Why we only ever ask for a public address

What we actually read

We read on-chain Transfer events where a tracked wallet is the sender. That's it. It's the same data anyone can pull from a public block explorer — we just attribute it to the agent you named and put a budget alert on top.

We've thought about wallet-connect flows more than once, because they'd make onboarding one click shorter. We keep deciding against it: it's a bigger attack surface for exactly the thing our ICP is most worried about, and it buys us onboarding speed we don't actually need for a paste-an-address product.

What we will never ask for

Seed phrase. Private key. A wallet-connect or signature request of any kind. If a page claiming to be AgentCap asks for any of these, it isn't us — check the address bar against getagentcap.com.

What this means for your fleet

You can hand a public address to this product with the same risk profile as pasting it into a block explorer: none. If you're evaluating spend-tracking tools for agent wallets, "can it work from a public address alone" is a reasonable first filter — ask any vendor that question before you ask about pricing.