Paolo Ardoino wants AI agents to hold Tether, but developers are left on the hook for overspending

Tether CEO Paolo Ardoino’s vision of financial autonomy for people and machines puts a practical decision in developers’ hands: how much spending authority should an AI agent receive when a wallet’s owner unlocks it?

Tether’s Sept. 3 explanation of WDK CLI, the local command-line wallet built with its Wallet Development Kit, gives a concrete answer for that product. The human opens a timed session. On macOS and Linux, another process running as the wallet owner can request transactions if it can reach the unlocked wallet’s local endpoint. The CLI daemon does not require fresh approval of each payment.

That distinction matters for anyone building an assistant that can move money. Keeping wallet keys under the owner’s control establishes custody. Deciding which recipient, amount and operation an automated system may authorize is a separate design choice.

Ardoino set out the broader ambition when Tether announced WDK on Nov. 11, 2024. His statement described programmable monetary systems connecting people, machines and AI agents while preserving financial control. The September explanation shows how that longstanding strategy translates into one local wallet interface.

It also shows why the answer cannot be reduced to whether WDK “has safeguards.” Its CLI, software development kit and customizable MCP Toolkit offer different controls at different points in the transaction process. A developer’s choice of integration determines which protections apply.

Unlocking grants a session

The CLI documentation describes three components: terminal commands, a background process called a daemon that holds the unlocked wallet, and a bundled Model Context Protocol server. MCP lets an AI client call structured software tools. Both interfaces use the same local wallet.

Under the documented security model, a locked seed is encrypted with AES-256-GCM using a key derived through scrypt. Unlocking changes the access model. On macOS and Linux, the daemon’s socket is restricted to its operating-system owner, but it has no separate credential for each program.

A process running as that owner, if it can reach the socket, can ask the unlocked wallet to sign without knowing or re-entering the passphrase. The account boundary therefore matters alongside the wallet password.

The default session lasts five minutes from unlock. Ordinary activity does not extend it. The user can lock the wallet sooner, explicitly unlock it again to reset the timer, or disable automatic expiry with a zero lifetime.

These are useful session controls. They determine when access begins and ends. A short timer, however, does not by itself establish an amount limit or require a fresh decision about each recipient.

Tether describes the same-user access as an accepted hot-wallet trade-off. Its precautions include a dedicated wallet with limited funds, short sessions and separation under a dedicated operating-system account. These are disclosed operating constraints, not a reported theft or exploit.

The bundled MCP interface keeps wallet creation, seed export, unlocking and other administration outside its tool menu. That reduces what an agent can request through that server. It does not confine an AI client that also has independent shell access.

For transfers, the MCP guide says send_token defaults to a dry run. The recommended sequence is to preview a payment, show its network, token, recipient, amount and estimated fee, obtain confirmation, then execute.

The daemon does not require proof that those earlier steps happened. An otherwise valid execution request can broadcast from an unlocked wallet. A second route, call_method, can invoke declared chain-specific write operations without a dry run or enforced confirmation.

That makes the location of the check consequential. A client can present a careful approval screen while the underlying wallet remains willing to accept requests through another permitted path. For that screen to define spending authority, the product must control the other paths too.

The documentation’s tool counts need a qualification. The September blog mixes references to eleven tools with a nine-tool table, while the current MCP guide lists eleven. The additional entries are list_methods and call_method. Their significance is the ability to discover and invoke declared methods, rather than the size of the menu.

There is also a version mismatch. The CLI guide describes 1.0.0-beta.3, while Tether’s Aug. 27 changelog records beta.4. That entry describes a configuration-override fix and says public commands, configuration keys and stored-data behavior are otherwise unchanged. The guide’s beta.3 label therefore should not be read as the latest release number.

WDK offers more than the CLI’s controls

Developers building an application can use WDK’s SDK directly. Its local transaction policies provide configurable ALLOW and DENY rules before governed wallet or protocol operations execute. Examples cover approved recipients and amount conditions.

Those checks can block a governed call. They are opt-in local controls, with a defined scope, rather than rules enforced on the blockchain. The documentation says they are not a complete sandbox: separately retained raw account references and certain internal module calls remain outside their interception.

The SDK also leaves important inputs to the application. It does not automatically maintain recipient lists, fetch prices, decode contract-call data or persist spending counters. Developers own durability and concurrency when a limit depends on cumulative activity.

A daily budget illustrates the consequence. Checking the size of one payment cannot establish how much an agent has already spent that day. A product must record prior spending and handle simultaneous requests consistently if it promises a cumulative ceiling. The implication is that a cumulative budget needs application-level accounting as well as a check on each payment.

The separate MCP Toolkit, documented as beta.1, provides another approach. Tether says its built-in write tools use MCP elicitations to obtain explicit user approval before broadcasting. Its configuration options let developers expose read-only tools, choose individual operations or add their own.

These approval flows deserve to be distinguished from the bundled CLI server’s recommended preview sequence. Customization also means the developer must decide what any added operation is allowed to do.

Tether’s own division of uses places the CLI in local operator workflows, the SDK inside applications and the Toolkit in custom agent servers. That gives builders options as they move from experimentation to a product handling user funds.

The choice involves a practical trade-off. Requiring a person to approve every payment gives that person a transaction-level decision. Allowing an agent to operate within a preset budget permits more automation, but requires a reliable rule for what counts against the budget and which operations it covers.

For a user, the meaningful promise is therefore specific: what can this assistant spend, where can it send funds, and what ends its authority? A wallet password or an approval prompt answers only part of that question unless the surrounding software makes the intended restriction effective.

Ardoino’s self-custody strategy gives developers the means to build without handing wallet ownership to a custodian. The next responsibility sits with the product: make the authority delegated to the agent match the limits the owner believes they have set.