What's the difference between an onchain agent and a regular AI agent?

A regular AI agent reasons and calls APIs; its actions stop at software. An onchain agent also controls a crypto wallet, so it can sign transactions and move value on a public blockchain itself — holding a balance, getting paid, or paying other agents without a human approving each step.

Do onchain agents actually control real money?

Yes — that's the defining feature. An onchain agent signs its own transactions from a wallet it controls. Responsible setups scope that control tightly with spend limits, permission scopes, and human-approval steps for high-stakes actions, but the agent is genuinely transacting, not simulating.

How can I tell a real onchain agent from a claimed one?

Look for evidence, not adjectives. Is the code open? Is it active? Can the behavior be reproduced or checked on-chain? Standards like ERC-8004 make identity and reputation verifiable on Ethereum, and the Sato Score grades transparency and liveness. A "verified" label with no receipts is just marketing.

What do I need to build an onchain agent?

Five things: a reasoning model, a policy-controlled wallet, tools and skills (protocol SDKs or MCP servers), data feeds, and guardrails. Most builders start from a framework that bundles several of these — browse the directory.

Are onchain agents safe?

Autonomy with a wallet raises the stakes: bugs, bad reasoning, key compromise, and prompt injection can all cause real loss, and autonomous execution amplifies mistakes. Guardrails — spend limits, scoped permissions, approvals, sandboxes — reduce that risk but don't remove it. Treat any safety or performance claim as unproven until the evidence is there.

← Back to wiki

What Are Onchain Agents?

Last updated 2026-06-24

Onchain agents are autonomous AI agents that can interact with blockchain systems, holding wallets, signing transactions, reading chain data, and executing workflows across protocols without constant human input.

Key takeaways

▸An onchain agent is an AI agent that holds a wallet and acts on a blockchain itself — not a chatbot that describes crypto.
▸The stack: a reasoning model + a policy-controlled wallet + tools/skills (often over [MCP](/wiki/what-are-mcps)) + data feeds + guardrails.
▸Blockchains are the first payment rails built for software, so an agent can earn, spend, and transact permissionlessly.
▸Labels like "verified" are claims until the evidence backs them — check the receipts, not the marketing. That gap is what the [Sato Score](/sato-score) measures.

An onchain agent is an autonomous AI agent with its own crypto wallet. It reads blockchain data, decides what to do, and signs its own transactions — paying for services, trading, or coordinating with other agents without a human approving each step. The "AI agent" part is the brain; the "onchain" part is what gives it economic independence.

That line matters. A chatbot that *talks about* crypto is not an onchain agent. An agent that *holds keys and moves value on a public chain* is. This page covers what they are, the stack that makes them work, what they already do, and where the real risks hide — with receipts.

Why It Matters

Blockchains are the first financial rails designed for software-native participants. An agent with a wallet can pay for services, earn revenue, trade, and coordinate with other agents permissionlessly. That makes onchain agents the foundation of an emerging machine economy where useful agents become digital workers and, eventually, ownable assets.

How It Works

▸An AI model (the reasoning layer) is connected to tools that expose blockchain capabilities, wallet signing, RPC reads, protocol SDKs, or MCP servers.
▸A wallet or key-management system (like embedded wallets or policy-controlled signers) gives the agent the ability to transact, usually with spend limits and permission scopes.
▸The agent runs in a loop: observe (read chain/social/market data), reason (decide what to do), act (sign transactions or call APIs), and report.
▸Guardrails (permission scopes, human approval steps, spend limits, sandboxes) keep autonomous execution within acceptable risk.

Key Components

•Reasoning model (LLM or specialized model)
•Agent framework or runtime
•Wallet / key management with policies
•Skills and tools (SDKs, MCP servers, APIs)
•Data feeds (onchain data, market data, social data)
•Permissions and guardrails
•Memory and state

Onchain agent vs. AI agent vs. bot

The terms get blurred constantly, so be precise. A plain AI agent plans and uses tools, but its "actions" are API calls — it can draft an email or query a database. A bot runs fixed scripts with no reasoning. An onchain agent adds one capability that changes the economics: it controls a wallet and can sign transactions on a public blockchain.

That means an onchain agent can do things no API key allows — hold a balance, get paid, pay another agent, or move funds across protocols on its own. The reasoning might be identical to any AI agent; the difference is custody and settlement. For a deeper split, see onchain vs. offchain agents.

The onchain agent stack

Strip away the branding and every onchain agent is the same five layers:

▸Reasoning model — the LLM (or specialized model) that decides what to do.
▸Wallet + key management — the part that can actually sign. Production agents rarely hold a raw private key; they use embedded wallets or policy-controlled signers with spend limits and scoped permissions, often built on account abstraction (ERC-4337). More in how agents use wallets.
▸Tools and skills — the blockchain capabilities the model can call: protocol SDKs, RPC reads, and increasingly Model Context Protocol servers that expose chain actions in a standard way.
▸Data feeds — onchain state, market data, and social signals the agent observes before acting.
▸Guardrails — spend limits, permission scopes, human-approval steps, and sandboxes that keep autonomy inside an acceptable risk envelope.

The loop tying them together is simple: observe, reason, act (sign), report — then repeat.

What onchain agents actually do today

Skip the demos; here's where real value moves:

▸Payments. Agents can now pay per request from their own wallet. 0x opened its Swap API to agents at $0.01 per call over the x402 standard — no API key, just a wallet (The Defiant). See the payments use case.
▸Trading. Agents monitor markets and execute swaps inside preset risk limits — the trading use case maps the tooling.
▸Treasury. Agents rebalance stablecoin holdings across venues on a schedule.
▸Governance. Agents summarize proposals and surface voting context for DAOs.

The through-line: narrow, bounded jobs with clear guardrails — not "give the bot your keys and walk away."

Identity, trust, and the verification problem

Once agents transact with each other, one question dominates: which agents can you trust? The honest answer is that most "verified" and "high-performing" labels are self-reported. Self-reported is not the same as shown.

Two things are addressing it. On-chain, ERC-8004 ("Trustless Agents") gives agents a portable identity, reputation, and validation registry on Ethereum (EIP-8004). Off-chain, transparency signals like the Sato Score grade how open, active, and verifiable a product is — explicitly a transparency signal, not a safety or returns grade. Either way, the rule holds: trust the receipts, not the claim.

How to start building

You don't need to assemble the stack from scratch. A practical path:

Pick a framework that bundles wallet + tools — browse the options in the directory.
Give it a wallet with limits — scoped permissions and spend caps before any mainnet funds.
Add skills — connect protocol SDKs or MCP servers for the actions your agent needs.
Set guardrails — human-approval steps for anything irreversible, and sandbox first.
Test on a testnet, then start small on mainnet.

Match the tools to the job using the use-case pages, which map the directory to what agents actually do.

Examples

▸A trading agent that monitors markets and executes swaps within preset risk limits.
▸A DAO agent that summarizes governance proposals and posts voting recommendations.
▸A treasury agent that rebalances stablecoin holdings across yield venues.
▸A token-deployment agent that launches contracts when triggered by social posts.

Risks & Limitations

⚠Financial loss from bugs, bad reasoning, or market moves, autonomous execution amplifies mistakes.
⚠Key compromise: an agent's wallet is only as safe as its key management and permission scoping.
⚠Prompt injection and adversarial manipulation can trick agents into harmful actions.
⚠Self-reported performance is not verified performance. Always check the evidence.

Frequently Asked Questions

What's the difference between an onchain agent and a regular AI agent?: A regular AI agent reasons and calls APIs; its actions stop at software. An onchain agent also controls a crypto wallet, so it can sign transactions and move value on a public blockchain itself — holding a balance, getting paid, or paying other agents without a human approving each step.
Do onchain agents actually control real money?: Yes — that's the defining feature. An onchain agent signs its own transactions from a wallet it controls. Responsible setups scope that control tightly with spend limits, permission scopes, and human-approval steps for high-stakes actions, but the agent is genuinely transacting, not simulating.
How can I tell a real onchain agent from a claimed one?: Look for evidence, not adjectives. Is the code open? Is it active? Can the behavior be reproduced or checked on-chain? Standards like ERC-8004 make identity and reputation verifiable on Ethereum, and the Sato Score grades transparency and liveness. A "verified" label with no receipts is just marketing.
What do I need to build an onchain agent?: Five things: a reasoning model, a policy-controlled wallet, tools and skills (protocol SDKs or MCP servers), data feeds, and guardrails. Most builders start from a framework that bundles several of these — browse the directory.
Are onchain agents safe?: Autonomy with a wallet raises the stakes: bugs, bad reasoning, key compromise, and prompt injection can all cause real loss, and autonomous execution amplifies mistakes. Guardrails — spend limits, scoped permissions, approvals, sandboxes — reduce that risk but don't remove it. Treat any safety or performance claim as unproven until the evidence is there.