What is an MCP server for trading?

A program that exposes a trading account to an AI assistant through the Model Context Protocol, so the assistant can read prices and, in most cases, place orders. Some are run by the broker or venue, some are community projects you host yourself, and some only read market data.

Do I have to give an AI agent my private key?

Not unless you choose a server that requires one. Hosted servers from brokers and venues use OAuth and no secret touches your machine. Every open-source Hyperliquid server in this comparison asks for a raw private key in a file, which is the one credential you cannot rotate after a leak.

Can an AI agent withdraw my money?

It depends on the server. Most block it: Robinhood’s agent cannot transfer, Coinbase’s Transfer permission cannot reach an external address, and Fensory’s key cannot sign a withdrawal. Kraken’s CLI is the exception here, where enabling the funding service lets an agent initiate withdrawals unless you scope the API key to prevent it.

What stops an AI agent from placing an order that is too big?

On most of this field, nothing but the account balance. Two products here document a cap you can set on a single order: Webull and Fensory. Everywhere else the answer is to fund a separate account with only what you are prepared to lose, which is what several vendors tell you to do in their own setup guides.

Are these servers safe to use?

The software is the smaller risk. The bigger ones are a credential in a file that something else can read, an agent acting on a misread instruction, and an abandoned project nobody is patching. Check when the code last changed, check what the account enforces rather than what the model is asked to do, and fund it accordingly.

Best MCP servers for trading, compared on custody and limits

Eleven ways to give an AI assistant a trading account, compared on where your credential ends up, what stops an order the agent should not have placed, and whether the code is still maintained. Two data-only servers are listed separately, because a server that cannot trade is not an alternative to one that can. Fensory publishes this page and appears in it, and is not available to US persons.

Ribhav Modi, Growth at Fensory. Checked each product against its own documentation and, where the project is open source, against the GitHub API.

Published 2026-09-16. Every entry checked on 2026-09-16. Fensory appears in this comparison and sells a trading account.

The comparison

Trading MCP servers compared on custody, credentials, execution, limits, availability and maintenance
Server	Who holds the funds	Credential on your machine	Places the order	What stops a bad order	Where you can open it	Maintained
Alpaca MCP Server	Alpaca Securities, in your brokerage account	API key and secret, in your client config	Executes	None documented. Paper trading is the default and live trading is an explicit switch	Not documented for the MCP server	Active. Last push 15 September 2026, 962 stars, MIT
Coinbase for Agents	Coinbase, in an isolated portfolio	None on the hosted endpoint. OAuth. A CDP key for the CLI path	Executes	Portfolio scoping, separate Trade and Transfer permissions where Transfer cannot reach an external address, and revoking the connection. Maximum trade sizes and daily limits are named on one Coinbase page but not documented anywhere we could find	Not documented for the agent product	Active, hosted. Expanded 10 September 2026
Robinhood Agentic Trading	Robinhood, in a separate Agentic account	None. OAuth, you paste a URL	Executes, and can place trades without confirming each one if you ask it to	The balance of the Agentic account, and disconnect in the app. No per-order cap and no symbol list	United States only. Crypto is unavailable in some states, including New York	Active, hosted. Crypto added July 2026
TradeStation MCP	TradeStation Securities	None. OAuth, hosted by TradeStation	Executes, after an explicit confirmation	Per-tool consent and order confirmations. A $10,000 minimum balance instead of a cap	Not documented	Active, hosted. ChatGPT support documented July 2026
Webull	Webull Financial	None on the hosted server. App key and secret on the self-hosted one	Executes on the agentic product and the self-hosted server. The hosted cloud server cannot place an order	Order size and value caps, a symbol allow-list, an optional read-only mode, order preview and disconnect	US at launch. The self-hosted server documents nine regions including the UK, Japan and Singapore	Active. Self-hosted repo last pushed 12 September 2026, Apache 2.0
Kraken CLI	Kraken	API key and secret, in environment variables or a local config file	Executes once the trade service is enabled	Service-group gating, a dangerous-operation acknowledgement the CLI enforces itself, and position limits set at the API-key level	Not stated in the MCP documentation	Active, open source under MIT
Phantom MCP	A dedicated wallet, with Phantom’s key service signing	None. Browser sign-in on first use	Executes	A simulation-first convention on transfers and transactions, which the agent follows rather than the account enforcing. The segregated wallet is the real boundary	Not documented	Live, but the public repository has not moved since 28 April 2026. Development is internal
Open-source Hyperliquid servers	You, in your own Hyperliquid account	A raw private key in a file. All seven of them	Executes	None enforced by any of them. Every one offers advice in the README instead	Self-hosted, so whatever Hyperliquid allows	Two are current: hypurrquant, last commit 4 September 2026, and erscoder, 22 August. GigabrainGG’s main branch last moved 17 January 2026, 0xikalgo in March, caiovicentino in November 2025, edkdev in October 2025, Impa-Ventures in March 2025
Walnut	Your existing broker. Walnut holds nothing	None. OAuth	Drafts. You confirm each order in Walnut	The human confirmation step. No cap or allow-list documented	US brokerage accounts	Live, hosted, closed source
Composer MCP	Composer, in your account there	API key and secret in your client config	Executed	Dry-run preview tools. No cap or allow-list	US	Gone. The repository returns 404, the last release was 14 July 2025, and the advertised remote endpoint does not resolve
FensoryOurs	You. Tokens settle to a wallet you control, perp margin sits at the venue	None. OAuth through a Fensory account	Executes	Kill-switch, market allow-list and a per-order cap, all enforced on the account. An order above the cap is rejected rather than trimmed	Not available to US persons	Active, hosted
Alpha Vantage MCPData only	None. No account, no funds	None on the recommended hosted path, which authorises your API key in a browser	Read-only	Rate limits only. The free tier is 25 requests a day, which one conversation can spend	Not restricted	The healthiest project here. Last push 30 August 2026, 210 stars, MIT
Shibui FinanceData only	None	None at all. Paste the URL	Read-only	Nothing to limit	Not restricted	Live. Closed source, and run by one person on one server

Two questions decide this, and most comparisons answer neither

The first is where your credential ends up. Four models exist. A hosted server signs you in with OAuth and no secret touches your disk. A broker mints you an API key that you paste into a config file, which is revocable if it leaks. A local server holds an exchange secret on your machine. Or you paste a raw blockchain private key into a file, which is not revocable at all: whoever reads that file owns the wallet.

Every open-source Hyperliquid server in this comparison, all seven of them, is in that last category. A leaked brokerage key can be rotated in a minute and the damage stops there. A leaked private key means the wallet is emptied and there is nothing to revoke, which is why that distinction outranks every feature in the table.

The second question is what happens when the agent gets it wrong. Of the eleven execution servers here, two document a cap you can actually set on a single order: Webull and Fensory. Coinbase names maximum trade sizes and daily limits on one page but does not document how to set them, and its own setup guide tells you to fund a separate portfolio to limit the blast radius instead. Robinhood, Alpaca and every open-source Hyperliquid server have no cap at all, so the real limit is how much money sits in the account.

The servers that can place an order

Alpaca MCP Server

Built by the venue

The official server from Alpaca, a US broker-dealer, covering US equities, options and crypto. Open source under MIT and self-hosted. Its launch post is dated 20 November 2025, which makes it the oldest of the brokerage servers by about two months.

What it reaches: US equities and ETFs, options, crypto
Cost: Free server, commission-free US equities and options

Choose this if: You want US equities, ETFs and options including multi-leg spreads, you are comfortable holding your own API keys, and you want to run against a paper account first. It is also the only broker server here you can read end to end before you run it.

Worth knowing: Several forks copy the official repo tagline word for word; only the alpacahq repository is Alpaca’s. With no per-order cap, the protection while testing is the paper-trading default, not a limit.

Alpaca docs

Coinbase for Agents

Built by the venue

A hosted MCP endpoint into an isolated Coinbase Advanced portfolio, launched 11 June 2026, reaching spot crypto, US derivatives and S&P 500 equities. Trade and Transfer are separate permissions, and Transfer moves funds only between your own portfolios.

What it reaches: Spot crypto, US futures, S&P 500 equities
Cost: No product fee. Standard Advanced maker and taker tiers

Choose this if: You are already on Coinbase, you want a hosted connection with no key in a file, and you are willing to bound the damage by funding a separate portfolio, which is what Coinbase’s own documentation tells you to do.

Worth knowing: Coinbase has published no country list for this product, so a non-US reader cannot tell from the documentation whether it is open to them. Coinbase also notes that extended-thinking modes sometimes draft an order and stop short of placing it.

Coinbase docs

Robinhood Agentic Trading

Built by the venue

Robinhood’s own MCP server, announced 27 May 2026, reached through a dedicated Agentic account that is separate from your main one. Setup is pasting one URL and signing in. The agent can trade but cannot transfer, stake or lend, and margin is not enabled on the agentic account.

What it reaches: US equities and crypto. The marketing page also names options
Cost: No separate fee documented

Choose this if: You are in the United States, you already use Robinhood, and you want the shortest setup here. Funding the Agentic account with a fixed amount is how you bound it.

Worth knowing: How much the agent can spend is decided entirely by what you put in that account. Robinhood’s support article and its product page also disagree on whether options are included.

Robinhood support

TradeStation MCP

Built by the venue

The first brokerage MCP connection, announced 13 January 2026, covering stocks, ETFs, options and futures. Access needs an eligible balance of at least $10,000 and a paid Claude or ChatGPT subscription, and each tool is granted or denied the first time it runs.

What it reaches: Stocks, ETFs, options, futures and futures options
Cost: No MCP fee. Commissions, a paid AI subscription, possible market data costs

Choose this if: You trade futures as well as equities, you want a confirmation in front of every order, and you prefer granting access one tool at a time instead of all at once.

Worth knowing: The only entry here that requires both a paid AI subscription and a five-figure balance. Two community repositories use the TradeStation name and are not connected to the official service.

TradeStation

Webull

Built by the venue

Three separate things share this name: a hosted cloud MCP server that is read-only, a self-hosted open-source server with full trading that documents nine regions, and the consumer Agentic Trading product. The MCP server went public on 11 June 2026.

What it reaches: Equities, options, futures, event contracts and crypto
Cost: Not documented

Choose this if: You want the strongest documented controls of any broker here. It is the only brokerage product that lets you cap order size and value and restrict trading to a list of symbols, which is the control most of this field is missing.

Worth knowing: Work out which of the three you are using. The cloud server cannot trade at all, and the self-hosted one runs against a sandbox until you switch it to production.

Webull agentic trading

Kraken CLI

Built by the venue

A command-line tool with a built-in MCP server, open source under MIT, reaching Kraken spot, futures and the xStocks tokenized equities. The default service set is read-only for live funds, and a local paper-trading engine runs with no credentials at all.

What it reaches: Spot, perpetual and dated futures, xStocks tokenized equities, forex, staking
Cost: Free and open source

Choose this if: You want a local tool you can inspect, a genuine paper mode that needs no credentials, and confirmation enforced by the tool itself rather than by whatever the model decided to do.

Worth knowing: The only server here where the agent can reach withdrawals: enabling the funding service lets it initiate them, gated only by the acknowledgement flag. Scope the API key to exclude withdrawal, or do not enable that group.

Kraken MCP docs

Phantom MCP

Built by the venue

Phantom’s own server, first published in February 2026. Signing in creates a new dedicated wallet, not your personal one, and Phantom’s key service signs under policy. Swaps run across Solana, Ethereum and Bitcoin, and perpetual futures run on Hyperliquid.

What it reaches: Solana, Ethereum and Bitcoin swaps, Hyperliquid perpetual futures
Cost: No Phantom swap fee documented

Choose this if: You want on-chain trading with no key in a config file at all, and you are happy for the blast radius to be whatever you fund the agent wallet with. It is the cleanest key story in the on-chain half of this field.

Worth knowing: No per-order cap, allow-list or kill-switch is documented. The transaction preview is a convention the agent is asked to follow, not a control that refuses anything.

Phantom docs

Open-source Hyperliquid servers

Community projects

Seven community servers that wrap the Hyperliquid API and can place an order: edkdev, 0xikalgo (Rust), Impa-Ventures, GigabrainGG, erscoder, caiovicentino and hypurrquant, whose CLI also reaches other venues. Free, self-hosted, and none is affiliated with Hyperliquid. Read-only servers are excluded, which is why kukapay and mektigboy are not here.

What it reaches: Hyperliquid perpetual futures and spot
Cost: Free

Choose this if: You want to read every line of what signs your orders, you are trading Hyperliquid, and you can manage key hygiene yourself. Of the seven, hypurrquant is the one we would start from: MIT licensed, the most recent commit of the set, and 36 stars. erscoder is worth reading for its pattern, a documented read-only mode that needs no private key at all, so removing the key disarms the write tools.

Worth knowing: A leaked private key cannot be rotated the way an API key can. 0xikalgo asks for your main wallet key on disk in step two while warning you in the same README never to use your main wallet. GigabrainGG and erscoder carry no licence, which means all rights reserved, and erscoder has no stars or forks, so the pattern is worth copying even where the repository is not worth depending on. Check the package name before installing: erscoder’s README points at a PyPI package belonging to a different author.

erscoder/hyperliquid-mcp

Walnut

Built by the venue

A hosted connector that links US brokerage accounts through a regulated integration provider. Walnut never holds funds and your brokerage credentials never reach it. Every order is confirmed by you in Walnut’s own dialog rather than by the agent.

What it reaches: US equities and ETFs through linked brokerage accounts
Cost: Free, with no paid tier

Choose this if: You want your assistant to do the research and the reasoning while a human stays on the trigger, and you would rather not give any agent the ability to place an order at all.

Worth knowing: It is not an execution server in the sense the rest of this list is. Nothing trades without your click.

Walnut

Composer MCP

Built by the venue

Listed here because directories still recommend it. It connected an assistant to Composer’s automated strategies. The package is still installable and the company is trading normally, but the MCP product looks retired.

What it reaches: US equities, ETFs and crypto through automated strategies
Cost: Server free, trading needed a paid Composer plan

Choose this if: Nothing today. It is on this page so that a reader who found it recommended elsewhere can see what we found when we checked.

Worth knowing: Several directories still list it as current. Verified on 16 September 2026: it is not.

PyPI package

Fensory

OursBuilt by the venue

Our own. A hosted MCP server into a non-custodial account spanning tokenized US stocks and treasuries, gold, crypto spot and perpetual futures, with a kill-switch, a market allow-list and a per-order cap set on the account.

What it reaches: Tokenized US equities and treasuries, gold, crypto spot, perpetual futures
Cost: Free to connect. 0.01% to 0.05% on perpetual futures and Hyperliquid spot, nothing on tokenized equities, yields or bridging

Choose this if: You are outside the US, you want the cap and the allow-list enforced on the account rather than asked of the model, and you want one account that reaches tokenized equities and perpetual futures rather than two.

Worth knowing: Not available to US persons, which rules it out for a large share of this page’s readers. The cap is per order and not a limit on total losses, so orders inside your limits can still lose money.

The Fensory MCP server

Data servers, which cannot

Listed apart because they are not alternatives to the servers above. They read market data and have no account behind them, which makes them a sensible thing to run alongside one.

Alpha Vantage MCP

Built by the venue

The official Alpha Vantage server: prices, fundamentals, earnings, news sentiment, screeners, technical and macro indicators across global stocks, forex, crypto and commodities. It cannot place an order.

What it reaches: Global equities, forex, crypto, commodities, macro data
Cost: Free tier, then paid API plans

Choose this if: You want your assistant to research well before anything touches an order. Run it alongside an execution server; the two do different jobs.

Worth knowing: The legacy setup puts your API key in the URL, which leaks into logs. Use the hosted path.

GitHub repo

Shibui Finance

Built by the venue

A hosted, free, credential-free server over decades of US end-of-day equity data, financials, technical indicators and SEC filing records. No account and nothing to place an order with.

What it reaches: US equities, NYSE and NASDAQ, end of day
Cost: Free

Choose this if: You want long-history US equity data in an assistant with the shortest possible setup, and end-of-day data is enough.

Worth knowing: End of day only, so no intraday and no real-time. One maintainer is a real dependency to weigh.

Shibui Finance

How we checked

The field is every MCP server we could find that an assistant can use to place a real trade, plus the two data-only servers people most often confuse with them. Data servers are listed separately and are not ranked against execution servers, because a server that cannot place an order is not competing with one that can.

The community Hyperliquid servers were drawn from a GitHub search on name and description, sorted by stars and read on 16 September 2026. Everything that can place an order is in the entry; the read-only ones are named and excluded. If you know of one we have missed that can trade, it belongs here and we would rather add it than defend a shorter list.

Every factual cell was read on the vendor’s own documentation or repository on 16 September 2026, never from another roundup. Where a vendor page refused to load, we left the claim off the page rather than sourcing it to a summary of that page.

Repository figures come from the GitHub API, not a directory listing: stars, the archived flag, and the last commit on the default branch. That last detail matters, because a repository can show recent activity from a branch that was never merged. One server in this comparison looks five months fresher than it is for exactly that reason.

Fensory publishes this page and appears in it. We sell a trading account, which is a conflict worth stating: it is why the comparison is on documented custody, credentials, limits and maintenance rather than on a score we assign.

Questions people ask

What is an MCP server for trading?: A program that exposes a trading account to an AI assistant through the Model Context Protocol, so the assistant can read prices and, in most cases, place orders. Some are run by the broker or venue, some are community projects you host yourself, and some only read market data.
Do I have to give an AI agent my private key?: Not unless you choose a server that requires one. Hosted servers from brokers and venues use OAuth and no secret touches your machine. Every open-source Hyperliquid server in this comparison asks for a raw private key in a file, which is the one credential you cannot rotate after a leak.
Can an AI agent withdraw my money?: It depends on the server. Most block it: Robinhood’s agent cannot transfer, Coinbase’s Transfer permission cannot reach an external address, and Fensory’s key cannot sign a withdrawal. Kraken’s CLI is the exception here, where enabling the funding service lets an agent initiate withdrawals unless you scope the API key to prevent it.
What stops an AI agent from placing an order that is too big?: On most of this field, nothing but the account balance. Two products here document a cap you can set on a single order: Webull and Fensory. Everywhere else the answer is to fund a separate account with only what you are prepared to lose, which is what several vendors tell you to do in their own setup guides.
Are these servers safe to use?: The software is the smaller risk. The bigger ones are a credential in a file that something else can read, an agent acting on a misread instruction, and an abandoned project nobody is patching. Check when the code last changed, check what the account enforces rather than what the model is asked to do, and fund it accordingly.

Open the app The Fensory MCP server How the limits work