MetaMask Agent Wallet goes live, and the $10,000 cover behind it is not sold in the UK

MetaMask made Agent Wallet generally available on 6 August, two months after the early access run opened in New York on 8 June. The product hands an AI coding agent its own self-custodial wallet and a command-line tool to spend from it. You install @metamask/agent-wallet, add MetaMask’s skills to Claude Code, Codex, Cursor, OpenClaw or Hermes, pick your limits, and the agent swaps, bridges, lends, opens perpetuals and takes prediction-market positions without you at the keyboard.

Consensys is selling the guardrails rather than the returns. “Agents will manage real capital and make real financial decisions, and the infrastructure underneath has to be worthy of that,” said Joe Lubin, founder and chief executive of Consensys and a co-founder of Ethereum, in the June release. The same release cited Gartner’s October 2024 forecast that a quarter of enterprise breaches will trace back to AI agent abuse by 2028, and put the global agent market at $5.4bn in 2024 growing to $236bn by 2034.

The engineering behind that pitch is real, and it is documented in more detail than the category is used to. The commercial promise attached to it is narrower than the announcement reads.

• 22 / 21preconfigured mainnets and testnets in the CLI
• 5 minbefore an unanswered approval auto-declines
• 3sign-in methods, each giving a different address
• 0native gas tokens the agent needs to hold

Setting it up is a conversation, not a form

The install runs through the agent itself. You paste a sentence asking it to set the wallet up, it runs mm init, and you answer three questions: how you sign in, where the keys live, and which trading mode applies. mm doctor then checks the CLI version, the skill version, authentication and initialisation before the wallet will do anything.

The first of those three questions carries a trap MetaMask flags in its own quickstart. Google sign-in, email sign-in and a MetaMask Mobile QR scan are three separate methods, and each one loads a different wallet address even when the same email address sits behind all three. Fund the wrong one and the money is not lost, but it is not where the agent is looking either.

What the agent can reach

Once it is running, the agent executes across the preconfigured EVM networks plus Hyperliquid for perpetuals, Polymarket for prediction markets and Aave V3 for lending, with guides for yield vaults and for paying x402-gated APIs. Two mechanics are worth naming because they change what an agent can do unattended.

Gas is handled by an EIP-7702 relay. Where the wallet’s native balance cannot cover the fee, the CLI routes an ERC-20 transfer or swap through the relay, which submits the transaction and deducts the fee from the token being moved. An agent holding nothing but USDC keeps working, which removes the most common way an unattended bot stalls at three in the morning.

The second is batching. On eligible chains and accounts the CLI folds the ERC-20 approval and the trade into a single atomic ERC-7821 execute() call. That halves the transaction count and closes the window in which an approval sits on chain waiting to be front-run.

The path every transaction takes

Before a transaction lands

1. Your agentPROPOSES A TRADE
2. SimulateWHAT WILL IT DO?
3. Threat scanBLOCKAID
4. MEV protectSMART TRANSACTIONS
5. It landsON CHAIN

MALICIOUS, OR OUTSIDE YOUR POLICY

Held for your approval insteadMOBILE PUSH OR EMAIL LINK · 5 MINUTES · THEN AUTO-DECLINE

The agent cannot proceed without you, and it cannot opt out of the scan.

Guard Mode and Beast Mode

The modes apply to the server wallet and are chosen at install. The difference is not cosmetic.

Guard Mode is the default and MetaMask recommends it. Beast Mode keeps the scanner and discards everything else, which leaves one question standing between an agent and your balance: does Blockaid think this particular transaction is malicious. A well-formed transaction sending everything you own to an address you have never seen is not malicious by that test. Switching into Beast Mode prompts for a confirmation, and the mode can be changed later with mm wallet trading-mode set, so the choice at install is not permanent in either direction.

Where the keys actually sit

The default wallet mode, and the one the documentation recommends for most users, is the server wallet. Keys are “managed and secured server-side in a trusted execution environment (TEE), so agents can’t access your main wallet”. MetaMask’s position is that this remains self-custody, because you hold the secret recovery phrase and can export it and walk away whenever you like.

The alternative is to bring your own BIP-39 mnemonic, passed through the MM_MNEMONIC environment variable rather than a command-line flag, and optionally encrypted at rest. That keeps the keys on your machine and costs you the policy engine: outflow limits and trading modes apply to the server wallet only. Bringing your own key also changes the timing, because server-wallet operations are asynchronous and return a pollingId unless you ask the CLI to wait, while a local key returns results immediately.

What the outflow limit counts, and what it misses

Guard Mode’s backstop is a rolling 24-hour cap on the value leaving the wallet. MetaMask simulates each transaction, estimates the dollar value moving out, and adds it to the running total once the transaction confirms. Swap 10 dollars of USDC into ETH and later swap that ETH into DAI and the counter reads 20, not 10, because it measures outflow rather than net position.

The 24-hour outflow counter

Counted towards your limit

• Token transfers out
• Swaps
• Deposits to protocols and venues

VALUED IN USD BY THE SIMULATION ENGINE, ADDED ONCE THE TRANSACTION CONFIRMS.

Not counted

• Signatures, including Permit2
• Anything not sent via the backend

TRACKING IS IMPRECISE WHERE A TRANSACTION CANNOT BE SIMULATED. FALL BACK ON YOUR ALLOWLISTS.

Guard Mode and the server wallet only. Beast Mode has no outflow limit at all.

The scanner covers most of the map, not all of it

Every supported EVM transaction passes three steps before it lands: simulation, threat scanning by Blockaid, and MEV protection through Smart Transactions. MetaMask’s phrasing here is careful and worth reading closely, because the product page footnote limits scanning to “Blockaid-supported chains including Ethereum, Linea, Arbitrum, Avalanche, Optimism, Base, Polygon, BSC, Sei”, the same nine named in June.

The developer documentation is both more generous and more specific. Its chain table marks Transaction Shield available on 13 of the 22 preconfigured mainnets, adding Monad, HyperEVM, MegaETH and Robinhood Chain to the June nine, and marks the other nine unavailable: Unichain, opBNB, ZKsync Era, Mantle, Celo, Hemi, Blast, Scroll and Palm. Solana is named as a supported network in the product FAQ and does not appear in the chain table at all. For chains outside the preconfigured list, the CLI falls back to reading balances over direct RPC through Multicall3, which is a balance lookup rather than a security pipeline.

Testnets are thinner still. Three of the 21 carry Transaction Shield, so an agent proven safe on a testnet has mostly proven that its logic works, not that the protection around it does.

What the $10,000 actually covers

This is where the announcement and the terms part company.

Transaction Protection is not a feature bundled with Agent Wallet. It is the payload of Transaction Shield, a subscription the developer documentation describes as pairing “Transaction Protection with priority support”, and which MetaMask’s British page prices at £9.99 a month or £99 a year after a 14-day trial. The Consensys supplemental terms define the cover as “100 covered transactions per month with an aggregate value of up to $10,000 USD per month”, and exclude “losses whose proximate cause occurred outside an active MetaMask Transaction Shield subscription”.

Those terms open with a sentence the marketing does not carry: “Metamask Transaction Shield is not insurance and does not provide reimbursements for many types of losses that insurance is meant to cover.”

The exclusions decide what the number is worth to somebody running a trading agent. MetaMask’s own page spells out the biggest one as “transactions that worked as expected, but led to financial loss. For example: trading tokens that dropped in value, low liquidity, or honeypot interactions.” An autonomous agent trading perpetuals around the clock is, almost by definition, generating exactly that class of loss. The cover is for a transaction the security stack cleared and should not have. It is not for a trade that went against you.

Claims run to a schedule as well as a cap. A loss has to be filed within 21 days through the Transaction Shield portal in the extension, most claims are processed within 15 business days, and an approved payout arrives as mUSD at the market rate to an address you nominate, with KYC documentation requested where the law requires it.

The line a British reader should find first

On MetaMask’s own en-GB page, in answer to “Who is eligible to subscribe to Transaction Shield?”, the answer is: “Transaction Shield is available globally with the exception of the following territories: the UK, US sanctioned countries.” The same answer is given twice, once more under “Where is Transaction Shield available?”

The same page quotes the subscription in pounds, gives the cap as “£10,000/month” in one FAQ answer while the body of the page says $10,000, and states that a transaction “must take place on MetaMask Extension in order to be eligible for coverage”, with mobile support still to come. Agent Wallet transactions originate from a CLI. Nothing published today reconciles those two statements, and for anyone reading from Britain none of it changes the position, because the subscription is not sold here. Our guide to UK crypto regulation covers why consumer crypto products keep arriving in this country last, and sometimes not at all.

The gaps the documentation admits

To its credit, MetaMask writes down where its own controls thin out rather than leaving them to be discovered. Outflow tracking “can be imprecise if transactions are not submitted through our backend”, and signatures such as Permit2 “are not included in the outflow calculation as of now”. A Permit2 signature is how a great many approvals are granted, so an agent can hand out spending permission without moving the 24-hour counter that Guard Mode uses as its backstop. The documentation’s own advice in that case is to fall back on your allowlists.

The June release named prompt injection as one of the new attack surfaces agents introduce. The pipeline that answers it inspects transactions, not instructions. An injected prompt that produces a well-formed swap to an allowlisted protocol, inside the outflow limit, is a transaction the scanner has no reason to bounce. The allowlist is the control that catches it, which is another way of saying Guard Mode is the product and Beast Mode is a decision to switch it off.

The rules are the guarantee

Set against the other agent wallets shipping this year, mandatory simulation, scanning and MEV protection on the execution path is a higher floor than the category has had, and publishing the guardrail tables, the chain-by-chain coverage and the outflow limitations beats a security marketing page by a distance. The $10,000 on the poster is doing a different job. It covers a hundred transactions a month, it is bought separately, Consensys says it is not insurance, it excludes losing money on a trade, and it cannot be bought in Britain at all. Set the allowlists and the outflow cap as though nothing sits behind them, because for a UK reader nothing does.