> For the complete documentation index, see [llms.txt](https://docs.beamswap.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.beamswap.io/safety-and-permissions.md). # Review before you approve Understand what your AI, wallet and each Beamswap contract can do. ## Agent Vault An [Agent Vault](https://docs.beamswap.io/agent-vaults) lets your AI trade without asking you each time. The safety comes from rules the Base blockchain enforces on every order, not from the AI behaving well. **Agent Vaults are not externally audited.** The vault contracts had internal reviews, unit, fuzz and invariant tests, Base fork tests against the real CoW Protocol settlement and Chainlink feeds, and Slither static analysis with no medium or high findings. That is not a third-party audit and not a guarantee that exploits are impossible. Start with small limits and a small deposit, watch a few trades, then decide. ### What your agent can do * Place sell orders between the tokens you allowed, on CoW Protocol. * Cancel an open order. * Pause trading. ### What your agent can never do Even if its key, the private link or Beamswap's servers were compromised, the vault contract refuses to: * withdraw or transfer funds. Proceeds of every trade go back into the vault. * trade a token you did not allow, or a token without a Chainlink price feed. * go over your per-trade or daily USD limit. * trade at a price worse than your price guard versus Chainlink prices. * keep an order alive longer than your maximum validity. * use up the reserve you set for a token. * attach its own fee or hooks to an order. Only Beamswap's approved order settings are accepted. * resume trading after a pause, change your rules or change your token list. ### Your controls Only you, from your own wallet, can do these. Each is one transaction that takes effect when it confirms. | Control | What it does | | ------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Withdraw** | Owner-only. Sends any token or ETH from the vault to your wallet, or another address you choose. Nobody else can move funds out. | | **Edit limits** | Change tokens, per-trade and daily USD limits, price guard, order validity, reserves and when the agent's permission ends. Lowering a limit does not cancel orders already placed. | | **Pause agent / Resume agent** | Stops new trades. Your AI can pause too, but only you can resume. Pausing alone does not cancel orders already placed. | | **Emergency stop** | In one transaction: pauses, revokes the agent and cancels every open order. Funds stay in the vault, and only you can withdraw them. | | **Cancel open orders** | Cancels orders that are already resting on CoW Protocol. | | **Revoke a private link** | Stops one AI connection at once. | ### Rules that limit the damage * **Price guard:** an order's expected output must be within your chosen percentage of its input value, using Chainlink prices. Beamswap suggests 0.5%, 1% or 2%. The contract accepts up to 20%. * **Per-trade and daily caps:** in USD. The daily window resets at 00:00 UTC, so an agent could use one day's budget just before midnight and another just after. Size your daily cap with that in mind. * **Reserve:** an amount of a token the agent may not trade away. * **Open orders:** at most 20 at a time. * **Stale prices and downtime:** if a Chainlink price is older than its allowed age, or the Base sequencer is down or has just restarted, the vault refuses new trades. * **Permission expiry:** your agent's permission ends on the date you choose (7, 30, 90 days or a custom date). Extend it when you want to. The worst case with a misbehaving agent is repeated trades that stay at the edge of your price guard, bounded each day by your guard percentage times your daily cap, until you pause. Every trade appears in your dashboard with the reason your AI gave. ### Limits to know * Vaults trade only tokens Beamswap has listed with a Chainlink USD feed: USDC, WETH and cbBTC today. GLINT cannot be traded from a vault. * The price guard is checked when an order is placed. A long validity mostly risks an order that never fills once the market moves away, so keep it short. * The vault contract is not upgradeable, so nobody can change the rules of your vault. If Beamswap releases a new version, it ships as a new factory and you choose whether to move. * Chainlink prices, the Base sequencer feed and CoW Protocol are trusted to work as designed. * Your private link is a secret. Anyone with it can trade inside your limits until you revoke it. * If you connect your own agent wallet instead of a hosted key, keep that key safe. Its power is limited to trading inside your limits. For addresses and validation scope, see [Base contracts](https://docs.beamswap.io/contracts-base). ## Hosted MCP The AI prepares a request. You review it on a Beamswap approval page, connect your wallet and approve the exact action. Beamswap does not ask for your private key. Keep approval links and result capabilities private. Check the token address, amount, recipient, network and price shown by both the page and your wallet. Decline anything that differs from your request. A signed session and a USDC payment are separate signatures. ## Local MCP The local package can automatically pay Base USDC API charges when a wallet key is configured. Each tool has a list-price ceiling, up to $50 for distribution creation. Use a separate wallet with limited USDC; there is no total spending budget. Configure your AI client's confirmation controls; a prompt alone is not enforcement. Never paste private keys into chat, shared files or source control. Do not expose an auto-paying local server publicly without access controls. ## Wallet transactions Swap routes are unsigned instructions, not executed swaps. Swaps, limit orders and automation runs you make yourself need your signature and show the fee and minimum received first. Staking, funding and claiming require separate wallet transactions. The current staking contract has no yield or rescue function; distribution creators retain substantial control over their own campaigns. ## If a request times out An interrupted signed request can have an unknown payment outcome. Do not retry by signing another payment. Check the request status, receipt and wallet activity first. Keep the request ID for reconciliation. The local package preserves a wallet-level recovery lock across restarts. Follow its [owner recovery guide](https://github.com/BeamSwap/beamswap-mcp/blob/main/docs/payment-recovery.md) before clearing the lock. ## Contract review The Base launch included adversarial tests, invariants, fork tests, static analysis, source verification and ownership/runtime read-back. The Agent Vault contracts had internal reviews, Base fork tests and Slither. Neither set is an external audit or a promise that exploits are impossible. Older Moonbeam audit reports do not cover the new Base contracts. [Contract addresses and validation scope](https://docs.beamswap.io/contracts-base).