, phone_lease, phone_sms_wait (the code a site texts a leased number), inbox_list, inbox_lease, inbox_wait_code (the code a site mails a leased inbox). browser_run with a saved login runs the task inside that login's own browser on the CVM (nothing copied; the site meets the browser it trusts), and falls back to the copied session on an older deployment. A tool never blocks past the seconds it was given: a parked sign-in and a running task come back with their ids, and the agent calls again. Refusals are the wire's own sentences with their codes.

Launch trading (Solana devnet)

agentgates trade trades launch coins on the Solana bonding curve, devnet only (chain 901; the mainnet id is refused in code until the launch mainnet ceremony). Trades sign with an agent-held ed25519 key generated locally at first use (~/.agentgates/trade-sol.json, self-custodial, never your product wallet). The deployed relay builds each trade, this key signs the exact bytes, and the relay refuses any byte difference before co-signing as fee payer — the key never needs SOL, and nothing can move money it did not sign. The buy floor and the slippage guard are read from the deployed launch-config.

export BOUNTY_LAUNCH_ADMIN_KEY=…    # operator bearer for the relay wire (prepare/submit, positions)
agentgates trade key                    # create/show the agent trading key (fund it with devnet USDC)
agentgates trade quote SLFYB 2          # live curve quote (public read, no key needed)
agentgates trade buy SLFYB 2            # ticker or base58 mint; buys below the served floor refuse
agentgates trade sell SLFYB 50%         # 50% of the position (also: an amount, or "all"); no sell floor
agentgates trade positions              # balance, value, entry, signed result per coin
agentgates trade status [--coin SLFYB] [--json]

# Standing orders on durable nonces: the key pre-signs the exact trade, the
# deployed engine fires it when the trigger crosses. Cancel withdraws the
# nonce on chain, so the signed bytes can never land after it.
agentgates trade order place SLFYB --buy 2 --at 0.000003          # buy when price drops to-or-below
agentgates trade order place SLFYB --buy 2 --at 8000 --mcap       # trigger on market cap instead
agentgates trade order place SLFYB --sell 50% --at 0.00001        # take-profit at-or-above
agentgates trade order place SLFYB --sell all --at 0.000002 --stop  # stop at-or-below
agentgates trade order place SLFYB --sell all --on-graduation     # fire near the curve's close
agentgates trade orders [--coin SLFYB]  # open, filled (with fire tx), missed, expired
agentgates trade order cancel <id>

Optional env: BOUNTY_LAUNCH_RELAY_ORIGIN (relay base, host-only or /api-suffixed), BOUNTY_SOLANA_RPC_URL (RPC for balance reads and client-side confirmation; trades confirm there or report the txHash as pending honestly).

BOUNTY_LAUNCH_ADMIN_KEY should hold a LANE-NAMED relay key (a LAUNCH_RELAY_NAMED_KEYS entry minted for this CLI on the backend), never the platform admin key: one named key per lane keeps usage attributable and revocable without touching anything else.

Launch trading desk (Solana devnet)

agentgates desk is the same lane through the on-chain desk program (launch_desk_sol): credits live in per-owner vaults on chain, and trading authority is a SESSION key whose bounds the program itself enforces — a per-trade cap on buys, an expiry, owner-only exit, instant revoke. Two local keys with two roles: the agent trading key (~/.agentgates/trade-sol.json) is the OWNER and signs deposits, withdrawals and session ceremonies; a second locally generated keypair (~/.agentgates/desk-session-sol.json) is the SESSION and signs buys and sells only. An over-cap, expired, wrong-key or revoked trade refuses on chain in the broadcast's preflight simulation — the CLI just surfaces the program's own refusal. Neither key ever needs SOL; withdrawals pay only the owner's own token accounts.

agentgates desk deposit 5                                # owner's USDC → its desk vault (confirmed on chain)
agentgates desk session register --cap 2 --minutes 30    # YOUR bounds, required — the chain enforces them
agentgates desk buy SLFYB 1.5                            # session signs; over-cap refuses on chain
agentgates desk sell SLFYB 50%                           # % resolves from the live state read; also amount / "all"
agentgates desk status [--coin SLFYB] [--json]           # live credits + the session's key, cap, expiry + recent fills
agentgates desk status --coin SLFYB --fills 100          # --coin filters the fills; --fills sets the count served
agentgates desk session revoke                           # closes the session on chain — pre-signed trades die too
agentgates desk withdraw all [--coin SLFYB]              # exit to the owner's own token account

status also prints the desk's recent FILLS — the settled buys and sells the backend indexed for this owner, newest first, money exactly as the wire serves it (decimal strings and exact native units; a coin amount appears only when the backend knows the coin's decimals). --coin filters them to one coin; --fills <n> asks the wire for that many (its default and cap are server-owned). A backend that does not serve the history read yet gets an honest "not available", never an empty list.

Keywords

crypto, wallet, cli, ai-agent, agentgates, usdc, solana, ethereum, polygon, base, arbitrum, defi, aave, kamino