Why the assistant never signs

A language model is good at turning a sentence into a concrete request and explaining the result. It is not a good place to keep a key.

The easiest way to give an assistant power over money is to give it a wallet or a signing endpoint. Both make the model part of the security boundary, and a model can be persuaded by text. Myntle takes the opposite route: the model works on language and read-only data, and the money path never passes through it.

The swap path uses six tools. Five read: get_wallet_balances, get_supported_assets, get_quote, get_transaction_status, and get_transaction_history. The sixth, prepare_swap, proposes a swap.

None of the five returns the connected wallet or a signature, and the six do not include a generic signing tool or a generic RPC tool. That is deliberate. A narrow set lets the assistant do useful work without acquiring a capability that is hard to take back.

When the assistant proposes a swap, the server validates the amount, asset, destination, and slippage against the account that is connected. It builds the transaction from its own stored quote instead of accepting the transaction the model described.

The approval is bound to the exact parameters shown in the card. If the amount changes in the browser, the server rejects the trade before a wallet is asked to sign. The approval response itself is checked against a server-held secret, so a modified client cannot invent an approval.

A person approves the trade, and the connected wallet or passkey signs it. The application never holds a private key or a balance, and the assistant never sees an address or a signature.

The first release keeps a human in every movement of money. A bounded autonomous mode can be added later, but it is an additional mode, not a replacement for the boundary.

The assistant can still be useful when it is wrong. It can misread a ticker or miss a route. The application can refuse a malformed trade, and the settlement record can disagree with the assistant’s sentence.

That is the design: the model is an interface to a ledger, not a signer for it. You can read the code and the verification notes in the repository.