{
  "projectId": "agentkit",
  "title": "Coinbase AgentKit 的工具与钱包适配层",
  "summary": "发布包将 ActionProvider 与 WalletProvider 分开组合，AgentKit 根据当前网络筛选工具；签名与交易最终交给具体钱包实现。",
  "scope": "npm @coinbase/agentkit@0.10.4 的选定发布文件；REA 解析 3 个 JS 文件，静态分析。",
  "status": "partial",
  "analyzedAt": "2026-10-13T10:33:50.148136+00:00",
  "tool": {
    "name": "REA",
    "version": "6.4.0"
  },
  "findings": [
    {
      "title": "工具由 schema、元数据与钱包绑定生成",
      "detail": "AgentKit.getActions 先检查 supportsNetwork，再取各 ActionProvider 的工具。ActionProvider 把名称、说明、schema 和 invoke 组合，并在需要时注入 walletProvider。",
      "evidenceType": "code_inference",
      "evidenceIds": [
        "ev_38506834caf9925f8426a44039dd5685b261ebe27055958222ab10dcaaf96941"
      ],
      "sourceUrls": [
        "https://registry.npmjs.org/@coinbase/agentkit/-/agentkit-0.10.4.tgz"
      ]
    },
    {
      "title": "CDP 钱包适配器负责远程签名和发送",
      "detail": "选中的 CDP EVM 钱包实现从显式配置或环境变量取得 CDP 凭据；signTransaction/sendTransaction 委托 cdp.evm。未取得 CDP 服务端，不能由 SDK 包认定服务器端密钥控制和策略执行。",
      "evidenceType": "code_inference",
      "evidenceIds": [
        "ev_38506834caf9925f8426a44039dd5685b261ebe27055958222ab10dcaaf96941"
      ],
      "sourceUrls": [
        "https://registry.npmjs.org/@coinbase/agentkit/-/agentkit-0.10.4.tgz"
      ]
    }
  ],
  "limitations": [
    "仅分析发行包中的 AgentKit、基础 ActionProvider 与 CDP EVM 钱包三个实现文件。",
    "不同 WalletProvider 的权限模型可能不同，不应推广为所有钱包的共同性质。",
    "静态代码不证明运行行为、完整风控、成交或收益；未审计服务端。",
    "没有登录、读取账户、连接钱包、签名、交易或执行目标代码。"
  ],
  "artifacts": [
    {
      "label": "@coinbase/agentkit@0.10.4",
      "url": "https://registry.npmjs.org/@coinbase/agentkit/-/agentkit-0.10.4.tgz",
      "sha256": "da80dc7c99c51a2bfb3ec8b29f66f30f1eb1a1ad13ed1853bb275957b58975e9"
    },
    {
      "label": "dist--agentkit.js",
      "url": "https://registry.npmjs.org/@coinbase/agentkit/-/agentkit-0.10.4.tgz",
      "sha256": "fc0db1519193917adb57254eced3d9d4f7ffd906ee4f15dccd02d00faad7d24f"
    },
    {
      "label": "dist--wallet-providers--cdpEvmWalletProvider.js",
      "url": "https://registry.npmjs.org/@coinbase/agentkit/-/agentkit-0.10.4.tgz",
      "sha256": "e973e8cf641b355b9cfc8e14f23e609c7a2a7fbd7f76a03e0f4a8a52cacb119e"
    },
    {
      "label": "dist--action-providers--actionProvider.js",
      "url": "https://registry.npmjs.org/@coinbase/agentkit/-/agentkit-0.10.4.tgz",
      "sha256": "576a2fb996b0a49a894acd5a35d988157ae5b4ba30d06527836fbc480430ba46"
    }
  ],
  "evidenceIds": [
    "ev_38506834caf9925f8426a44039dd5685b261ebe27055958222ab10dcaaf96941"
  ],
  "reportUrl": "/research/rea/agentkit.json",
  "coverage": {
    "parsedFiles": 3,
    "parseFailures": 0,
    "semanticCoverage": "unknown",
    "rootArtifactSha256": "0470accd2a81dffecfc29ddd3966c008c86fd8e135071a2955577ed421e03122",
    "inputFileCount": 3,
    "inputBytes": 15801,
    "npmIntegrityVerified": true,
    "analysisResult": "completed"
  }
}