Locker Protocol Agentic

Locker Protocol Agentic

Your private key is nowhere: not on our servers, not on the agent's machine, not with anyone.

The agent trades. It holds nothing.

• Where the key is: the account's private key stays in Locker Vault, an offline app on a phone or tablet. This computer only holds an agent key, sealed under a password, that expires on its own (six months by default, the longest Hyperliquid allows).
• Who can withdraw: only the vault, by a QR code a person scans and signs. Hyperliquid refuses the agent key every withdrawal and every send; the one movement of funds it accepts from that key is a deposit into a Hyperliquid vault, which lpa never signs (measured on mainnet, 2026-09-28).
• What goes where: orders and reads go to Hyperliquid, deposits and balances to Arbitrum nodes, and nothing else unless you turn it on (the list is below). No server of ours, no account, no telemetry.

Documentation: doc.lockerprotocol.com/agent-wallet: install, the setup in steps, how it trades and every command. Website: hyperagentictrader.com.

Locker Protocol Agentic is an agent wallet for Hyperliquid perps: the lpa command for people and for AI agents, an MCP server, and two SDK packages. It comes with a simulation account on the real order book, a local policy checked before every order, and every movement of funds signed on the phone.

This repository is its home: the documentation, the changelog, the release log with the SHA-256 of every tarball, and the issue tracker. The four npm packages point their repository field here. The source is not published.

How it works

Three places, and one rule: the key that owns the money never leaves the phone.

  PHONE (offline)              THIS COMPUTER                              HYPERLIQUID

+--------------------+ +-----------------------------------+ +----------------+ | Locker Vault | | lpa <- you, a script, or an AI | | | | | | | agent (shell or MCP) | | order book | | holds the ACCOUNT | | | | | | | key; it never | QR | | 1. quote on the live book | | your account | | leaves the phone |<---->| | 2. local policy | | | | |codes | | 3. your go | | | | signs: the agent's | | v | | | | approval, deposits,| | guardian (background process) | | | | withdrawals, dex | | holds the AGENT key in memory, |----->| orders, | | transfers, revoke | | checks the policy again, signs | | cancels, | +--------------------+ | trading actions only | | leverage, | +-----------------------------------+ | TP/SL | +----------------+

• Locker Vault is an app on a phone or tablet that stays offline. It holds the account's key and signs by QR code: the computer shows a request, the phone's camera reads it, the person reads on the phone what it does and signs, the phone shows the signature, the computer's webcam reads it back.
• The agent key is made on the computer by lpa init, approved once by the vault, sealed on disk under a password. Hyperliquid lets it trade, and refuses it every withdrawal and every send. It expires on its own.
• The guardian is a background process that lpa unlock starts. It holds the agent key in memory, checks every order against the policy a second time, and against the mandate once you sign one on the phone, and signs only a closed list of trading actions. It answers only requests that carry the token it writes at start, which a plugin cannot read. The agent that calls lpa never sees the password nor the key.

Three ways to sign for your account

The drawing above follows Locker Vault, the safest way and the one we recommend. lpa setup asks how your account signs, Locker Vault first; lpa init --with vault|browser|mobile says it on one line, and lpa signer show says it afterwards.

With an extension or a mobile wallet, the account is proven first, before any money, by one signature that moves nothing, checked here and sent nowhere; an address that is a contract is refused. Those two are online wallets and show a typed signature as raw fields, so the local page says what your wallet will show, field by field. Locker Vault keeps the key on a device that is never online and shows every request in words. lpa signer use changes the way for the same address; the agent key and the mandate stay.

The mandate, the live copies and the plugins

• No stop in percent. Since 2.4.0 no share of a loss refuses an order, the day's nor the one since the start, and no fall of the equity stops the daily pilot. What bounds the money: the size of an order, the leverage, the markets, the orders and the notional of a day, the risk:reward, the expiry, the other bounds of this computer, the mandate, the model's budget, the pause after losses in a row, and the stops each strategy sets for itself.
• The mandate is the agent's limits signed once by your wallet: the policy's bounds, a ceiling on the notional opened per day, the fee recipient, and what the key may be used for. Locker Vault shows every bound on its own row. Since 2.4.0 it holds fifteen fields under the version 2 of its EIP-712 domain; a mandate signed before 2.4.0 is refused whole (MANDATE_OUTDATED) until you sign it again with lpa mandate sign. The guardian checks it before every opening and never lets it widen the local policy. The folder remembers the highest mandate signed and the revocation, so a file gone, an older one put back or a revoked one opens nothing, in this guardian and the next; lpa mandate revoke stops every opening until you sign a new one, and lpa mandate release (your password) goes back to the local policy alone.
• A live copy (lpa copy start --live) mirrors a trader on the real account. It needs the guardian unlocked by you and a mandate that names the trader, with room in its copy budget. Each order goes through the policy and the mandate like yours, signed by the agent key, never by the account's key. A reduction the guardian could not place is kept and tried again, never lost; the copy's budget stays counted while its positions are open; your own account is never copied. Simulation stays the default.
• A plugin adds commands and MCP tools. It runs in a separate Node process that reads its own folder only: not your keys, not your settings, not the guardian's token. It does know your user name, the computer's name and its network addresses, and the install screen says so. It reaches your wallet only through the capabilities it declared and you approved, none of which signs for the real account. Its files are fingerprinted at install, and a changed plugin does not run.

What the agent key can and cannot do

Measured on Hyperliquid mainnet on 2026-09-28, with an approved agent key:

A stolen agent key cannot withdraw, but it can lose money: by trading against an accomplice on a thin market, or by depositing the account into a vault run by someone else. lpa never signs vaultTransfer (its guardian signs a closed list of trading actions), but a thief with the key and the password does not need lpa. The real bound is a dedicated account that holds only what you are ready to risk.

How this compares with the other agent wallets, quote by quote and source by source: COMPARISON.md.

The four packages

Each package's page on npm is its complete reference: how it works, then every command, tool or function with an example.

The four versions move together, one version per release. Node 22.13 or later for the wallet and the MCP server; the two SDKs alone run on any Node 22.

What gets installed where: the one-line installers put lpa and the MCP server in ~/.lpa, on one copy of the packages, with two launchers, lpa and locker-mcp, so both always run the same version. npm install -g installs lpa alone; an MCP client can then fetch the server with npx at @latest, the newest release at each start: when a version comes out, run the installer again so that lpa follows. Either way they share the ~/.lpa folder and the guardian, and a guardian signs nothing for a program of another version.

Install

npm install -g @locker-protocol/agent-wallet-hyperliquid-trader@latest

Or the one-line installers, which fetch Node when it is missing and put everything in ~/.lpa, with no administrator rights.

On macOS and Linux:

curl -fsSL https://hyperagentictrader.com/agent-wallet-install.sh | sh

On Windows (PowerShell):

irm https://hyperagentictra