> ## Documentation Index
> Fetch the complete documentation index at: https://docs.walletsuite.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Give an AI Agent a Wallet

> Give your AI agent a financial identity on the hosted WalletSuite platform — provision it, connect an MCP client, and grant it read, prepare, and signing authority.

Give every AI agent a financial identity it can act with — authenticated, scoped, and governed, with signing keys it never sees. WalletSuite runs the platform; you connect your agent to the hosted MCP endpoint and grant it exactly the authority it needs.

This walkthrough goes read → prepare → sign. What an agent can do is set server-side by its tool profile and token scopes, not by anything the agent holds — see [Execution Levels](/ai-agents/execution-levels).

## Prerequisites

* A WalletSuite organization with a provisioned agent and its key — see [Credentials & Authentication](/getting-started/prerequisites/credentials-and-authentication)
* A server or runtime that holds the agent's key and authorizes it
* Any MCP client that speaks HTTP — see [Install Guides](/ai-agents/install-guides)

## Step 1 — Provision an agent

From your dashboard, provision an agent. You receive an `agentId` and one dedicated key — the agent's [identity](/core-concepts/agents-and-authority). The key stays on your server and never reaches the model, the browser, or a prompt.

## Step 2 — Authorize the agent

Your server authorizes the agent with its key. The raw key never leaves your server, and the model only ever sees a disposable token. See [Connect Your Agent](/ai-agents/token-exchange) for the flow.

## Step 3 — Connect an MCP client

Point your MCP client at `https://mcp.walletsuite.io` with the bearer in the `Authorization` header. The agent sees only the tools its profile and scopes allow — tools outside that surface are never registered, so a prompt cannot call what the agent was not granted. Full config in [Connect Your Agent](/ai-agents/token-exchange).

## Step 4 — Try it

Your agent starts at Read (R0): balances, prices, fees, transaction history, and asset resolution. No signing scope is present, so no signing tool is even reachable. Ask your agent any of these:

```text theme={null}
What is the ETH balance of 0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045?
```

You should see a structured response with the balance in ETH and its USD value.

Try a few more:

* `What's the price of ETH right now?`
* `Show me recent transactions for 0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045 on ethereum`
* `Resolve USDC on ethereum` — finds the token contract address
* `What would the gas fee be for sending 1 ETH from 0xabc to 0xdef?`

## Step 5 — Grant more authority

To let the agent construct unsigned transactions, grant it the **Prepare** level; to sign and broadcast, grant **Execute**; for autonomous operation under budgets and rules, grant **Governed Autonomous**. A level is the tool profile bound to the agent plus the scopes minted at [token exchange](/ai-agents/token-exchange) — nothing to install, nothing to self-operate. See [Execution Levels](/ai-agents/execution-levels).

Every level above Read clears the [policy engine](/core-concepts/policy-gates) before anything is signed — destination allowlists, value caps, and per-agent budgets decide each intent, and a denied intent cannot be signed.

Signing runs through non-custodial MPC threshold signing — no full private key is ever assembled, and no single party can sign alone. See the [trust model](/security/overview#trust-model).

## What Happens Under the Hood

```text theme={null}
Your agent calls a tool
  → hosted MCP endpoint authorizes the token and applies the agent's tool profile and scopes
    → runs the call: a read query, an unsigned payload, or a policy-checked signing intent
  → returns a structured response
```

The agent never holds a key or a raw credential. The hosted platform translates natural language into governed blockchain operations and enforces authority on every call.

<Note>
  Calling WalletSuite directly from a backend or SDK with an `x-api-key` — no MCP, no agent — is a separate path. See [Add Wallet Operations to Your Application](/getting-started/use-case-guides/add-wallet-to-backend).
</Note>

## Next Steps

* [Connect Your Agent](/ai-agents/token-exchange) — the full provision → exchange → connect flow
* [Execution Levels](/ai-agents/execution-levels) — Read, Prepare, Execute, and Governed Autonomous
* [Policy Gates](/core-concepts/policy-gates) — deny-by-default rules that decide what an agent can sign
* [Choose Your Surface](/ai-agents/choose-your-setup) — the five surfaces of the one hosted platform
* [Tool Reference](/ai-agents/tool-reference) — complete list of all available tools
* [Security Overview](/security/overview#trust-model) — the full non-custodial trust model
* [Supported Chains](/supported-chains) — full chain list for read, prepare, and signing