Agent Tools is a suite of capabilities that let an AI agent act for you without ever holding your real secrets. Every tool works the same way: your agent gets mock tokens, and our proxy swaps them for the real values inside a session it can't see. Two tools are live today.
Give your agent a card it can't leak.
Give your agent a login it can't leak.
An agent browses a page. The page contains injected instructions. The agent dumps its context to an attacker-controlled endpoint. If your card number or your password was in that context, it's gone. Both Agent Tools — cards and logins — exist to keep those secrets out of the agent in the first place.
If the agent is compromised, the attacker gets mock tokens. They only work through our proxy, and a proxy session times out after 15 minutes idle. They cannot make a purchase or sign in anywhere else, and you can revoke a card or login at any time.
The same flow powers both tools — cards and logins. If your agent uses Playwright, it works with Agent Tools. The rest is config in the dashboard.
Cards go in the Cards vault, logins in the Logins vault. Card numbers are tokenized to Basis Theory — a PCI-DSS Level 1 vault — so we hold only a token, never the number; logins sit encrypted. Nothing leaves until a proxy session needs it.
// dashboard Card added brand: Visa last4: 4242 exp: 09/28 Login saved site: github.com
Give a shopping agent a card with spending caps and a kill switch; give a research agent just the logins it needs. API keys are issued separately per agent.
POST /v1/virtual_cards
{
"name": "Shopping Agent",
"card_id": "card_1",
"weekly_limit": 200,
"per_txn_cap": 75
}Card fields and login fields both become tokens that look real but carry no value. A compromised agent can leak them all day.
await page.fill('#cc', 'SAPu7x2kc1000000'); await page.fill('#name', 'u7x2k_first_name'); await page.fill('#user', 'u7x2k_login_github_username'); await page.fill('#pass', 'u7x2k_login_github_password');
The real card numbers and passwords are injected inside an isolated session the agent cannot observe. The merchant or the site sees a normal request.
// inside the proxy (you never see this) const real = await vault.resolve(session, token); request.form.cc = real.cardNumber; await submit(request); // merchant sees: 4242 4242 4242 4242
The same three controls protect both tools. Whether it is a card number or a password, the agent is isolated from real values, from other sessions, and — for cards — from its own spending ceiling.
Mock tokens in the agent's context, real numbers in ours. Substitution happens inside a proxy the agent cannot observe or script.
Agent cards have daily, weekly, monthly, and per-transaction caps. Optional merchant allowlists. Auto-pause on any limit exceeded.
Each agent session runs in its own browser context. Cookies, storage, and cache do not cross between sessions. Tokens are single-use and expire in 15 minutes.
Any workflow that ends in a checkout form or a sign-in form works. You decide which agent gets which card and which logins, and how much it can spend.
Three tiers: begin on Free, then step up to Plus or Pro as your agents do more. Upgrade anytime from your dashboard — compare what each tier includes below.
| Feature | Free | Plus | Pro |
|---|---|---|---|
| Payments per week | 2 | 20 | Unlimited |
| Agent cards | 1 | 5 | Unlimited |
| Daily spend limits | — | Yes | Yes |
| Merchant allowlists | — | — | Yes |
| Webhook notifications | — | Yes | Yes |
| Email support | — | Yes | Yes |
| Priority support | — | — | Yes |
One drop-in import covers both tools — the same swap fills card fields at checkout and credential fields at sign-in. Keep the rest of your agent code.
import { chromium } from 'playwright'; const browser = await chromium.launch(); const page = await browser.newPage(); await page.goto(url); await page.fill('#card', CARD_NUMBER); await page.fill('#name', CARDHOLDER); await page.click('#pay');
import { chromium } from '@selfxyz/agent-pay-playwright'; const browser = await chromium.launch(); const page = await browser.newPage(); await page.goto(url); await page.fill('#card', 'SAPu7x2kc1000000'); await page.fill('#name', 'u7x2k_first_name'); await page.click('#pay');
On the long tail of stores, agents still fail at the boring parts — carts that silently no-op, payment iframes, wallet-button traps. The Checkout Recipe Registry is a community catalog of per-platform and per-merchant checkout recipes: machine-readable JSON with a schema, a validator, and an autonomy benchmark. Any Playwright agent can read it, with or without Agent Tools.
{
"id": "brushespack.com",
"kind": "merchant",
"hosts": ["brushespack.com"],
"platform": "woocommerce",
"status": "verified",
"lastVerifiedAt": "2026-06-22",
"evidence": "Order #681199, $2.00, merchant email receipt",
"cardSurface": "stripe-payment-element",
"cvvTarget": "payment-frame:input[name=cvc]",
"gotchas": [
"Set #billing_country FIRST — it AJAX-refreshes.",
"Below the Stripe minimum, no card frame mounts."
]
}// Prefer the Playwright drop-in: it strips the query, the // fragment, and any hosted-checkout token before lookup. Pass // the URL you navigated to — SdkPage has no url() getter. import { recipesForUrl } from '@selfxyz/agent-pay-playwright'; const { merchant, platform } = await recipesForUrl(productUrl); // Or plain HTTP — public, unauthenticated, no account needed. // Send only scheme://host/path, never a session token: // GET /v1/recipes?url=https%3A%2F%2Fbrushespack.com%2Fproduct
Logins applies the card model to credentials. Save a username and password once, and your agent signs in with mock tokens — your real credentials never enter the agent's context, so a prompt injection can't leak them.
The proxy swaps each token for the real value inside an isolated session, at the moment of submit. Add your logins from the Logins tab in the dashboard.
If something is missing, write to us. We answer honestly, including about what we don't have yet.