coinbase-agentkit — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited coinbase-agentkit (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
AgentKit is Coinbase's open-source framework for building AI agents with onchain capabilities. It provides wallet management, 50+ built-in actions (transfers, swaps, contract deployment, NFT minting), and integrations with LangChain, Vercel AI SDK, and Model Context Protocol. Framework-agnostic and wallet-agnostic — works with CDP wallets, Viem, Privy, and ZeroDev.
Source: https://github.com/coinbase/agentkit
LLMs have stale training data. These are the most common mistakes.
@coinbase/cdp-agentkit-core and @coinbase/cdp-langchain packages are retired. The current package is @coinbase/agentkit with framework extensions @coinbase/agentkit-langchain and @coinbase/agentkit-vercel-ai-sdk. If you see imports from cdp-agentkit, you are using the deprecated SDK.CdpEvmWalletProvider in v0.1+. There is also CdpSmartWalletProvider for smart contract wallets and CdpV2SolanaWalletProvider for Solana. Using the old name will fail.ChatOpenAI. It works equally well with Anthropic, Google, or local models.@coinbase/agentkit. The scoped name is required.CdpEvmWalletProvider and requires CDP_API_KEY_ID and CDP_API_KEY_SECRET environment variables. Without them, initialization throws a cryptic error about missing credentials.ViemWalletProvider accepts a private key for local testing, but production agents must use CdpEvmWalletProvider or CdpSmartWalletProvider where keys are managed by CDP infrastructure.npm install @coinbase/agentkitWith LangChain integration:
npm install @coinbase/agentkit @coinbase/agentkit-langchain @langchain/langgraph @langchain/openaiWith Vercel AI SDK:
npm install @coinbase/agentkit @coinbase/agentkit-vercel-ai-sdk ai @ai-sdk/openaiScaffold a complete project:
npm create onchain-agent@latestemitDecoratorMetadata: true in tsconfig (for custom actions)Set environment variables:
export CDP_API_KEY_ID="your-key-id"
export CDP_API_KEY_SECRET="your-key-secret"Or use a .env file (never commit this):
CDP_API_KEY_ID=your-key-id
CDP_API_KEY_SECRET=your-key-secretAgentKit is wallet-agnostic. Choose a provider based on your security and UX requirements.
CDP-managed wallets. Keys are stored and signed server-side by Coinbase infrastructure. Best for production agents.
import { CdpEvmWalletProvider } from "@coinbase/agentkit";
const wallet = await CdpEvmWalletProvider.configureWithWallet({
apiKeyId: process.env.CDP_API_KEY_ID,
apiKeySecret: process.env.CDP_API_KEY_SECRET,
networkId: "base-sepolia",
});
console.log("Wallet address:", wallet.getAddress());
console.log("Network:", wallet.getNetwork().networkId);Persist and restore wallet state across sessions:
const exportedData = wallet.exportWallet();
const serialized = JSON.stringify(exportedData);
const restored = await CdpEvmWalletProvider.configureWithWallet({
apiKeyId: process.env.CDP_API_KEY_ID,
apiKeySecret: process.env.CDP_API_KEY_SECRET,
cdpWalletData: JSON.parse(serialized),
});ERC-4337 smart contract wallets with gasless transactions via paymasters. Ideal for agents that need sponsored gas.
import { CdpSmartWalletProvider } from "@coinbase/agentkit";
const smartWallet = await CdpSmartWalletProvider.configureWithWallet({
apiKeyId: process.env.CDP_API_KEY_ID,
apiKeySecret: process.env.CDP_API_KEY_SECRET,
networkId: "base-sepolia",
paymasterUrl: process.env.PAYMASTER_URL,
});Use any viem-compatible wallet. Useful for local development and testing where you control the private key.
import { ViemWalletProvider } from "@coinbase/agentkit";
import { createWalletClient, http } from "viem";
import { privateKeyToAccount } from "viem/accounts";
import { baseSepolia } from "viem/chains";
const account = privateKeyToAccount(process.env.PRIVATE_KEY as `0x${string}`);
const client = createWalletClient({
account,
chain: baseSepolia,
transport: http(),
});
const wallet = new ViemWalletProvider(client);Privy server wallets for applications that already use Privy for auth.
import { PrivyWalletProvider } from "@coinbase/agentkit";
const wallet = await PrivyWalletProvider.configureWithWallet({
appId: process.env.PRIVY_APP_ID,
appSecret: process.env.PRIVY_APP_SECRET,
networkId: "base-sepolia",
});import { AgentKit } from "@coinbase/agentkit";
const agentKit = await AgentKit.from({
walletProvider: wallet,
actionProviders: [
walletActionProvider(),
erc20ActionProvider(),
cdpApiActionProvider({
apiKeyId: process.env.CDP_API_KEY_ID,
apiKeySecret: process.env.CDP_API_KEY_SECRET,
}),
],
});If no walletProvider or actionProviders are specified, AgentKit defaults to CdpEvmWalletProvider with walletActionProvider.
Action providers define what an agent can do onchain. Each provider groups related actions.
import { walletActionProvider } from "@coinbase/agentkit";
const actions = walletActionProvider();Provides: getBalance, getWalletDetails, nativeTransfer
import { erc20ActionProvider } from "@coinbase/agentkit";
const actions = erc20ActionProvider();Provides: getBalance, transfer, approve, getAllowance
import { erc721ActionProvider } from "@coinbase/agentkit";
const actions = erc721ActionProvider();Provides: mint, transfer, getBalance
import { wethActionProvider } from "@coinbase/agentkit";
const actions = wethActionProvider();Provides: wrapEth (ETH to WETH)
Requires CDP API credentials. Provides access to Coinbase's swap and faucet APIs.
import { cdpApiActionProvider } from "@coinbase/agentkit";
const actions = cdpApiActionProvider({
apiKeyId: process.env.CDP_API_KEY_ID,
apiKeySecret: process.env.CDP_API_KEY_SECRET,
});Provides: requestFaucet, tradeTokens (swap via CDP API)
import { compoundActionProvider } from "@coinbase/agentkit";
const actions = compoundActionProvider();Provides: supply, withdraw, borrow, repay, getPortfolio
import { morphoActionProvider } from "@coinbase/agentkit";
const actions = morphoActionProvider();Provides: deposit, withdraw
import { pythActionProvider } from "@coinbase/agentkit";
const actions = pythActionProvider();Provides: fetchPrice (real-time price data from Pyth oracles)
Register and manage Base names (ENS equivalent on Base).
import { basenameActionProvider } from "@coinbase/agentkit";
const actions = basenameActionProvider();Provides: registerBasename
import { twitterActionProvider } from "@coinbase/agentkit";
import { farcasterActionProvider } from "@coinbase/agentkit";
const twitter = twitterActionProvider();
const farcaster = farcasterActionProvider();Twitter provides: postTweet, getAccountDetails Farcaster provides: postCast, getAccountDetails
| Provider | Actions |
|---|---|
openseaActionProvider | listNft, getNftBalance |
superfluidActionProvider | createFlow, updateFlow, deleteFlow |
moonwellActionProvider | supply, withdraw, borrow, repay |
acrossActionProvider | bridgeTokens (cross-chain bridge) |
defiLlamaActionProvider | getProtocolTvl, getProtocolList |
jupiterActionProvider | swap (Solana DEX aggregator) |
zeroXActionProvider | getQuote, swap (0x aggregator) |
zoraActionProvider | createToken, mint |
clankerActionProvider | deployToken (Farcaster token deployment) |
wowActionProvider | createMemecoin, buyMemecoin, sellMemecoin |
ensoActionProvider | routeSwap |
fluidActionProvider | lend, borrow |
The most common integration pattern. Converts AgentKit actions into LangChain tools.
import { AgentKit } from "@coinbase/agentkit";
import { getLangChainTools } from "@coinbase/agentkit-langchain";
import { ChatOpenAI } from "@langchain/openai";
import { createReactAgent } from "@langchain/langgraph/prebuilt";
import { MemorySaver } from "@langchain/langgraph";
const agentKit = await AgentKit.from({
walletProvider: wallet,
actionProviders: [
walletActionProvider(),
erc20ActionProvider(),
cdpApiActionProvider({
apiKeyId: process.env.CDP_API_KEY_ID,
apiKeySecret: process.env.CDP_API_KEY_SECRET,
}),
],
});
const tools = await getLangChainTools(agentKit);
const llm = new ChatOpenAI({ model: "gpt-4o" });
const memory = new MemorySaver();
const agent = createReactAgent({
llm,
tools,
checkpointSaver: memory,
});
const result = await agent.invoke(
{ messages: [{ role: "user", content: "What is my wallet address?" }] },
{ configurable: { thread_id: "session-1" } }
);import { AgentKit } from "@coinbase/agentkit";
import { getVercelAITools } from "@coinbase/agentkit-vercel-ai-sdk";
import { openai } from "@ai-sdk/openai";
import { generateText } from "ai";
const agentKit = await AgentKit.from({ walletProvider: wallet });
const tools = await getVercelAITools(agentKit);
const { text } = await generateText({
model: openai("gpt-4o"),
tools,
prompt: "Get my wallet balance on Base Sepolia",
maxSteps: 5,
});AgentKit can run as an MCP server, exposing actions to any MCP-compatible client.
npm install @coinbase/agentkit-model-context-protocolimport { AgentKit } from "@coinbase/agentkit";
import { getMcpTools } from "@coinbase/agentkit-model-context-protocol";
const agentKit = await AgentKit.from({ walletProvider: wallet });
const server = getMcpTools(agentKit);
server.listen();Create domain-specific actions by extending ActionProvider.
Requires emitDecoratorMetadata: true in your tsconfig.json:
{
"compilerOptions": {
"emitDecoratorMetadata": true,
"experimentalDecorators": true
}
}Define a custom action:
import {
ActionProvider,
WalletProvider,
Network,
CreateAction,
} from "@coinbase/agentkit";
import { z } from "zod";
const CheckPriceSchema = z.object({
tokenSymbol: z.string().describe("Token symbol to check price for"),
});
class PriceCheckerProvider extends ActionProvider<WalletProvider> {
constructor() {
super("price-checker", []);
}
@CreateAction({
name: "check_price",
description: "Check the current USD price of a token",
schema: CheckPriceSchema,
})
async checkPrice(
walletProvider: WalletProvider,
params: z.infer<typeof CheckPriceSchema>
): Promise<string> {
const response = await fetch(
`https://api.coingecko.com/api/v3/simple/price?ids=${params.tokenSymbol}&vs_currencies=usd`
);
const data = await response.json();
return JSON.stringify(data);
}
supportsNetwork(_network: Network): boolean {
return true;
}
}
export const priceCheckerProvider = () => new PriceCheckerProvider();Register with AgentKit:
const agentKit = await AgentKit.from({
walletProvider: wallet,
actionProviders: [
walletActionProvider(),
priceCheckerProvider(),
],
});const wallet = await CdpEvmWalletProvider.configureWithWallet({
apiKeyId: process.env.CDP_API_KEY_ID,
apiKeySecret: process.env.CDP_API_KEY_SECRET,
networkId: "base-mainnet",
});| Network | ID |
|---|---|
| Base Mainnet | base-mainnet |
| Base Sepolia | base-sepolia |
| Ethereum Mainnet | ethereum-mainnet |
| Ethereum Sepolia | ethereum-sepolia |
| Arbitrum Mainnet | arbitrum-mainnet |
| Polygon Mainnet | polygon-mainnet |
| Solana Mainnet | solana-mainnet |
| Solana Devnet | solana-devnet |
import { defineChain } from "viem";
const customChain = defineChain({
id: 84532,
name: "Base Sepolia",
nativeCurrency: { name: "ETH", symbol: "ETH", decimals: 18 },
rpcUrls: {
default: { http: ["https://your-rpc-url.com"] },
},
});
const client = createWalletClient({
account,
chain: customChain,
transport: http("https://your-rpc-url.com"),
});CDP API keys can be scoped to specific actions. In the CDP portal:
CDP wallets can export private keys for migration, but this should be rare:
const exportedWallet = wallet.exportWallet();Once exported, the key material leaves CDP infrastructure. Handle with extreme care.
CdpEvmWalletProvider or CdpSmartWalletProvider (not Viem with raw keys)CDP_API_KEY_SECRET in a secrets manager (not .env in production)CdpSmartWalletProvider with paymasters for gasless UXRequest testnet tokens via the CDP faucet action:
import { cdpApiActionProvider } from "@coinbase/agentkit";
const cdpActions = cdpApiActionProvider({
apiKeyId: process.env.CDP_API_KEY_ID,
apiKeySecret: process.env.CDP_API_KEY_SECRET,
});The requestFaucet action is available on Base Sepolia and Ethereum Sepolia.
The fastest way to start:
npm create onchain-agent@latest
cd my-onchain-agent
cp .env.example .env
# Fill in CDP_API_KEY_ID, CDP_API_KEY_SECRET, OPENAI_API_KEY
npm install
npm run devThis creates a chatbot agent with wallet access, token operations, and LangChain integration out of the box.
const agentKit = await AgentKit.from({
walletProvider: wallet,
actionProviders: [walletActionProvider(), erc20ActionProvider()],
});
const tools = await getLangChainTools(agentKit);
const agent = createReactAgent({ llm, tools });
const result = await agent.invoke({
messages: [{
role: "user",
content: "Check my ETH balance, and if I have more than 0.01 ETH, send 0.005 ETH to 0x742d35Cc6634C0532925a3b844Bc9e7595f2bD18",
}],
});const agentKit = await AgentKit.from({
walletProvider: wallet,
actionProviders: [
walletActionProvider(),
erc20ActionProvider(),
erc721ActionProvider(),
wethActionProvider(),
cdpApiActionProvider({
apiKeyId: process.env.CDP_API_KEY_ID,
apiKeySecret: process.env.CDP_API_KEY_SECRET,
}),
compoundActionProvider(),
pythActionProvider(),
basenameActionProvider(),
],
});| Version | Change |
|---|---|
| 0.2.x | Added Solana support, ZeroDev, Privy providers |
| 0.1.x | New architecture: CdpEvmWalletProvider, action provider system, framework extensions |
| Pre-0.1 | Legacy @coinbase/cdp-agentkit-core (deprecated) |
Last verified: February 2026 against @coinbase/agentkit v0.2.x
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.