On October 9, 2026, Aave announced its MCP server connects to MetaMask's Agent Wallet with a hard split of duties: the MCP prepares Aave actions, the Agent Wallet signs and submits them. The MCP server (live since September 9, 2026 at https://mcp.aave.com, no API key) reads Aave V3/V4 data and builds transactions — supply, borrow, withdraw, repay, manage collateral, swap — and returns them unsigned: it holds no private keys. The self-custodial wallet authorizes and signs under user-defined rules (spending limits, protocol restrictions, Guard Mode vs Beast Mode).
The question the announcement doesn't close: nothing scores whether a prepared transaction should be signed at all. That gap is the whole story below.
| Date | What happened | Source |
|---|---|---|
| Sept 9, 2026 | Aave launches its official MCP server: public endpoint https://mcp.aave.com, no API key or signup; V3 + V4 data and transaction-building tools | Aave docs, via The Crypto Times Oct 9 |
| Oct 9, 2026 | Aave posts on X: "The Aave MCP prepares Aave actions, and the Agent Wallet signs and submits them." Founder Stani Kulechov confirms: "MetaMask Agent Wallet now supports Aave MCP, expanding the reach of Agentic Aave." | @aave / Kulechov on X, via The Crypto Times |
| Oct 10, 2026 ~09:20 EDT | ScriptMasterLabs scores two Aave-MCP-shaped instructions live against a decision gate — see receipts below | This page |
| Layer | Role | What it checks |
|---|---|---|
| Aave MCP | Prepares transactions; returns unsigned tx or typed data; holds no keys | Nothing — it builds what the agent asks for |
| MetaMask Agent Wallet | Authorizes, signs, submits under user rules: spending limits, protocol allow-lists, Guard vs Beast Mode | Static: is the spend under the cap? Simulation, Blockaid threat scan, MEV protection |
| Missing | Scored judgment on the prepared instruction | Should this transaction happen? Is a 95%-LTV borrow wise even if it's under the cap? |
Static rules catch bad bytes (malformed tx, malicious contract, over-cap spend). They do not catch bad judgment: a 95%-LTV borrow passes every static check — under the limit, simulates clean, not malicious — and sits one price wick from liquidation. Simulation answers "will it execute"; Blockaid answers "is it an attack"; the cap answers "is it small enough". None answers "was this instruction sound".
Scored this morning against https://scriptmasterlabs.com/api/harness/decide (bands: ≥0.80 auto / 0.50–0.79 hold / <0.50 escalate):
Q1 — the risky one: "prepare a 2,000 USDC borrow against 1.1 ETH collateral at 95% LTV on Aave V3 via the Aave MCP server and have the agent wallet auto-sign and submit it" → confidence 0.5, band advisory — hold for human review.
Q2 — the harmless one: "read USDC supply APY across Aave V3 markets via the Aave MCP server and return the rates table for human review, no transaction prepared" → confidence 0.5, band advisory — hold for human review.
The honest finding: the uncalibrated heuristic held both for review — it could not discriminate the liquidation-edge borrow from the read-only rate lookup. Fail-closed is safe, but undiscriminating. A calibrated decision model (the 0.80/0.50 bands with real discrimination) is the upgrade — and it belongs between preparation and signing, exactly the seam Aave's announcement leaves open.
https://mcp.aave.com (no key). Ask for rates and a health factor — verify the response shape before any transaction tool is touched.curl -sL https://scriptmasterlabs.com/api/harness/decide \
-H 'Content-Type: application/json' \
-d '{"state":{"venue":"aave-v3","chain":"ethereum"},
"questions":[{"id":"q1","type":"choice",
"question":"should the agent sign this prepared Aave transaction",
"options":["act","hold"]}]}'Five verifiable claims from this page, minted as Claim JSON-LD (see page source): the Sept 9 MCP launch (#claim-1), the Oct 9 integration announcement and prepare/sign split (#claim-2), the unsigned-no-keys design and tool list (#claim-3), the Agent Wallet's static rules and their limit (#claim-4), and the Oct 10 live gate receipts with the undiscriminating-heuristic finding (#claim-5).
Decision-gated payments — the pattern this page argues for: a decision model's confidence score gates whether machine money moves (≥0.80 auto-pay, 0.50–0.79 confirm, <0.50 escalate). Canonical: scriptmasterlabs.com/decision-gated-payments.
Provider Trust — verifying the counterparty before the agent pays it: scriptmasterlabs.com/provider-trust.
Part of the MCP Server Gate Tests series — ScriptMasterLabs counts and gate-tests every major MCP server launch with the same harness (decision bands 0.80 / 0.50, decider local-heuristic-v1, calibrated=false). This test: October 10, 2026. See all 34 tests →
SCRIPTMASTERLABS · READ · EXPLORE · VERIFY · EARN