AI agents have moved past just talking. They book, they buy, they hire, they hand microtasks to other agents — and increasingly they need to move real money without a human clicking every button. That raises a simple question almost nobody had answered: where does an agent keep its own money, and who actually controls it? One honest note up front: this is educational content, not investment advice.

See it in production: DePix App for AI agents — the non-custodial Liquid wallet + Pix gateway this post is about.

Why an AI agent needs a wallet of its own

Picture an assistant that books a trip, pays a supplier, or splits microtasks across other agents. Each of those needs a balance. The most common answer today is to hand the agent a “card” or a spend-token tied to your account — the agent spends your money, from your balance, at your risk. The money is never the agent’s; it’s a temporary permission to touch someone else’s balance. That’s fine for small experiments, but it breaks the moment the agent needs to receive, hold, and reuse value on its own.

An AI agent wallet flips that logic. Instead of lending it your balance, the agent gets an account of its own — its own funds, under its own control. It receives, holds, converts, and pays without waiting for you to open an app at every step. It’s the difference between lending your card and opening an account in the agent’s name, with the key in its hands.

What an AI agent wallet actually is

An AI agent wallet is software that runs inside the agent and holds the cryptographic keys that control its money. In practice it does three things: it generates a seed (the recovery phrase that is the wallet’s master key), it signs transactions locally, and it talks to a network to receive and send value.

The detail that changes everything is where that seed lives. In the DePix App, the seed is generated and encrypted inside the agent’s own environment and never leaves it. The agent signs every transaction in its own process (client-side); the backend only quotes prices and settles — it never signs and never holds the money. This is the first AI agent wallet on the Liquid Network, a Bitcoin sidechain, and the first with a native Pix gateway built in. In it the agent holds three assets: DePix (a stablecoin pegged to the Brazilian real, where 1 DePix = 1 real), L-BTC (Bitcoin on Liquid), and USDt.

A quick naming note: DePix App is the product (the app, the MCP server, the platform); DePix is the stablecoin — the asset the wallet receives and holds. They are not the same thing. And if a non-custodial wallet sounds novel, it isn’t: it’s the same design as the DePix App integrated wallet , only now run by an agent instead of a person.

Custodial or non-custodial: the difference that changes everything

This is the most important idea — and the easiest to mix up. There are two ways to give an agent money.

In the custodial model, the agent gets a spend-token drawn from a balance that belongs to someone else (the company, the platform, or you). If the provider freezes the account, trips a limit, or simply goes down, the agent loses access. The agent never had the money; it had permission to use it.

In the non-custodial model, the agent holds its own money — the key, the signature, and the balance are its own. But “the agent holds it” does not mean “you lose control.” You stay in control through the guardrails you set: a per-transaction limit, a daily limit, and an optional allowlist of exactly who it may pay — and you decide how much to fund it with in the first place, so your exposure is only ever that balance. The agent moves money on its own, but only inside those rails; it cannot spend past a cap you defined or pay someone off the allowlist. Non-custodial doesn’t take control away from you — it takes away a third party who could otherwise freeze the funds or gate every send. In exchange, guarding the key is the owner’s responsibility, and there is no “forgot password” here. It’s the same principle behind being your own bank : the limits are yours to set, and so is the key.

One MCP, two levels: hosted to receive, local for the whole wallet

There is one product here: the DePix App MCP server (@depixapp/mcp), built on the Model Context Protocol, the open standard that connects assistants like Claude, Cursor, and ChatGPT to external tools.¹ What you pick is the level you connect at.

Level 1 is the hosted server, at mcp.depixapp.com: OAuth, zero install, 22 tools. Through it the agent creates checkouts, registers products, reads payment status, and opens support tickets — the receiving side, with no critical key to paste. It cannot spend, and that’s physics rather than a product choice: signing happens inside the process that holds the seed, so a server we host could only move your money by holding your seed. It holds none. This is the same rail the DePix App already offers to accept Pix and get paid in crypto on any website.

Level 2 is the same MCP running locally, with npx -y @depixapp/mcp: the same 22 tools plus 27 wallet_* tools — 49 in all. That’s the whole wallet in the agent’s hands, running where the agent lives, with the seed never leaving that machine.

The first run is a human ceremony in a terminal, never a tool the agent calls: npx -y @depixapp/mcp init creates or restores the wallet, shows the 12 words once inside that terminal, and prints the ready-to-paste mcpServers block for your client. The recovery phrase must never pass through a model’s context — that’s exactly why it’s a command you type instead of something the agent can ask for. After that, DEPIX_API_KEY handles the gateway calls and DEPIX_WALLET_PASSPHRASE unlocks the wallet (DEPIX_WALLET_DIR is optional).

What the agent does with the wallet

With the wallet live, the whole script fits in a few steps — and this is where native Pix matters, because the agent funds itself with real Brazilian money:

  • Receive Pix: it mints a QR or link, the payer pays, the agent knows instantly.
  • Pay Pix: payout to any Pix key — the wallet signs, the backend settles.
  • Hold three assets: DePix, L-BTC, and USDt in the same confidential wallet.
  • Convert: swap between DePix, L-BTC, and USDt, always under the agent’s key.
  • Guardrails: per-transaction and daily limits the owner sets, enforced on the agent’s side.
  • Self-onboarding: the agent registers, tests in a sandbox, and graduates to a production key on its own — a product capability, with no human in the loop.

From the first Pix received to the final payout, everything happens under the agent’s key.

Each asset has a job (and the honest trade-offs)

No tool solves everything, and pretending otherwise would be dishonest. Each asset in the wallet has a clear job:

  • DePix is for spending and transacting day to day with privacy. It is not a store of value: because it tracks the real, it loses purchasing power to inflation. And like any stablecoin, the 1 DePix = 1 real parity depends on the issuer and its backing — it is not an automatic guarantee.
  • To store value for the long term, the asset is Bitcoin, historically one of the best stores of value of the past two decades. L-BTC (Bitcoin on Liquid) inherits that sovereignty and adds privacy through Confidential Transactions.² The trade-off has to be said out loud: Liquid is run by a federation, which makes it more centralized than Bitcoin’s main chain. And Bitcoin itself is volatile, which makes it impractical for buying coffee.

The rule of thumb: use Bitcoin to save, use DePix to spend with privacy — and let your agent do the same, aware of what each asset can and can’t do.

Proof, not a promise

Calling something “first” only counts if there’s something under it. The same infrastructure behind this AI agent wallet has already processed around R$500k in Pix, serves 1,200+ users, and has generated 3,769 checkouts — non-custodial, on Liquid mainnet, since March 2026. The MCP server is Apache-2.0 and published on npm³ and in the official MCP Registry as io.github.depixapp/depix-mcp — one entry carrying both the hosted remote (22 tools) and the npm package with the wallet level (49). The request-signing spec (with Ed25519 test vectors) is public, and the engine lineage stays available as the code-level @depixapp/sdk for anyone who prefers building against the library. In other words: don’t take our word for it — install it, inspect it, and attack it yourself.

If you want to connect the dots, it’s worth understanding where the sovereignty in this design comes from in our piece on the sovereign individual and permissionless money — the same idea of controlling your own money, now extended to a software agent.

References

  1. Model Context Protocol — official documentation
  2. Blockstream — Liquid Network technical overview
  3. DePix App — MCP server on npm (@depixapp/mcp)

Give your agent an account

Pix has convenience; DePix has privacy and self-custody — now for your agent too. Instead of lending it your balance, give your agent a wallet only it controls: its own key, its own money, live on Liquid mainnet. Start at depixapp.com/ai .