AI assistants and broker APIs: connect one safely

What goes wrong when an assistant writes the code

These are not bugs in your prompt. They are facts about the API that an assistant cannot know from the code alone, each one sourced to the page that states it. Read them before you let anything near an account.

• Which account am I connected to, practice or real? Print the full web address before every call.
• Read the broker's own list of error codes and handle those, not the ones you assume.
• Read my key from an environment variable, which is a setting on my computer rather than a line in the code, and never print it.
• Stop and show me the order before you send it.

• Never paste an API key, password or account number into a chat window.
• Never let generated code place an order on a real account until you have read that code line by line.
• Never let an assistant decide how big the position is.
• Never trust a number an assistant states without the broker page that says it.

1. The code is fine and autotrading is switched off at the terminalMetaTrader 5 (Python package and MQL5)In plain words: nothing is wrong with the code. MetaTrader has a switch that stops programs trading, and it is off.The most common MetaTrader 5 automation failure is retcode 10027, TRADE_RETCODE_CLIENT_DISABLES_AT: the terminal itself has algorithmic trading disabled. No amount of editing the script fixes it, and an assistant asked to debug the code will keep editing the code.What to doEnable algorithmic trading in the terminal, then re-run. Check the retcode before you change a line.MQL5 forum: trade retcode 10027 checked 19 Sep 2026
2. MT5 Python code that can never run on your machineMetaTrader 5 (Python package and MQL5)In plain words: MetaTrader's Python add-on only exists for Windows. On a Mac it cannot be installed at all.The MetaTrader5 Python package ships Windows x86-64 wheels only. Ask for MT5 Python code on a Mac or a Linux box and you will get code that imports a package that cannot be installed.What to doRun MT5 and the Python script on Windows, or in a Windows container. Decide this before you write anything.PyPI: MetaTrader5 checked 19 Sep 2026
3. One header short of working, and the error blames your logiceToroIn plain words: eToro needs three tags sent with every request, two that identify you and one that is new each time. Miss one and it says you are not logged in, so you go looking in the wrong place.eToro requires three headers on every request, not two: x-api-key, x-user-key and a fresh x-request-id. Assistants routinely emit the first two and stop. Its own FAQ lists the common mistakes as the wrong headers, the wrong base URL and skipping validation against the API reference, and says a 401 comes from missing credentials or insufficient scopes rather than bad logic.What to doCheck all three headers and the base URL first, and generate a new x-request-id per call rather than reusing one. Treat a 401 as a credentials or scopes problem, not a code problem.eToro Builder FAQ checked 19 Sep 2026
4. Demo and live differ by one word in the patheToroIn plain words: the practice account and the real account use almost the same web address. One missing word and you are on the real one.At eToro the demo execution path carries a /demo/ segment that the live path does not. It is exactly the kind of single token an assistant drops when it rewrites a URL, and the request still succeeds.What to doPrint the full URL your code is about to call, every time, and assert on the /demo/ segment until you mean to go live.eToro Builder FAQ checked 19 Sep 2026
5. Official sample code that has been broken for yearsCapital.comIn plain words: the broker's own example file has been broken since 2023 and nobody fixed it.Capital.com's own Postman collection repository has seven commits and an open issue titled "Importing postman collection gives error", open since 18 Jan 2023. An assistant pointed at the official sample reproduces the broken setup faithfully.What to doCheck the issues tab and the last commit date before you trust any official sample, including ours.GitHub: capital-com-sv/capital-api-postman issues checked 19 Sep 2026
6. The assistant is reading a changelog that stopped five months agoInteractive BrokersIn plain words: there are three IBKR pages listing what changed, and the one an assistant usually finds stopped updating in April.Ask an assistant what changed recently in the IBKR Web API and it will most likely read the Campus mirror, which stops at 14 Apr 2026, rather than the Documentation changelog, which is current to 9 Sep 2026.What to doGive it the URL yourself: interactivebrokers.com/docs/web-api/changelog.IBKR Documentation: Changelog checked 19 Sep 2026
7. Rate limits that are real but not in the docsTradeLocker APIIn plain words: there is a limit on how often you can ask, but it is not written down anywhere you can read before you start.TradeLocker publishes no rate limits in its documentation. They are only readable from the authenticated /trade/config endpoint, so an assistant writing a polling loop has nothing to size it against and will guess.What to doCall /trade/config first and read the limits out before you write the loop.TradeLocker Public API checked 19 Sep 2026
8. The API it is writing against no longer existsFXCMIn plain words: FXCM switched off the connection older guides tell you to use, and never said so.FXCM's own page now lists only a FIX API, a Java API and ForexConnect. There is no REST API and no deprecation notice, but older guides still describe one, so an assistant trained or searching on those will confidently write FXCM REST calls.What to doOpen the broker's current API page yourself and check the API is listed before you start.FXCM: API trading checked 19 Sep 2026
9. The connector says connected and no tools arriveInteractive BrokersIn plain words: the connector can look like it is working and still hand the assistant nothing to work with. Check what tools it can see, not what colour the badge is.An open community issue thread reports the Interactive Brokers MCP connector showing as connected on claude.ai web and Claude Desktop while surfacing zero tools, and separately a schema bug in which tools taking integer, boolean or array parameters were rejected with the message string found, type expected. A partial patch around 14 Jul 2026 fixed roughly seven tools, while the tool-surfacing failure was still being reported. Claude Code was reported as unaffected by the same reporters. These are community reports on an open issue, not confirmed by the vendor.What to doDo not treat a connector badge as a health check. List the tools the client can actually see before you write anything against them, and test the same grant on every surface you plan to use, because the same authorisation can behave differently on web, on desktop and in a terminal client. If a tool rejects typed parameters, check the tool schema before you rewrite your prompt.Community issue thread: IBKR MCP connector checked 19 Sep 2026

Official

IBKR AI Integration (MCP)

IBKR's own hosted MCP server, usable from ChatGPT, Claude, Grok, Perplexity and any MCP client including Claude Code, ChatGPT Codex and Cursor. Instructions never become orders automatically: you review and submit each one on an IBKR platform. Not available in India or Japan. No rate limits are published on the release note.

cTrader Remote and Local MCP servers

Spotware's own MCP servers for cTrader accounts. cTrader states plainly that when trading is enabled an agent connected through cTrader MCP can place, modify and close real orders, with a confirmation requirement available as an MCP server setting rather than as a broker-enforced step. Open API rate limits are 50 requests a second on real-time data and 5 a second on historical data.

MetaTrader 5 built-in MCP and AI Assistant

MetaQuotes added MCP and agentic AI to MetaTrader 5 in 2026. MetaQuotes says users processed over 1 trillion tokens through the free MQL5 Lite model in three weeks.

eToro MCP server (Builders)

eToro's own hosted MCP server at mcp.public-api.etoro.com, aimed at developers building on the public API. eToro warns that automated or AI tools may cause rapid and substantial losses.

Community

metatrader-mcp-server

The most starred broker MCP server we found. Not from MetaQuotes. Wants your broker password in an env file or command line, which is a bigger risk than an OAuth login.

Qoyyuum/mcp-metatrader5-server

The second most starred MetaTrader 5 MCP server. Also ranked on our GitHub page. We have not opened its README, so its credential handling is unverified.

interactive-brokers-mcp

Community MCP server that bundles IB Gateway and a Java runtime. States it is unofficial and not endorsed by Interactive Brokers. Wants your broker password in an env file or command line, which is a bigger risk than an OAuth login.

rcontesti/IB_MCP

Well starred but nearly a year without a push, which for a broker API wrapper is a long time. Credential handling unverified.

psyb0t/mt5-httpapi

The only route we found that runs the Windows only terminal in Docker or QEMU and puts REST and MCP in front of it. Note the licence before you vendor it. Credential handling unverified.

emerzon/mtdata-mcp

The largest tool surface we found on any MetaTrader 5 community server, and it includes live trading. A large tool surface is a large blast radius. Credential handling unverified.

8nite/metatrader-4-mcp

Essentially the only MetaTrader 4 option we found, for a platform with no official MCP route at all. Twenty stars and no push in over a year, so read it as the only thing there rather than as a recommendation.

Hellek1/ib-mcp

Pushed the day before this reading, which makes it the most recently touched IBKR community server we found. Credential handling unverified.

capital-mcp

capital-mcp is published on capital-com-sv, the same GitHub organisation that carries Capital.com's official Postman collection and Java samples, and its README carries Capital.com's statement that it does not control, develop, endorse, or accept any liability for any third party software. Both are true at once, which is why the label here is broker-published, not endorsed. Capital.com announced it on 8 Jun 2026, describing trades with a mandatory two-step preview and confirmation, and the release states Capital.com is not legally liable for the MCP described nor the behaviour of the LLMs. Trading is off by default, the demo environment is the default, and execution requires confirm=true while CAP_REQUIRE_EXPLICIT_CONFIRM is on.

ig-trading-mcp

Node.js IG REST client with a built-in MCP server using the official MCP SDK. Not from IG. Wants your broker password in an env file or command line, which is a bigger risk than an OAuth login.

etoro-mcp-server (PyPI)

Community package by an independent developer, part of the syedair/mcp-servers repo (star count is for the whole repo). Not from eToro.

Blahaj-gif/Finance-mcp

The only multi broker community server we found. Its description puts execution behind a human approval step, which is the posture the official servers take.

etoro-mcp-server (gabrielcerutti)

The broadest eToro MCP server we opened, installable as a Claude Desktop bundle or npm package. States it is unofficial and not endorsed by eToro.

jgalea/saxo-mcp

Described as read only. A different repository from SirAdlerBD/saxo-mcp and from chongkwongsheng/saxo-mcp, both also listed here.

florinel-chis/oanda-mcp

One of two OANDA v20 servers we found. OANDA publishes no official route, so this layer is all there is.

florinel-chis/etoro-mcp

By far the largest eToro tool surface we found, and unlike eToro's own server it is described as able to trade. Selectable toolsets are a real safety feature if you use them.

saxo-mcp

A small but carefully gated Saxo OpenAPI MCP server. No affiliation with Saxo stated.

mcp-server-saxo-openapi

Documentation lookup server for the Saxo OpenAPI, useful when an agent writes Saxo code. Not from Saxo.

chongkwongsheng/saxo-mcp

One of three separate Saxo servers with near identical names. Its description is the safest posture of the three, but we did not open it.

aobathree/oanda-mcp

Described as read only, which is the posture to prefer if you are going to run one at all.

SimonTarara62/capitalcom-mcp-server

A community alternative to the server Capital.com promotes. Its description is the carefullest posture we saw for Capital.com, but we did not open it.

IG-incubator/IG-Skills

Read the owner name carefully. IG-incubator is not IG Group. This is a community project that asks for IG Labs credentials, and the name is close enough to mislead.

vestorfinance/arrissa-entry-station-ai-trading-app

The only TradeLocker adjacent project we found in this space at all, at zero stars. TradeLocker has no official route, so there is nothing else to point at.

IG Trading: CFD Assistant

Published by IG on its own page and re-read on 2 Oct 2026 at ig.com/au/trading-platforms/ai-assistant: strictly read-only, no placing, amending or closing trades, ChatGPT today and Claude coming soon, and the IG username and password never shared with the AI. Finance Magnates reported the launch on 28 May 2026. The earlier unverified reading on this site came from checking /au/mcp-server, which 404s.

What changed in agent access, read again on 23 Sep 2026

Read againFive things moved between 1 and 23 Sep 2026, and one thing this site had recorded needs correcting.

The correction first. MetaTrader 5 has had a native MCP server since build 6060 of 23 Jul 2026, and it is the only entry in this section that sits on all three rungs at once, because the rung is a setting rather than a product decision. Its release note states that AI operations are governed by configurable security settings, and that you can explicitly allow or prohibit AI initiated trading operations, or require manual confirmation. Build 6180 of 3 Sep 2026 widened the assistant's tool set to Strategy Tester reports, optimisation runs, chart indicators and terminal logs, and says nothing about execution, so it is a tooling change and not an authority change. Sourcemetatrader5.com release notes, read 23 Sep 2026.

No changeInteractive Brokers stays on drafts with approval, IG stays read only on its own wording that your AI can see the full account picture but only you can place or modify trades, and Spotware's two official cTrader servers are unchanged, with the Agent Skills library still proprietary under the Spotware end user licence rather than open source. Nothing in scope was withdrawn. OANDA and Saxo have published nothing at all on AI, agents, MCP or LLM access on their developer portals, and that silence is the finding: neither permission nor prohibition, read 23 Sep 2026.

The gapNobody maps broker API terms against agent use. Capital.com is the only in scope broker whose API documentation says anything, and all it says is that it is at your own discretion and risk. The liability question is asked in the trade press and answered in no broker's terms: the nearest published statement is a US equity broker saying customers are responsible for how their agents are built and the actions they take, and no CFD, FX or spread betting broker's terms were quoted anywhere we opened. A second and narrower gap is numerical: an agent that confuses points with big points sizes a stop wrongly on two digit gold pricing, which was reported on the MetaQuotes beta forum on 28 Jun 2026 and has no reply resolving it. Points, pips, lot sizing and contract size conventions broker by broker are where an agent goes wrong silently, and no reference covers them.

Before you let an agent trade

Settle these before any agent can place orders. Each point links to the page we opened.

• The MCP spec says there SHOULD always be a human in the loop with the ability to deny tool invocations, and clients should show confirmation prompts for operations.MCP specification 2025-06-18: ToolsChecked 18 Sep 2026
• The MCP spec says clients SHOULD prompt for user confirmation on sensitive operations and show tool inputs to the user before calling the server.MCP specification 2025-06-18: ToolsChecked 18 Sep 2026
• The MCP spec says clients MUST treat tool annotations as untrusted unless they come from trusted servers, so a server labelling a tool read-only is not a guarantee.MCP specification 2025-06-18: ToolsChecked 18 Sep 2026
• The MCP spec says servers MUST validate inputs, implement access controls, rate limit tool invocations and sanitise outputs.MCP specification 2025-06-18: ToolsChecked 18 Sep 2026
• IBKR states that AI instructions never become orders automatically; the client reviews and submits every order, and IBKR is not responsible for decisions taken on AI generated information.IBKR: AI integrationsChecked 18 Sep 2026
• eToro warns that automated or AI enabled tools may result in rapid and substantial financial losses, including loss of the entire investment, and orders are executed on an execution-only basis.eToro Builders: MCP serverChecked 18 Sep 2026
• Capital.com's MCP README says use of its Public API is at your own risk and Capital.com does not endorse or take responsibility for third party software or its outcomes.GitHub: capital-com-sv/capital-mcpChecked 18 Sep 2026
• MetaTrader 5 lets users allow or prohibit AI initiated trading operations or require manual confirmation.MT5 Build 6060 release notesChecked 18 Sep 2026
• cTrader says every trading tool surfaces symbol, volume, price, SL/TP and account impact, and you confirm before anything fires.cTrader: MCP server for tradingChecked 18 Sep 2026
• The IG Australia AI assistant uses OAuth so the IG username and password are never shared with ChatGPT or Claude, and it cannot place or amend trades. IG publishes it for IG Australia only.IG AU: AI assistantChecked 18 Sep 2026
• The MCP specification's own security page, at dated revision 2026-07-28, says MCP servers MUST NOT accept any tokens that were not explicitly issued for the MCP server. That forbids token passthrough, which is the shortcut a connector takes when it hands a token issued for something else straight through to your broker.MCP specification 2026-07-28: security best practicesChecked 19 Sep 2026
• The same page says proxy servers MUST implement per-client consent, so a proxy in front of a broker connector cannot reuse one approval across every client that reaches it.MCP specification 2026-07-28: security best practicesChecked 19 Sep 2026
• The same page warns against wildcard or omnibus scopes such as *, all or full-access, and recommends a minimal initial scope set containing only low-risk discovery and read operations, with elevation requested later and only when a job needs it.MCP specification 2026-07-28: security best practicesChecked 19 Sep 2026
• For a local MCP server the same page requires the client to show the exact command that will be executed, without truncation, before it runs, and recommends sandboxing, because a local server runs with the privileges of the client that launched it.MCP specification 2026-07-28: security best practicesChecked 19 Sep 2026

The specification's own rules, and one credential audit against them

The MCP specification has a dated revision, 28 Jul 2026, and its security page carries requirements at MUST level. Those requirements stay abstract until you hold them against a connector people actually install, so that is what this section does.

What the specification requires

• The MCP specification's own security page, at dated revision 2026-07-28, says MCP servers MUST NOT accept any tokens that were not explicitly issued for the MCP server. That forbids token passthrough, which is the shortcut a connector takes when it hands a token issued for something else straight through to your broker.
• The same page says proxy servers MUST implement per-client consent, so a proxy in front of a broker connector cannot reuse one approval across every client that reaches it.
• The same page warns against wildcard or omnibus scopes such as *, all or full-access, and recommends a minimal initial scope set containing only low-risk discovery and read operations, with elevation requested later and only when a job needs it.
• For a local MCP server the same page requires the client to show the exact command that will be executed, without truncation, before it runs, and recommends sandboxing, because a local server runs with the privileges of the client that launched it.

Source: MCP specification 2026-07-28: security best practices checked 19 Sep 2026

The most installed FX MCP server, measured against those rules

ariadng/metatrader-mcp-server carries 808 GitHub stars and was last pushed on 28 Mar 2026. It is MIT licensed and carries its own explicit loss disclaimer, so it is honest about what it is. It takes the raw MetaTrader 5 login, password and broker server from a .env file or from command line arguments, in the shape LOGIN=..., PASSWORD=..., SERVER=MetaQuotes-Demo. On a live account that is a plaintext password sitting on disk, readable by any process running with your privileges, on exactly the machine the specification flags as an attack target. The design is the problem here, not the author.

Source: GitHub: ariadng/metatrader-mcp-server, MCP specification 2026-07-28: security best practices checked 19 Sep 2026

Scope of this auditThis is the only repository whose README we opened on this reading. Every other credential posture named on this page is unverified: we are reporting what a repository description says, not what its code does.

Where people are actually installing from

Stars are not installs. These are the download counters, all read on 19 Sep 2026.

• PyPI: metatrader-mcp-server45 downloads in the last day, 354 in the last week, 2,772 in the last month.pypistats.org
• PyPI: mcp-metatrader5-server13 in the last day, 75 in the last week, 440 in the last month.pypistats.org
• npm: interactive-brokers-mcp2,310 downloads for 18 August to 16 Sep 2026.api.npmjs.org

Every safer read only alternative we found sits between 0 and 3 stars. That is the point worth making: the guidance has to meet people at the server they are already running, not at the one we would prefer they ran.

Safer postures we observed

Each line below is taken from the repository description, not from a README anyone opened, so treat all of them as unverified.

• chongkwongsheng/saxo-mcpSIM default, gated writes
• SimonTarara62/capitalcom-mcp-servertwo-phase, allowlists, demo-first
• Blahaj-gif/Finance-mcporder execution behind a human approval step
• jgalea/saxo-mcpread only
• aobathree/oanda-mcpread only
• Erfangit23/mt5-mcp-serverdry run on by default

What changed hereWhat changed in the checklist beside this guide. The seven points that were there are unchanged. Four have been added, drawn from the specification revision above: do not accept a connector that passes a token through, refuse a wildcard scope, read the exact local command before it runs, and keep a live broker password out of a .env file.

Questions about AI and broker APIs

Is it safe to connect an AI like Claude to my live trading account?

Not as a first step. Start read only on a demo account and never give an agent unsupervised order tools. The broker-backed servers differ: IG's own page for Australian clients says its assistant is read only, IBKR's server drafts trade instructions that you submit yourself, and cTrader, MetaTrader 5 and Capital.com's capital-mcp can place orders. Capital.com's runs a two phase preview and confirmation, MetaTrader 5 lets you allow, block or require confirmation, and on cTrader a confirmation requirement for trading operations exists in MCP settings and it is optional. The MCP specification says there should always be a human in the loop who can deny tool calls.

Can the Capital.com MCP server place trades?

Only if you switch trading on. capital-mcp, published on Capital.com's own GitHub organisation, has trading off by default and uses the demo environment by default; setting CAP_ALLOW_TRADING=true enables trading. Trades then go through a preview, confirm and execute flow with allowlists, size limits and daily order caps.

Agent Skills: the first release we have found from a platform vendor in scope

Spotware publishes an official Agent Skills repository, spotware/ctrader-skills, with two skills: ctrader-cli and ctrader-mcp-servers, the latter carrying five helper scripts for pip maths and position sizing. It targets any agent that supports the Agent Skills specification, including Claude Code, Cursor, Windsurf, Codex, Cline and OpenCode, and ships a native Claude Code plugin as well. It stood at roughly 6 stars when we looked.

LicenceThe licence is proprietary under the Spotware EULA, not an open source licence. That matters if you plan to fork, vendor or redistribute the skills: read the EULA before you do. Most repositories in this space are MIT or Apache, and this one is not.

This is the first Agent Skills release by an in-scope retail platform vendor that we have found. We are not claiming it is the first that exists.

Source: GitHub: spotware/ctrader-skills checked 19 Sep 2026

Two secondary sources, wrong in opposite directions

Both of these are widely read and both are careful pieces of work. Both are also wrong about a fact that a first party page settles in one sentence, and they are wrong in opposite directions. We are recording it because it is the whole argument for opening the vendor's own page: a round-up ages, and nothing inside it tells you when it did.

1. LeapRate states that MetaQuotes has no official MCP equivalent.MetaQuotes' own release notes documented native MCP in MetaTrader 5 build 6060 on 23 Jul 2026, two months before this reading. We already publish this correction in full on the MetaTrader 5 page, so it is not restated here.The correction, on the MetaTrader 5 pageSourceLeapRate: broker MCP and AI agent infrastructure race, MetaQuotes news 5538: MetaTrader 5 build 6060 checked 19 Sep 2026
2. StockBrokers.com lists eToro as having no official MCP server.eToro publishes one, on its own builders site. Be fair about what it is: a documentation server exposing only get-all-routes and get-route-spec, not a trading server. So the round-up is wrong on the fact and right on the practical answer, which is that an eToro MCP server will not trade for you.SourceStockBrokers.com: AI agent brokers, eToro Builders: MCP server checked 19 Sep 2026

First party pages beat secondary reporting, and that is all this shows. Neither publisher had a reason to be wrong: one wrote before MetaTrader 5 build 6060 shipped, the other read a broker site that does not mention a server published on a separate developer domain. We checked both on 19 Sep 2026 and will check them again.

What StockBrokers.com found, attributed to them

These are their figures and their quotes from a survey we did not repeat. We are recording them as theirs, not as our own test.

• They tested 14 brokers. Seven had a first party MCP server: Interactive Brokers, Webull, tastytrade, Moomoo, Robinhood, Public.com and TradeStation.
• Seven had none: eToro, Schwab, E*TRADE, Fidelity, Ally Invest, Firstrade and Merrill Edge. Our own reading of eToro's builders site disagrees with the eToro row, as above.
• All seven of the servers they found launched during 2026, tastytrade in September 2026.
• tastytrade requires a dry run confirmation token before an order can be submitted.
• Their quoted warnings: from Robinhood, agents can move quickly and may be difficult to monitor; from Public.com, executed transactions cannot be reversed; from tastytrade, you are responsible for any unattended trading.

Source: StockBrokers.com: AI agent brokers checked 19 Sep 2026

How much of this actually exists, counted

Repository counts read from the GitHub search API on 19 Sep 2026. These are counts of repositories and not search volumes, and an unauthenticated search index can lag the repository pages.

A generic tradingview-mcp sits at 4,574 stars, an order of magnitude above every broker specific MCP server we have found. That is an honest point about where the traffic actually is: charts and indicators, not accounts.

Source: GitHub search API, total_count readings, GitHub: LLMQuant/awesome-trading-agents checked 19 Sep 2026

Confirmation is a default, not a feature

Almost every broker agent page answers the question does confirmation exist, and almost every answer is yes. That question is the wrong one. Ask instead: is confirmation on by default, and can I turn it off? Those two answers decide what happens on the day you are not watching, and the field splits five ways on them.

• On by default, and you cannot turn it offThe band to preferCapital.com's local server cannot be talked past: a preview returns a preview_id, and you then say execute with that preview_id and confirm true. Capital.com's wording is that a trade can't be placed without a valid preview_id. tastytrade uses a mandatory dry run confirmation token, and TradeStation enforces explicit confirmation on every order. The tastytrade and TradeStation readings come from an independent tested comparison, not from the brokers' own pages.Source How to set up the Capital.com MCP Server, Capital.com, Best Brokers for AI Trading Agents in 2026: MCP Tested, StockBrokers.com, checked 23 Sep 2026
• On by default, because there is no order path at allSafe by constructionIG Australia's assistant is read only: IG's wording is that its MCP app is strictly read-only, and your AI can view your account data but cannot place trades, amend orders, change settings, or take any action on your account. Interactive Brokers drafts and stops: instructions never become orders automatically. eToro's hosted MCP server, Deriv's hosted plugin, TradingView's server and LuxAlgo's hosted MCP never reach an account.Source AI assistant, IG AU, AI-Powered Portfolio Analysis and Trading Tools, Interactive Brokers LLC, deriv-com/deriv-api-plugin, Deriv, MCP server, eToro Builders, checked 23 Sep 2026
• Off by default, and you have to switch it onThe one to check before you connectcTrader is the case that makes the distinction worth drawing. Its help centre says that when trading is enabled the AI agent can place, modify and close real orders on your behalf, and offers the remedy: tick Require confirmation for trading operations in the local MCP server settings, or configure your AI client to confirm tool calls. A tick box is off until ticked. ctrader.com, meanwhile, says you confirm before anything fires, with no setting mentioned. If you read the marketing page and connect, you are trading without the step you think you have.Source AI Agent Connect FAQ, cTrader help centre, MCP server for trading, cTrader, checked 23 Sep 2026
• Your choice, made once, at the platformMetaTrader 5MetaTrader 5 puts the decision in the terminal rather than in the server: you explicitly allow or prohibit AI-initiated trading operations, or require manual confirmation, with separate controls on AI network requests and command line operations. MCP arrived in build 6060 of 23 Jul 2026. The current build is 6180 of 3 Sep 2026.Source MetaTrader 5 release notes, MetaQuotes, checked 23 Sep 2026
• No confirmation step published at allRead the wording, not the reassuranceBitget: once authorized by you, agents can place spot and futures orders, configure leverage, and manage margin modes, with no confirmation mechanism documented. Dukascopy places orders from plain language, on demo accounts only for now. ThinkMarkets' ChelseaAI executes, with circuit breakers and an analysis only mode but no confirmation. eToro's Agent Skills teach an agent to authenticate, trade, and query, and eToro's own words are that you are solely responsible for all trades, orders, and financial outcomes, and that automated or AI-enabled tools may result in rapid and substantial financial losses. Public.com's agentic brokerage runs unattended once approved with no caps you set.Source Bitget MCP server, Bitget, Trade with AI. From your favorite chat, Dukascopy Bank, ThinkMarkets launches MCP server, Finance Magnates, 1 Jun 2026, Agent Skills, eToro Builders, Best Brokers for AI Trading Agents in 2026: MCP Tested, StockBrokers.com, checked 23 Sep 2026

Three questions to ask a broker agent page, in this order. Is there a confirmation step? Is it on when I install it? Can I be talked out of it by the agent, or only by myself in a settings pane? A page that answers only the first is not telling you what you need.

Two standing rules sit underneath all of this, and neither mentions AI. OANDA’s API Licence Agreement of April 2026 requires that an ATS must be fully verified and tested in the OANDA Demo environment prior to its use in the OANDA Platform, says an ATS used on the OANDA Platform should not be left to run unattended, and limits use to your own use, with the platform not to be used by any other person. Saxo issues LIVE credentials only to a direct retail or professional client of Saxo Group seeking an application for personal usage or for usage within your own entity. Trading 212 warns that sharing your API keys with third-party applications involves potential risks and that it has no official partnerships with any third-party apps. None of the three mentions AI, agents or MCP.Source OANDA API Licence Agreement, April 2026, Request LIVE OpenAPI application credentials, Saxo, Trading 212 API key, Trading 212 help centre, checked 23 Sep 2026

This site is independent and unofficial. It is not affiliated with, endorsed by or operated by any firm named on it, it uses no broker logo or trade dress, and it never asks anyone for a broker credential. Nothing here is advice or an endorsement, and none of these links is an affiliate link.