Skip to main content

Security model

hoodpocket is built around one honest question: what happens when things go wrong?

The pocket bounds the blast radius​

The wallet is a fresh key, generated locally, funded with only what the agent may trade. Your main funds never touch it. Whatever fails (the model hallucinates, a scam slips through a tier, the machine is compromised), the worst case is the pocket's balance.

This is the same structure Robinhood chose for its own agentic trading (dedicated, isolated accounts), rebuilt self-custodially.

Policy runs before signatures​

Guardrails are enforced in the server, before any transaction is signed:

  1. Trust tier of the token must be enabled by policy
  2. The trade's USD value must fit the per-trade limit for that tier
  3. The rolling 24h USD budget must not be exceeded
  4. Denylisted addresses are always refused

A blocked trade never reaches the chain and costs nothing. The error message states exactly which rule blocked it, so the agent can adapt instead of retrying blindly.

The key is never exposed to the agent​

There is no MCP tool that returns the private key. A prompt-injected agent can read the address, balances, and history, but it cannot exfiltrate the key or send funds to an attacker: there is no withdrawal tool either. Funds can only rotate between currencies inside the wallet. Moving funds out requires the key, which only you hold.

Key backup (hoodpocket export-key) is a CLI command intended to be run by a human in a terminal.

What hoodpocket does not protect against​

Being honest about the boundaries:

  • A compromised machine. The key lives on the machine running the server (chmod 600, but plaintext). If that machine is owned, the pocket is owned. Keep the pocket small.
  • Perfect scam detection. Tiers make scams expensive, not impossible. See Trust tiers.
  • Bad trades. The agent can still buy high and sell low inside its limits. Guardrails bound losses; they do not create alpha.
  • Server-side enforcement. Guardrails live in this server's code, not on the blockchain. An on-chain "vault mode" (ERC-4337 smart account with session keys) is on the roadmap for larger balances.