DCP is one app that controls how AI agents use wallets, credentials, identity, and private data. Agents get access inside rules you set. You stay in control.

Is DCP only a wallet?

No. DCP can work as a wallet control surface for agents, but it also controls credentials, identity, private data, remote-agent access, limits, approvals, and logs.

Do agents ask me for everything?

No. You set rules once. Actions inside those rules run automatically. Only exceptions ask for approval.

Where are my keys stored?

On your machine. DCP is local-first. Wallet keys stay in your local vault, not inside the agent and not on our servers.

Can I use DCP with multiple agents?

Yes. Each agent gets its own rules, limits, approvals, and logs, all from one dashboard.

Can DCP work with remote agents?

Yes. Your agent can run on a VPS or cloud machine while your vault stays local. Approvals come through Desktop, Telegram, or the DCP mobile app.

What happens if an agent is compromised?

The agent can only act inside the access you gave it. You can revoke access anytime, and every action is logged.

The core is free and open source (Apache-2.0). Desktop app, agent runtime, CLI, and source code are all free.

Which blockchains does DCP support?

DCP supports Solana. You can generate a Solana wallet or import one. Keys are encrypted locally with XChaCha20. DCP is non-custodial . You control everything.

How do AI agent spending limits work?

DCP lets you set daily caps and per-action limits for each agent. If an agent tries to spend more than the limit, the action is blocked or sent to you for approval. You can adjust limits anytime.

Is DCP better than .env files for AI agents?

Yes. With .env files, agents read your keys directly. One prompt injection leaks everything. DCP keeps credentials local and runs access inside rules. Agents get results, not raw keys.

Can I store credentials like OpenAI and Anthropic keys in DCP?

Yes. Store any credential: OpenAI, Anthropic, Stripe, AWS, custom keys. Your AI agents request access, rules decide, and the agent gets results, never the raw key.

Does DCP work with Claude, Cursor, and OpenClaw?

Yes. Claude Desktop, Cursor, VS Code, and other stdio MCP clients can run the DCP agent locally. OpenClaw and VPS agents use the remote installer and HTTP MCP. Custom runtimes can integrate through MCP or HTTP MCP.

How do I secure my OpenClaw agent with DCP?

Use the remote invite command from DCP Desktop. It installs the DCP agent service on your VPS, pairs it with your Desktop vault, and configures OpenClaw MCP when the install shape can be detected.

Is MCP server security a problem in 2026?

Yes. MCP servers have known vulnerabilities. Over 42,000 exposed endpoints leaked credentials in early 2026, including CVE-2025-6514 (remote code execution). DCP adds a control layer: even if your MCP server is compromised, agents can't use raw keys outside your rules.

How is DCP different from Infisical or VaultAgent?

DCP is local-first (keys never leave your device) and controls how agents use them. Infisical and VaultAgent are cloud-based secret stores. DCP also handles crypto wallets, which they don't. And DCP is free & open source.

How is DCP different from Turnkey or Cobo agentic wallet?

DCP is free and handles both crypto AND credentials. Turnkey and Cobo are enterprise-only, crypto-only, and Cobo holds a key share (MPC). DCP is fully non-custodial and local-first . You control everything.

What if my laptop is off?

Requests queue until you're back online. For 24/7 bots, just leave your laptop sleeping. No need to be unlocked.

Yes. The entire stack is open source under Apache-2.0. Self-host the relay if you want full control over your infrastructure.

Export your data, uninstall. Your wallets, keys, everything stays yours. No lock-in, no data hostage.

Can an AI agent pay for APIs without my private key?

Yes. The agent requests an x402 / USDC payment, DCP checks your daily cap, auto-approves small ones and asks your phone for the rest, then signs locally. The agent gets a paid result, and never sees the private key.

How is DCP different from Coinbase Agentic Wallet, Cobo, or Turnkey?

Those give the agent its own wallet or account. DCP is non-custodial: it keeps your existing wallet's key encrypted on your machine and lets the agent request to use it inside your rules. The agent receives a signed result, never the raw key.

Is DCP an MCP permission server?

Yes. Give your agent a DCP tool over MCP instead of raw secrets. It runs sensitive actions (sign, pay, use a scoped credential, read approved data) with task-scoped access, approval for exceptions, and logs. Works with the OpenAI Agents SDK, LangGraph, CrewAI, Claude, Cursor, and OpenClaw.

CLI Reference

The dcp CLI is shipped by @dcprotocol/vault.

Install

npm install -g @dcprotocol/vault

DCP packages require Node.js 22.

Core Commands

Command	Use
`dcp init`	Create a local vault.
`dcp create-wallet --chain solana`	Create a Solana wallet.
`dcp add identity.email`	Add a data record.
`dcp read identity.email`	Read a data record.
`dcp list`	List stored records.
`dcp status`	Show vault status.
`dcp update identity.email`	Update an existing record.
`dcp remove identity.email`	Remove a vault record.
`dcp approve --list`	List pending consent requests.
`dcp agents`	List paired agents.
`dcp revoke <agent_or_session>`	Revoke agent access.
`dcp config show`	Show budget and rate-limit config.
`dcp activity`	Show audit activity.
`dcp recovery restore`	Restore a vault from the recovery phrase.

Common Setup

dcp init
dcp create-wallet --chain solana
dcp add identity.name
dcp add identity.email
dcp list

Sending funds, swapping, and signing are done by agents through MCP tools (vault_transfer, vault_swap, vault_sign_tx), gated by your approval, not by a dcp subcommand. The CLI manages the vault; agents move value.

Connecting agents

Command	Use
`dcp pairing`	Create/manage pairing tokens for a local proxy setup.
`dcp cloud-connect`	Connect a cloud agent (OpenClaw / Hermes / Claude.ai) via a one-time link.
`dcp trust <service>`	Add a trusted service to the vault.
`dcp connect <service>`	Connect to a trusted service.

Recovery

dcp recovery show-phrase   # how the recovery phrase works
dcp recovery restore       # restore a vault from the recovery phrase

Remote / VPS agents

Prefer Desktop's generated invite command (run on the server):

curl -fsSL https://dcpagent.com/install.sh | sudo bash -s -- 'dcp_vps_v1_...'

The agent CLI (dcp-agent, from @dcprotocol/agent) also exposes install-service, configure-openclaw, run, status, and list. See Remote Agents.