Ledger Agent Stack for AI Agents: Propose-Only Wallets with Hardware Approval

Ledger Agent Stack is Ledger’s open-source preview toolkit that lets AI agents check balances, analyze portfolios, and prepare transfers or swaps—without ever holding private keys.

📑Table of Contents

The problem Agent Stack targets — agents vs value movement
Four primitives and when each applies
Wallet CLI in practice — separate read from sign
Install checklist for Claude Code and Cursor
Software-permission wallets vs hardware-gated agents
Limits, risks, and legal boundaries worth reading first
FAQ
Summary — what to do next

Sensitive actions still require human confirmation on a Ledger signer. The product line is summarized by one rule:

Agents propose. Humans approve. Hardware enforces.

What this article answers

Official guidance calls out Claude Code, Codex, Cursor, and other shell-capable agents. For developers who want agent-assisted wallet workflows, the useful questions are not press-release recaps but operational ones:

How read and sign paths are separated
Which primitive fits the job
What team policy must require

This article uses Ledger’s blog, the AI tools developer docs, and independent reporting to map:

The four primitives
A practical Wallet CLI path
Adoption checks
Early-preview limits

The problem Agent Stack targets — agents vs value movement

Where final authority lives

Agent Stack is not mainly about making agents “smarter.” It is about where final authority lives when value moves.

Agents are strong at research, account analysis, and transaction assembly. They are also exposed to:

hallucination
misinterpreted instructions
prompt injection

If final approval lives only inside a software UI that an agent can influence, the security boundary collapses into the agent runtime. Before production, start with a hardware-gated approval path for spend, and avoid agent-only software approval as a production policy.

Ledger’s blog contrasts software-only agent wallets (smooth UX, app-local authority) with a hardware final gate on the signer’s trusted screen.

Independent coverage of the same design

Independent coverage tracks the same design.

CoinDesk

CoinDesk: agents that can read and prepare without controlling keys, with explicit hardware approval for sensitive steps, framed as an early piece of Ledger’s 2026 AI roadmap—so treat “prepare” as non-final and keep human device approval as the next gate before any spend.

The Block

The Block: hardware sign-off for execution, plus OpenPGP-style protection for agent credentials and API keys; use that as a reminder to separate wallet keys from agent secrets before scaling automation.

Implication for readers

Implication for readers: separate “automate analysis and preparation” from “authorize spend,” and refuse designs that collapse both into one software surface.

Four primitives and when each applies

The four OSS primitives

The official blog presents four OSS primitives. Docs further split surfaces into runtime Wallet CLI and build-time DMK skills.

Primitive comparison

Primitive	Primary user	What it enables	Keys and approval
Device Management Kit Skills	App developers	Markdown skills so coding agents implement DMK integration	Device remains the final gate; HITL assumed
Ledger Wallet CLI	Individuals / power users	Balances, history, receive, prepare send/swap, earn	Reads without the device; every signing step on-device
Ledger Enterprise CLI	Institutions / governance	Transaction prep and governance support	No key custody in the agent; enterprise policy
Enterprise Multisig CLI	Multisig operators	Propose, query, sign, execute under quorum	Quorum plus hardware signatures

Sources for this section

Source: Ledger blog, AI tools overview (as of July 2026).

Practical split

Practical split:

Wallet CLI — operate your accounts from a terminal or coding agent.
DMK skills — teach coding agents how to integrate Device Management Kit into apps (intent vocabulary, 5-step implementation, clear-signing concepts).
Enterprise / Multisig — institutional governance and quorum flows, not personal Wallet CLI.

Both docs surfaces are marked early development with possible breaking changes. Treat the stack as preview tooling, not a frozen production API. Next step: re-read current docs before each rollout, pin the CLI version you validated, and re-run dry-run checks after upgrades.

Wallet CLI in practice — separate read from sign

Wallet CLI’s operational value is the command-level split between read-only paths (no device) and signing paths (always on-device confirmation).

Minimal install

Install @ledgerhq/wallet-cli globally (docs example shows wallet-cli v2.0.1).
Add the agent skill: npx skills add LedgerHQ/agent-skills -s wallet-cli-usage.
Prerequisites: macOS / Linux / Windows (WSL recommended), USB Ledger, target app open (e.g., Ethereum).
Sanity checks: wallet-cli --version, optional genuine-check.

Source: Wallet CLI docs (as of July 2026).

Network coverage

Capability	Bitcoin	Ethereum (+EVM)	Solana
Balances / operations / send-receive / swap	Yes	Yes	Yes
Token lookup	—	ERC-20	SPL
Earn	—	ERC-4626 vaults	Native staking

Source: Wallet CLI docs (as of July 2026).

Read-only first path

Run wallet-cli account discover ethereum once per network.
Use balances, operations, earn yields, earn positions.
Prompt the agent to analyze balances and recent history only.

Because read commands do not touch the device, teams can validate agent + Ledger wiring with lower blast radius.

Signing path (dry-run + human eye)

For send, swap, and earn deposit/withdraw, the terminal surfaces content and the Ledger screen must confirm it.

Fee preview: send --dry-run
Swap flow: swap quote → swap execute → swap status (clear-sign in Exchange app)
AI-generated destinations, amounts, and routes can be wrong—verify the device screen independently (explicit CLI guidance)

Official trial shapes:

Read: research developers.ledger.com, then analyze the portfolio via Wallet CLI.
Trade prep: rebalance proposal → lowest-swap route → prepare via CLI; execution only after human approval.

Key Ring (LKRP)

After ring init, AES-256-GCM encrypt/decrypt helps protect agent secrets (API keys and similar). It is not a replacement for wallet keys; treat it as a credential-protection layer beside the hardware signing boundary.

Install checklist for Claude Code and Cursor

Connect Ledger over USB and open the target app (e.g., Ethereum).
Run npx skills add ledgerhq/agent-skills (optionally -s wallet-cli-usage, or the three DMK skills).
Install Wallet CLI; run genuine-check and account discover ethereum (or the networks you use).
Allow read-only prompts first until balances/operations succeed.
For send/swap: dry-run or quote → human verification of amount and destination on device → approve.

If you are building app integration (DMK)

DMK skills docs describe three skills:

dmk-intent-vocabulary — map natural language to DMK APIs
ledger-dmk-implementation — Init → Session → Device State → App Management → Operation with HITL gates
dmk-business-logic — Clear Signing, secure channel, sessions, transports

npx skills add ledgerhq/agent-skills -s ledger-dmk-implementation dmk-intent-vocabulary dmk-business-logic

Prompts improve when they name:

platform (web/Node/mobile)
transport (WebHID/Bluetooth/USB/Speculos)
chain
operation

WebHID requires Chromium, localhost or HTTPS, and a user gesture to start discovery. Docs place responsibility on developers to keep on-device confirmation in the path.

Team policy boundary

Bots with autonomous execution policies are a poor fit.
Standardize propose-only agents plus physical human confirmation.
Expand from small test funds only after dry-run discipline is written down.

Software-permission wallets vs hardware-gated agents

The core difference is not marketing language—it is where the final boundary sits.

Software-permission agent wallets: authority completes in-app; rule-bounded autonomy can feel seamless.
Ledger Agent Stack: agents propose and prepare; execution requires human confirmation on secure hardware.

The Block contrasts this propose-only posture with wallets that already let bots execute inside user-defined rules. If your requirement is fully autonomous trading or unattended payment, this stack is intentionally misaligned.

Related industry pattern

MoonPay Agent and hardware signing

A related industry pattern appears in DigitalToday’s report on MoonPay Agent + Ledger hardware signing.

That pattern pairs agent execution power with private keys kept on device. Before you scale similar designs, confirm keys never leave hardware and that every spend still needs a human on-device check.

Approval boundary and credentials

Separately, zero-exposure credential tools (for example 1Password for Claude) share the same design question
The shared question is where you pin the approval boundary so agents never become secret holders; next, write that boundary into the team runbook before enabling signing skills

Adoption checklist

Can you accept physical human confirmation on every sensitive action?
Is read-only automation (balances, history, analysis) already enough value?
If full autonomy is required, can you reject this stack cleanly?
Can you tolerate early-preview breaking changes?
Will you document dry-run + device visual checks in team runbooks?
Do you need Enterprise/Multisig, or is personal Wallet CLI enough?

Limits, risks, and legal boundaries worth reading first

Preview quality and non-deterministic instructions

Preview quality: early development; APIs and behavior may change. Re-check docs before production and expect rework.
Non-deterministic AI instructions: wrong parameters are expected—device-screen verification is mandatory. Next action: never approve from CLI text alone.

Custody framing (tooling, not a financial service)

No custody claim: Ledger does not hold user assets and does not take responsibility for agent economic outcomes; docs frame this as tooling, not a financial service.

Threat model ceiling and residual human risk

Threat model ceiling: a compromised agent can still request signatures, but cannot force them without a human. Human mis-approval remains a residual risk. Ban rushed approvals and dual-check address/amount.

Production-funds ramp

Production funds: start with a small pilot; require dry-run in team policy. Gate production on read-only success → dry-run success → small live send; roll back to read-only if any check fails.

Operator caution

⚠️ Do not begin with production-size balances. Validate skills and read-only flows first; insert dry-run and visual checks before any signing path.

FAQ

Q1. Does the agent ever hold private keys?

A. Not in the official model. Agents analyze, recommend, and prepare; keys stay with Ledger; sensitive actions need human confirmation on device. Still treat every approval as independent verification of the device screen—not a rubber stamp for the agent’s plan.

Q2. Can Claude Code complete everything alone?

A. Shell-capable agents can drive CLI/skills, but signing always requires the device. Cursor and Codex follow the same boundary—this is not “autonomous send from the agent alone.”

Q3. Fastest read-only trial?

A. Add skills → install Wallet CLI → account discover → balances / operations. Start from the official portfolio-analysis prompt style.

Q4. Enterprise CLI vs personal Wallet CLI?

A. Wallet CLI targets personal accounts. Enterprise CLI supports institutional governance prep; Multisig CLI adds quorum plus hardware-signed multisig operations. Choose the primitive by autonomy and governance needs first; if you need unattended sends, stop and reject this stack before install work.

Q5. What if we need an autonomous production send bot?

A. That requirement conflicts with per-action human hardware approval. Choose a different architecture, or reopen the requirement and keep hardware approval if risk allows.

Summary — what to do next

Takeaways

Separate proposal from approval; pin the final boundary in hardware.
Choose among DMK skills, Wallet CLI, Enterprise, and Multisig by role.
Use Wallet CLI’s read/sign split as the default personal workflow.
Operate with preview constraints and residual human mis-approval risk.

Next actions

Open the AI tools overview and run npx skills add ledgerhq/agent-skills.
Complete one successful read-only portfolio analysis.
Add “dry-run + device visual check” to team procedures for sensitive operations.
For app integration, put DMK’s 5-step flow and WebHID constraints into design review.

For adjacent patterns, see 1Password for Claude’s zero-exposure design, Anthropic Academy on Claude Code / MCP / Agent Skills, and Agentjacking risk context.

Related articles:

Author

krona23

Over 20 years in the IT industry, serving as Division Head and CTO at multiple companies running large-scale web services in Japan. Experienced across Windows, iOS, Android, and web development. Currently focused on AI-native transformation. At DevGENT, sharing practical guides on AI code editors, automation tools, and LLMs in three languages.

DevGENT about →

📚 Read Next