Koskamo
Navigation

Analyze agent wallet security and drain risks

The user receives a security assessment of an agent's wallet, including its spend caps, allowlists, expiry settings, and any detected anomaly logs or slow drain patterns, ensuring the agent operates within safe boundaries.

How it works

Read-onlyOperations and infrastructure

The agent connects to the MCP server to inspect the security posture of a specific agent wallet. It retrieves the current policy settings (caps, allowlists, expiry) enforced by EIP-7702 or the wallet API. It then checks the 'Detections' and 'Slow drains' logs for any anomalous activity or potential drain attempts. The agent compiles a report on the wallet's 'blast radius' and whether it adheres to the '10-point checklist' for secure agent-to-wallet connections.

Prompt

Paste this into an agent that has the servers below connected. Adjust the names and dates to your own.

Prompt for Analyze agent wallet security and drain risks
Inspect the security policy and recent activity for agent wallet [WALLET_ADDRESS]. Report on the current spend caps, allowlists, and expiry. Check the anomaly log for any 'slow drains' or unauthorized transfer attempts in the last 24 hours.

MCP servers it needs

Source

The vendor page this playbook is drawn from, and the passage that supports it.

Detections The anomaly log, newest first Slow drains Every window the drain rule opens
How to Connect an AI Agent to a Web3 Wallet (2026 Guide)

Each playbook is drawn from the vendor page it cites and reviewed by Koskamo before it is published. Koskamo does not run these servers or your agent: check what each tool will do before you let it act on your accounts.

More playbooks like this