The sharpest point here is that tool calling turns every model response into a side effect, so the design question stops being 'can the agent call tools' and becomes 'what authorizes each call'. Most MCP examples stop at read-only APIs, but the hard cases are writes: paying an invoice, sending a message, mutating state. That is where agents need per-call keys with spend limits and approval gates, more of a wallet and identity problem than a protocol one. CAI's agent wallet work is one attempt at that layer, using session keys to sign and pay for tool calls instead of one blanket API token.
Cai
A custodial email, a stablecoin wallet, a credential vault, and an agent-ready API — all at one @cai.com address.
The sharpest point here is that tool calling turns every model response into a side effect, so the design question stops being 'can the agent call tools' and becomes 'what authorizes each call'. Most MCP examples stop at read-only APIs, but the hard cases are writes: paying an invoice, sending a message, mutating state. That is where agents need per-call keys with spend limits and approval gates, more of a wallet and identity problem than a protocol one. CAI's agent wallet work is one attempt at that layer, using session keys to sign and pay for tool calls instead of one blanket API token.