Self Labs launched Agent Vault on October 15, 2026. It is a payment and login layer for AI agents. You store your card, addresses and site logins in the vault, and your agent gets placeholder values instead. When the agent fills a checkout or sign-in form, Agent Vault's own browser swaps in the real value at that moment, so the card number and passwords never sit in the agent's prompt, logs or tool output.
That matters for any business that wants an agent to renew a subscription, book travel or reorder supplies. The usual options today are to give the agent a real card number, or to keep a person in every purchase. Agent Vault sits between those.
We read Self Labs' launch announcement and the Agent Vault docs on what it is, MCP setup, agent cards, billing and plans, the security model and attested detokenization on October 18, 2026. Everything about Agent Vault below comes from those pages. We have not run a purchase through it for this post.
The short answer
Agent Vault keeps your real card and passwords away from the agent and puts spending rules in front of every card fill. It works with Meta Muse, Grok Bot, OpenClaw, Claude Code, Hermes, Claude Desktop, Antigravity and Codex, and with any MCP client that supports streamable HTTP and OAuth. It is not a payment processor, it does not solve CAPTCHAs or bank checks for the agent, and its spending limits are still marked beta. Use it for small, repeat purchases with tight caps, and keep a person on anything large or new.
How it works
The docs describe four steps:
- 1You add your card, addresses and logins in the Agent Vault dashboard.
- 2Your agent receives mock tokens, strings such as av_card_1_number_u7x2k that mean nothing anywhere else.
- 3The agent drives a browser that runs inside the Agent Vault proxy and fills forms with those tokens.
- 4At each fill, the proxy checks your rules, swaps the token for the real value and types it into the merchant's page.
The merchant receives your real card, the same as if a person had typed it. A login fills only on the site it is registered for. The card security code is never stored. Depending on the deployment, you type it live when a checkout asks for it, or the checkout fails.
The launch announcement and the docs differ on one point. The announcement says the real card number is revealed only inside a Trusted Execution Environment, a sealed part of a server. The attested detokenization page says that enclave check is off by default and is not enabled on the hosted Agent Vault service. On the standard path, the card number is revealed inside the Agent Vault proxy, which is Agent Vault's own infrastructure. The agent still never sees it, but you are trusting Self Labs' servers with it at that moment. If that difference matters to your finance team, ask Self Labs which path your account uses before you connect a card.
Connecting an agent
There are two ways in. The hosted MCP server is at https://mcp.agentvault.io/mcp. You add it to your agent, sign in through your browser, and then choose on the dashboard's Connected apps page which cards and logins that connection may use. Until you do, every tool that touches your account refuses with a message telling you to choose access. The other way is a local MCP server that your agent launches on your machine with an API key. Either way, the agent gets 29 tools for checkouts and sign-ins.
The access dialog has three switches worth knowing about. One lets the agent create and change its own logins, which you only need if it should sign you up for new accounts. One asks you before every purchase from that connection. One fills a test card instead of your real card, for practice runs.
Revoking matters as much as connecting. The docs say only Revoke on the Connected apps page stops a connection, or its revoke-if-unused date. Signing out of your MCP client does not.
The controls you set
Spending rules live on an agent card, which is a set of rules attached to one of your real cards. It has no card number of its own. The defaults are:
- Per-transaction cap: $75
- Daily limit: $100 (Plus and Enterprise only)
- Weekly limit: $200 over the last 7 days
- Monthly limit: $500 over the last 30 days
The windows roll, so a weekly limit frees up as old spend passes 7 days. Spend counts the moment the card number is typed, before any order exists, so a few abandoned checkouts can use up a limit with nothing bought.
Merchant rules have three modes: allow all, a blocklist of sites, or an allowlist of named sites. The allowlist is on Enterprise only. You can also require approval for any purchase at or above an amount you pick. Once that is set, you are asked when the total cannot be read, too, and you have about 5 minutes to answer. Auto-pause stops the agent card when a purchase would break a limit, and it is on by default.
Two warnings from the docs. First, your first card gets a default agent card with the limits above, but every card you add after that starts with no limits at all until you add them. Second, the spending limits are in beta. Agent Vault declines a total it cannot read, but a total read wrongly could slip past, so the docs tell you to watch the Activity page.
Plans
Per the billing page, Free costs $0 and allows 5 payments a month and 1 agent card. Plus is $19 a month and allows 100 payments and 5 agent cards, with daily limits and webhooks. Enterprise is priced by contacting Self Labs and adds merchant allowlists and unlimited payments. A payment means one card fill, and an abandoned checkout still uses one. The first 1,000 Plus subscribers get 3 months free.
Workflows we would build around it
These are designs we would build. None of them describes a client result.
- 1Software renewals. An ops agent watches renewal dates in a shared sheet, signs in to the vendor's billing page with a vault login, and renews only tools on the approved list. It runs on its own agent card with a per-transaction cap set just above the largest normal renewal, a blocklist for sites it should never touch, and approval required above a set amount. Each renewal is logged back to the sheet with the order number from the vendor's receipt.
- 2Supplies reorder. When stock in your inventory sheet drops below a reorder point, the agent builds the order at the usual supplier and asks a named person to approve before the card is filled. For stores on Shopify, our post on Shopify Shop MCP checkout covers a second route with its own confirmation rules.
- 3Travel booking with a person in the loop. The agent finds options inside a written travel policy, holds the booking, and fills the card only after the traveler approves the total. Any one-time code from the bank goes to the traveler, which Agent Vault does by design.
For each of these we would give every agent its own agent card and its own API key or connection, so one can be stopped while the rest keep running. We would add limits to every card the moment it is added, keep auto-pause on, and compare the Activity page with the real card statement each week. Our guide to agent action budgets explains how we size caps by category and amount.
When it is not worth it
If the vendor has an API or a bank with built-in approvals, use that instead. Mercury's MCP server, for example, queues payments for approval inside Mercury, which we cover in our Mercury MCP post. If you buy fewer than a handful of things a month, a person with a card is simpler. If your policy requires an allowlist of merchants, you need Enterprise. If you need the enclave guarantee from the announcement, the hosted service does not offer it today according to the docs. And if a purchase is large, new or hard to undo, keep a person on it whatever tool you use. Our post on human approval gates for finance agents covers where those gates belong.
Agent Vault also does not settle how a business tells a customer's agent what it may do on the business's own site. That is a separate effort, covered in our post on the Personal Agent Protocol, which lists payments as an open topic.
How this fits implementation work
OrchestriAI is not a Self Labs partner and does not resell Agent Vault. We design the workflows around tools like it: AI agent systems that buy or book with clear approval steps, MCP development for the tools those agents call, and workflow automation for the sheets, receipts and reports around them. If you want to know which purchases are safe to hand to an agent first, start with the free automation audit.
Independence and limitations
OrchestriAI is an independent implementation provider. Product names are used for identification only. OrchestriAI is not affiliated with, endorsed by, or sponsored by Self Labs, Meta, Anthropic, OpenAI or Google. This article summarizes Self Labs' public announcement and documentation as of October 18, 2026. Prices, limits and security features can change, so confirm them in the current docs. This is not legal, security or financial advice.
