Agent cards: Giving AI agents a card of their own

Agent cards are a new type of Mercury virtual card built specifically to be handed to AI agents - software programs businesses can use to handle routine work automatically, like buying things online, booking flights, or managing online ad spend. An agent card can be given to an agent so it can make purchases on your behalf, while you keep full control over how much it can spend and which card it can ever touch.

What is an AI agent?

An AI agent is a software program that can complete tasks on its own, without a person doing each step. Businesses use agents to handle repetitive work like buying office supplies, booking flights, or managing advertising.

Mercury doesn't build AI agents. You build and run your own agent using whatever AI platform you choose (for example, Anthropic's Claude, OpenAI, or others). Mercury provides the card, the security controls, and the oversight tools that keep your agent spending within the limits you set.

What is an agent card?

An agent card works like any other Mercury virtual card - it's accepted anywhere Mastercard is accepted online - with two differences designed for autonomous use:

• Your agent can retrieve the card's credentials on its own. Unlike standard virtual or physical cards, an agent can pull an agent card's number, expiration date, and security code (CVC) through Mercury's API or CLI, so it can enter them at checkout without a person in the loop.
• It comes with agent-specific guardrails. An agent can spend within the card limit you set, but it can never create new cards, raise its own limit, or reach any card you didn't explicitly hand it.

Mercury Business customers can designate both debit and credit virtual cards as agent cards.

What you can use an agent card for

Agent cards are built for the online, and high-frequency, and time-intensive purchases that agents increasingly handle for businesses:

• Vendor and procurement payments
• Booking flights
• Managing online advertising
• API usage and developer tools
• Software and SaaS subscriptions

How agent cards keep you in control

Several capabilities can be risky to give carte blanche to agents: card creation (imagine if an agent made a ton of cards and spent against them all at once), card updates (an agent could increase limits on cards it controls to spend more without your permission!), and access to card credentials.

Agent cards are designed so agents can only access card credentials - and only for the agent cards you give it, not your other virtual and physical cards. These protections are on from day one and can't be turned off:

• Only humans can create agent cards. An agent card can only be created by a person in the Mercury web or mobile app. Agents can't create agent cards (only non-agent cards) themselves through the API, CLI, or MCP.
• Per-card spending limits. You set a daily, weekly, or monthly limit on agent cards, just as with normal virtual Mercury cards. The agent can never spend above these limits.
• Agents can't change their own limits. Spending limits are set and changed only by a human in-app - never by an agent through the API, CLI, or MCP.
• Agents can't unfreeze their own card. Only a human can, in-app.
• Card isolation. An agent can only retrieve credentials for the agent cards you explicitly hand to it via API/CLI, not your other normal virtual/physical cards.

Together, these cap your maximum exposure to the spending limits on only the agent cards a human created. A compromised or out-of-control agent can't mint more cards or raise its own spend limit to get around it.

In the future, we’ll add even more granular capabilities to help you manage agent spend.

Your responsibility and liability

You're in control of your agent cards, and you're responsible for how your agent uses them - just as your company is responsible for purchases an employee makes on a corporate card.

A few things worth knowing:

• You keep your normal dispute rights. Agent card transactions can be disputed through Mercury's standard process, the same as any other Mercury debit or credit card.
• If your agent card credentials are stolen by a genuine outside party (not your own agent), that follows Mercury's standard fraud-dispute process.

Your use of agent cards is governed by your Mercury IO Charge Card Agreement, Column Commercial Debit Card Agreement, and Terms of Use.

Setting up an agent card

Setup has two parts: a human creates the card in the app, then you instruct your agent to retrieve the credentials.

Step 1 - Create the agent card (web or mobile)

Only admins or team members with card-management permissions can create cards.

On web:

1. Go to your Cards page from your Mercury dashboard
2. On the top right, click Create Card
3. Select Debit or Credit and Virtual from the dropdown
4. Select the Agent checkbox
5. Give the card a nickname, like "Ad-buying agent card"
6. Set a daily, weekly, or monthly spending limit. You can change this later
7. Review the details and click Create Card

On mobile (make sure you’ve updated to the latest app version):

1. From Home, scroll down to Spending
2. Tap Spending
3. Tap the + on the top right of your screen. Select Debit and Virtual and tap the Agent checkbox

Agent cards appear labeled Agent in your card list and on the card detail page, so you can always tell them apart from your other cards.

Step 2 — Give your agent the card credentials via MCP or CLI

Your agent retrieves the card number, expiry, and CVC through Mercury's Vault surface - available via API or CLI. Card credential access works only for agent cards, never for your regular virtual or physical cards.

CLI

You can find our CLI in this Github repo.

Claude Code

Once in Claude code, type mercury-cli. Claude code should pick up the package from Homebrew. You can also find our CLI here.

# List agent cards on an account (card IDs + masked PAN, no secrets)
mercury cards list --user-id

# Reveal one card's full number, CVV, and expiry
mercury cards reveal --card-id <card-uuid>

API

Request:

curl --request GET \
  --url <https://vault-api.mercury.com/api/v1/account/{accountId}/cards/{cardId}> \
  --header 'accept: application/json' \
  --header 'Authorization: Bearer $MERCURY_TOKEN'

Response:

{
    "cardNumber": "5555666677778888",
    "expiration": {
        "month": 7,
        "year": 2031
    },
    "cvc": "234"
}

MCP

Reveal card functionality is not currently accessible via our MCP servers. You can find our full set of docs at docs.mercury.com.

FAQs

Does Mercury build or control my AI agent?

No. You choose and run your own agent using whatever AI platform you prefer. Mercury provides the card and the controls around it; it doesn't vet or manage your agent, much like it doesn't manage the web browser you use.

Can my agent create its own cards or raise its own limit?

No. Both are human-only actions in the web or mobile app, and this can't be changed. It’s what caps your exposure and makes agent cards safe to hand over to agents.

Can my agent see card details of other, non-Agent Mercury cards?

No. An agent can retrieve credentials only for the specific agent cards you assign to it. Every other virtual and physical card, and the rest of your account data, stays hidden from it.

Where are the card credentials stored on the way to the agent/when retrieved via API?

In a secure third-party vault. Mercury never stores raw card numbers or codes. Credentials are released only through authenticated requests, and you can restrict API requests to specific IP addresses.

How do I stop an agent immediately?

Freeze or cancel the card from the Cards page on web or mobile. It takes effect right away, and the agent can't reverse it.

What happens to my card details once my agent has them?

When your agent pulls the card number, expiry, and CVC, those details move from Mercury into wherever your agent runs, including the AI platform you're using to power it. From that point on, they live in your setup.
The simple way to think about it: Mercury keeps your credentials safe right up until your agent asks for them and we release them. After that, how they're stored and used is in the hands of your agent and your AI provider. So when you're choosing an AI platform and setting up your agent, it's worth a look at how each one handles the details you give it.

What does Mercury collect and log about agent card activity?

The same kinds of information we handle for any Mercury card, transaction details such as amount, merchant, and date, and for agent cards - certain records of the API and CLI requests used to reveal credentials. We use this to run the service, monitor for fraud and misuse, and meet our legal and compliance obligations.

The Mercury Debit Cards are issued by Column N.A., Members FDIC, pursuant to licenses from Mastercard®. The IO Card is issued by Patriot Bank, N.A., Member FDIC, pursuant to a license from Mastercard International Incorporated.