MCP for Trading: How AI Agents Connect to Markets

A trading MCP server lets an AI app such as Codex, Claude Code or Grok call market tools: read prices and wallets, then place orders. The safe designs give the AI a separate wallet and a revocable key, check spending limits on the server, and have no tool that can send funds out.

What MCP is, in one minute

The Model Context Protocol is an open standard that lets an AI app, the host or client, call tools exposed by a server. The AI decides when to call a tool. The server does the work and returns the result. MCP trading uses that call for markets: one tool returns a price, and another places an order. The wallet, the key, and the spending cap belong to the server you connect.

The hosts in the worked example below are Codex, Claude Code (CLI), and Grok. Claude Code here means the command-line app. Builders who want the message format can read the Model Context Protocol specification. Setup commands belong in the Codex MCP guide and the Claude Code MCP guide.

What a trading MCP server is

A trading MCP server exposes market and account actions as tools. People also search for this as trading MCP. The AI chooses a tool the server has published, sends the arguments, and reads the reply.

Group the tools before you connect a key.

• Read tools return prices, charts, holders, wallet activity, your balances, and your orders. They answer questions.
• Write tools request quotes and swaps, place limit and trigger orders, run DCA, place stop-loss and take-profit, and cancel. A write tool can spend money.
• Account tools read your settings and limits back, so the AI can tell you which caps are in force.

Read tools are research. Write tools spend money.

The host sends the tool name and the arguments. The server checks the key and any limit on the order, then returns a result. When the check fails, the order is not sent. A catalog of published servers is the crypto trading MCP servers directory. For a list of servers, see best MCP servers for crypto.

Three custody designs (and what each means for you)

Custody is who can move the money. Some servers run locally with exchange API keys. Some run locally with a wallet private key. Some are hosted and give the AI a dedicated agent wallet. The table has no product names. The worked example is the third row.

A copied private key has no revoke button, which is why that row says never use a main wallet. A scoped key still spends real money, and a buy inside the cap can still fall to zero. Fund only the wallet the agent can use.

Where limits should live

A prompt limit is a sentence, such as "never spend more than $50." A prompt can be ignored, misread, or overridden by injected text, including text that arrived in a tool result. A server-side limit is checked by the service on every order, against the cap stored for the account. A blocked order should be final: no retry, no splitting the size into smaller pieces, and no second tool used to get around the same cap. Rate limits should exist so a loop cannot send a burst of orders that each sit under the per-trade number.

LLM06 Excessive Agency names three root causes: excessive functionality, excessive permissions, and excessive autonomy. The MCP security best practices call the matching control scope minimization: give the client only the tools and the permission the job needs. That guidance treats token passthrough as an anti-pattern, and the authorization spec forbids it. A server keeps a credential issued for itself and does not forward that credential to another service.

You set your agent's limits on max per trade, daily buy volume and market-cap range from the Moby app, and Moby checks them server-side on every buy your agent makes. If the cap lives only in the prompt, treat it as a preference. AI agent guardrails is the longer write-up of how to set the controls.

The risks specific to trading through MCP

Prompt injection. A token description, a post, or a web page fetched by a tool can carry instructions, and the model may treat that text as a request from you. LLM01 Prompt Injection documents the pattern. With a write tool connected, a sentence hidden in a description can become an order.

Impostor tokens. Many tokens share a symbol. The AI should resolve the contract address with a search tool, and it should not guess the address. A fill on the wrong mint cannot be undone, so compare the resolved address with the one you meant before you approve.

Stale quotes. Prices move. A quote should expire fast and be re-fetched. If you hesitate, ask again.

Real money. Trades on a live server are not a simulation and cannot be undone. The CFTC customer advisory AI Won't Turn Trading Bots into Money Machines says AI technology cannot predict the future or sudden market changes.

Over-broad servers. A server with more tools than you need, or a key with more permission than you need, widens what one bad instruction can reach. Leave a send-funds permission off unless sending funds is the job you chose.

A checklist before you connect a trading MCP server

Use this before you paste a key or save a config.

• Who runs the server, and whether you can name the operator.
• Whether read tools and write tools are listed apart, so you can see which calls spend money.
• Which custody design it is: a local exchange key, a local wallet key, or a hosted agent wallet.
• Whether it can withdraw or send funds, as a tool in the list or as a permission on the key.
• Whether limits are checked on the server for every order, or only written in a prompt.
• Whether a per-trade cap and a daily cap exist, and whether you can read them back.
• Whether you can revoke the key at once, and whether revoke stops new orders.
• Whether an ask-before-trade option exists, so a quote waits for your yes.
• Whether logs show what it did: orders, quotes, and refused trades.
• How a blocked trade is reported: which cap, what was requested, and that the order did not go through.

If a line has no answer, connect read tools only, or wait. On Moby, the Solana rug check skill reads risk signals and holder concentration and returns a low, medium, or high verdict. That verdict does not replace the checks above.

Worked example: the Moby MCP

Moby is one hosted server with a dedicated agent wallet, the third row of the table. The connector page is the Moby MCP connector, and the agent page is Moby Agents.

The server is Streamable HTTP at https://mcp.moby.win/mcp. The key is sent only as an Authorization Bearer header. Keys start with moby_agent_, and a moby_agent_ key is not a wallet private key. You can keep up to 5 active keys for that one agent, and you rotate or revoke them in the Moby app. Rotating issues a new key and revokes the old one. Revoking a key stops the agent at once. Put the key in the host's secure input.

There is one agent per user, with its own wallet, separate from the main in-app wallet. You fund that wallet from the Moby app. It cannot withdraw, transfer, or send funds, because there is no tool for it.

You set your agent's limits on max per trade, daily buy volume and market-cap range from the Moby app, and Moby checks them server-side on every buy your agent makes. A blocked trade is final: do not retry it, split it, or switch tools to get around the cap. Base limits shown in the app are up to 6 trades a minute and 200 a day.

Safety tiers are green (verified), grey (not scored yet, or a young launchpad token, and not a warning by itself), and red. Moby refuses agent buys on red. Quotes last about 45 seconds. Order types the agent can place are market, limit, trigger buy, DCA, stop-loss, and take-profit. Ask before every trade is optional: the agent names the token, the contract, the amount, and the price, then waits for your yes.

The Moby app supports Solana, Robinhood Chain, BNB Chain, and Base. Moby Agents trade Solana tokens, paid in USDC, including tokenized stocks. Agent trading on Base, BNB Chain and Robinhood Chain is coming soon. Resolve the mint with search_tokens before a buy. Impostor tokens share symbols, so a guessed address can buy the wrong mint.

How to trade crypto with an MCP server (the Moby flow)

1. Create a key in the Moby app.
2. Add the server to Codex, Claude Code (CLI), or Grok.
3. Ask for your guardrails and balances first.
4. Ask for research, for example a token's holders and smart-money flow.
5. Approve a quoted trade.

Setup commands are in the Codex MCP guide and the Claude Code MCP guide. Agentic trading is the name for an agent that researches and places trades inside limits you set.

Frequently asked questions

What is MCP trading?

MCP trading means an AI app places trades by calling tools on a Model Context Protocol server. The server exposes read tools, such as prices and holders, and write tools, such as quotes and orders. The AI decides when to call them, and the server carries out the trade.

What does a trading MCP server do?

It turns market data and account actions into tools an AI can call. Read tools return prices, charts, holders, wallet activity and your balances. Write tools request quotes, place swaps and orders, and cancel them. Account tools read back your settings and limits.

Is it safe to let an AI trade through MCP?

It depends on the server's design. Safer designs use a separate wallet, a key you can revoke at once, limits checked on the server on every order, and no tool that can send funds out. Every trade is still real money, so start small and use approvals.

Should trading limits live in the prompt or on the server?

On the server. A prompt limit can be ignored, misread or overridden by injected text. A server-side limit is checked on every order no matter what the AI says, and a blocked order should be final, with no retry or splitting.

What is the difference between an API key and a private key for an AI agent?

A wallet private key gives full control of that wallet. An API key from a service gives only the permissions the service allows and can be revoked. A Moby Agent key starts with moby_agent_ and is not a private key.

How do I trade crypto with an MCP server?

Create a key with the service, add its server to your AI app, and ask for your limits and balances first. Then ask for research on a token, check the quote, and approve the trade. With Moby, quotes last about 45 seconds, so approve quickly or ask again.

Can an AI agent withdraw my money through MCP?

Only if the server gives it a tool to do so. Check the tool list before you connect. The Moby MCP has no withdraw, transfer or send tool, so a Moby Agent can only trade inside its own wallet.

Which AI apps can trade through the Moby MCP?

Moby supports Codex, Claude Code and Grok. Each connects to https://mcp.moby.win/mcp with a Moby Agent key. Moby Agents trade Solana tokens, paid in USDC, including tokenized stocks.