What is an MCP server for trading?

A program that exposes a trading account to an AI assistant through the Model Context Protocol, so the assistant can read prices and, in most cases, place orders. Some are run by the broker or venue, some are community projects you host yourself, and some only read market data.

Do I have to give an AI agent my private key?

Not unless you choose a server that requires one. Hosted servers from brokers and venues use OAuth and no secret touches your machine. Every open-source Hyperliquid server in this comparison asks for a raw private key in a file, which is the one credential you cannot rotate after a leak.

Can an AI agent withdraw my money?

It depends on the server. Most block it: Robinhood’s agent cannot transfer, Coinbase’s Transfer permission cannot reach an external address, and Fensory’s key cannot sign a withdrawal. Kraken’s CLI is the exception here, where enabling the funding service lets an agent initiate withdrawals unless you scope the API key to prevent it.

What stops an AI agent from placing an order that is too big?

On most of this field, nothing but the account balance. Two products here document a cap you can set on a single order: Webull and Fensory. Everywhere else the answer is to fund a separate account with only what you are prepared to lose, which is what several vendors tell you to do in their own setup guides.

Are these servers safe to use?

The software is the smaller risk. The bigger ones are a credential in a file that something else can read, an agent acting on a misread instruction, and an abandoned project nobody is patching. Check when the code last changed, check what the account enforces rather than what the model is asked to do, and fund it accordingly.

Best MCP servers for trading, compared on custody and limits

Eleven ways to give an AI assistant a trading account, compared on where your credential ends up, what stops an order the agent should not have placed, and whether the code is still maintained. Two data-only servers are listed separately, because a server that cannot trade is not an alternative to one that can. Fensory publishes this page and appears in it, and is not available to US persons.

Published 2026-09-16, last edited 2026-09-22. Every competitor claim was read against its own source on 2026-09-22. The page is re-checked when a source changes and at least quarterly. Fensory appears in this comparison and sells a trading account.

The comparison

Trading MCP servers compared on custody, credentials, execution, limits, availability and maintenance
Server	Who holds the funds	Credential on your machine	Places the order	What stops a bad order	Where you can open it	Maintained
Alpaca MCP Server	Alpaca Securities, in your brokerage account	API key and secret, in your client config	Executes	None documented. Paper trading is the default and live trading is an explicit switch	Not documented for the MCP server	Active. Last push 15 September 2026, 962 stars, MIT
Coinbase for Agents	Coinbase, in an isolated portfolio	None on the hosted endpoint. OAuth. A CDP key for the CLI path	Executes	Portfolio scoping, separate Trade and Transfer permissions where Transfer cannot reach an external address, and revoking the connection. Maximum trade sizes and daily limits are named on one Coinbase page but not documented anywhere we could find	Not documented for the agent product	Active, hosted. Expanded 10 September 2026
Robinhood Agentic Trading	Robinhood, in a separate Agentic account	None. OAuth, you paste a URL	Executes, and can place trades without confirming each one if you ask it to	The balance of the Agentic account, and disconnect in the app. No per-order cap and no symbol list	United States only. Crypto is unavailable in some states, including New York	Active, hosted. Crypto added July 2026
TradeStation MCP	TradeStation Securities	None. OAuth, hosted by TradeStation	Executes, after an explicit confirmation	Per-tool consent and order confirmations. A $10,000 minimum balance instead of a cap	Not documented	Active, hosted. ChatGPT support documented July 2026
Webull	Webull Financial	None on the hosted server. App key and secret on the self-hosted one	Executes on the agentic product and the self-hosted server. The hosted cloud server cannot place an order	Order size and value caps, a symbol allow-list, an optional read-only mode, order preview and disconnect	US at launch. The self-hosted server documents nine regions including the UK, Japan and Singapore	Active. Self-hosted repo last pushed 12 September 2026, Apache 2.0
Kraken CLI	Kraken	API key and secret, in environment variables or a local config file	Executes once the trade service is enabled	Service-group gating, a dangerous-operation acknowledgement the CLI enforces itself, and position limits set at the API-key level	Not stated in the MCP documentation	Active, open source under MIT
Phantom MCP	A dedicated wallet, with Phantom’s key service signing	None. Browser sign-in on first use	Executes	A simulation-first convention on transfers and transactions, which the agent follows rather than the account enforcing. The segregated wallet is the real boundary	Not documented	Live, but the public repository has not moved since 28 April 2026. Development is internal
Open-source Hyperliquid servers	You, in your own Hyperliquid account	A raw private key in a file. All seven of them	Executes	None enforced by any of them. Every one offers advice in the README instead	Self-hosted, so whatever Hyperliquid allows	Two are current: hypurrquant, last commit 4 September 2026, and erscoder, 22 August. GigabrainGG’s main branch last moved 17 January 2026, 0xikalgo in March, caiovicentino in November 2025, edkdev in October 2025, Impa-Ventures in March 2025
Walnut	Your existing broker. Walnut holds nothing	None. OAuth	Drafts. You confirm each order in Walnut	The human confirmation step. No cap or allow-list documented	US brokerage accounts	Live, hosted, closed source
Composer MCP	Composer, in your account there	API key and secret in your client config	Executed	Dry-run preview tools. No cap or allow-list	US	Gone. The repository returns 404, the last release was 14 July 2025, and the advertised remote endpoint does not resolve
OKX Agent Trade Kit	OKX, in your exchange account	API key, secret and passphrase in your client config, on your machine	Executes, including conditional, OCO and trailing-stop algo orders	A read-only flag and per-module filtering, so you can expose market data without trading. No cap on the size of a single order, and no kill-switch that survives the config	Not documented in the repository	Active. Last push 14 September 2026, 438 stars, MIT
Bybit MCP Server	Bybit, in your exchange account	API key and secret read from environment variables at runtime	Executes	A read-only mode: all 23 market-data tools work with no API key at all. POV execution refuses to run without a positive quantity or value limit, and OneTime execution is withheld over MCP because the API ignores those limits in that mode	Not documented in the repository	Active. Last push 22 September 2026, 34 stars, MIT
Gate MCP	Gate, in your exchange account. The DEX surface is a separate wallet	None in a file. OAuth2, with scopes	Executes spot, futures, options and delivery orders, including price-triggered and trailing orders	The scopes are the control, and they are the only ones here shaped like ours. Five of them: market for public data, profile for read-only account access, trade before any order can be placed, account for the unified and sub-accounts, and wallet, which covers transfers, deposits and withdrawals. No cap on the size of a single order	Not documented on the repository	Active. Last push 10 September 2026, 39 stars, MIT
tastytrade MCP	tastytrade, in your brokerage account	An OAuth client and refresh token, with a guard that refuses to send them to an unrecognised host	Executes, but only after its own dry-run	The most enforced confirmation in this comparison. The five order-submitting tools refuse to act without a token from their own dry-run; the token is single-use, expires in 60 seconds, and is bound to the arguments and the endpoint, so you cannot dry-run one share and submit a thousand. Under it sit per-leg quantity checks against the account’s own ceilings, a notional cap on buying-power impact, and a refusal to send orders into frozen or closing-only accounts	United States. A US brokerage account is required	Active. Last push 21 September 2026, 20 stars
Senpi	You. The terms at senpi.ai/terms say "Senpi does not take custody of funds" and that delegated access is limited to trading and "does not permit Senpi to transfer or withdraw funds to any external address"	A Senpi auth token in an environment variable, SENPI_AUTH_TOKEN. No private key in a file	Executes. Co-pilot mode asks first, autonomous mode does not	The most documented set in this field: a daily-loss halt, an intraday drawdown breaker, per-position max_loss_pct with trailing exits, margin, notional and leverage limits that reject a breaching signal, and consecutive-loss and per-asset cooldowns	No US-person exclusion published. The terms bar sanctioned jurisdictions and give California residents CCPA rights, which reads as US availability	Active. Last push 22 September 2026, 125 stars, 37 forks, MIT
FensoryOurs	You. Tokens settle to a wallet you control, perp margin sits at the venue	None. OAuth through a Fensory account	Executes	a kill-switch, an access expiry, a market allow-list and a per-order cap, all enforced on the account. An order above the cap is rejected rather than trimmed	Not available to US persons	Active, hosted
Alpha Vantage MCPData only	None. No account, no funds	None on the recommended hosted path, which authorises your API key in a browser	Read-only	Rate limits only. The free tier is 25 requests a day, which one conversation can spend	Not restricted	The healthiest project here. Last push 30 August 2026, 210 stars, MIT
Shibui FinanceData only	None	None at all. Paste the URL	Read-only	Nothing to limit	Not restricted	Live. Closed source, and run by one person on one server

Two questions decide this, and most comparisons answer neither

The first is where your credential ends up. Four models exist. A hosted server signs you in with OAuth and no secret touches your disk. A broker mints you an API key that you paste into a config file, which is revocable if it leaks. A local server holds an exchange secret on your machine. Or you paste a raw blockchain private key into a file, which is not revocable at all: whoever reads that file owns the wallet.

Every open-source Hyperliquid server in this comparison, all seven of them, is in that last category. A leaked brokerage key can be rotated in a minute and the damage stops there. A leaked private key means the wallet is emptied and there is nothing to revoke, which is why that distinction outranks every feature in the table.

The second question is what happens when the agent gets it wrong, and the sixteen execution servers here answer it in five different shapes rather than one. A cap on the size of a single order: Webull and Fensory. A ceiling that bounds a period rather than an order: Senpi, halting the day on a loss threshold and breaking on an intraday drawdown, and MetaMask, with daily spend limits. A confirmation the software itself enforces: tastytrade, whose order tools refuse to act without a token from their own dry-run, single-use, expiring in 60 seconds and bound to the arguments, so you cannot dry-run one share and submit a thousand, and Kraken, whose CLI enforces its own acknowledgement before a dangerous operation. A person approving each order: Walnut, which is a real control and stops being one the moment nobody is watching. And a capability gate: OKX, Bybit and Gate, where a read-only flag or an OAuth scope decides whether trading is reachable at all. That last group is worth separating from the rest, because a gate decides whether the door opens and says nothing about how much can go through it.

Reading our own row honestly: a per-order cap bounds one mistake and does nothing about thirty in a row, which is the failure an unattended agent actually has, and Senpi covers that where we do not. What our cap does that a gate cannot is bound the size of an order that is allowed to happen. Coinbase names maximum trade sizes and daily limits on one page but does not document how to set them, and its own setup guide tells you to fund a separate portfolio to limit the blast radius instead. Robinhood, Alpaca and every open-source Hyperliquid server have no cap at all, so the real limit is how much money sits in the account.

The servers that can place an order

Alpaca MCP Server

Official project

The official server from Alpaca, a US broker-dealer, covering US equities, options and crypto. Open source under MIT and self-hosted. Its launch post is dated 20 November 2025, which makes it the oldest of the brokerage servers by about two months.

What it reaches: US equities and ETFs, options, crypto
Cost: Free server, commission-free US equities and options

Choose this if: You want US equities, ETFs and options including multi-leg spreads, you are comfortable holding your own API keys, and you want to run against a paper account first. It is also the only broker server here you can read end to end before you run it.

Worth knowing: Several forks copy the official repo tagline word for word; only the alpacahq repository is Alpaca’s. With no per-order cap, the protection while testing is the paper-trading default, not a limit.

Alpaca docs

Coinbase for Agents

Official project

A hosted MCP endpoint into an isolated Coinbase Advanced portfolio, launched 11 June 2026, reaching spot crypto, US derivatives and S&P 500 equities. Trade and Transfer are separate permissions, and Transfer moves funds only between your own portfolios.

What it reaches: Spot crypto, US futures, S&P 500 equities
Cost: No product fee. Standard Advanced maker and taker tiers

Choose this if: You are already on Coinbase, you want a hosted connection with no key in a file, and you are willing to bound the damage by funding a separate portfolio, which is what Coinbase’s own documentation tells you to do.

Worth knowing: Coinbase has published no country list for this product, so a non-US reader cannot tell from the documentation whether it is open to them. Coinbase also notes that extended-thinking modes sometimes draft an order and stop short of placing it.

Coinbase docs

Robinhood Agentic Trading

Official project

Robinhood’s own MCP server, announced 27 May 2026, reached through a dedicated Agentic account that is separate from your main one. Setup is pasting one URL and signing in. The agent can trade but cannot transfer, stake or lend, and margin is not enabled on the agentic account.

What it reaches: US equities and crypto. The marketing page also names options
Cost: No separate fee documented

Choose this if: You are in the United States, you already use Robinhood, and you want the shortest setup here. Funding the Agentic account with a fixed amount is how you bound it.

Worth knowing: How much the agent can spend is decided entirely by what you put in that account. Robinhood’s support article and its product page also disagree on whether options are included.

Robinhood support

TradeStation MCP

Official project

The first brokerage MCP connection, announced 13 January 2026, covering stocks, ETFs, options and futures. Access needs an eligible balance of at least $10,000 and a paid Claude or ChatGPT subscription, and each tool is granted or denied the first time it runs.

What it reaches: Stocks, ETFs, options, futures and futures options
Cost: No MCP fee. Commissions, a paid AI subscription, possible market data costs

Choose this if: You trade futures as well as equities, you want a confirmation in front of every order, and you prefer granting access one tool at a time instead of all at once.

Worth knowing: The only entry here that requires both a paid AI subscription and a five-figure balance. Two community repositories use the TradeStation name and are not connected to the official service.

TradeStation

Webull

Official project

Three separate things share this name: a hosted cloud MCP server that is read-only, a self-hosted open-source server with full trading that documents nine regions, and the consumer Agentic Trading product. The MCP server went public on 11 June 2026.

What it reaches: Equities, options, futures, event contracts and crypto
Cost: Not documented

Choose this if: You want the strongest documented controls of any broker here. It is the only brokerage product that lets you cap order size and value and restrict trading to a list of symbols, which is the control most of this field is missing.

Worth knowing: Work out which of the three you are using. The cloud server cannot trade at all, and the self-hosted one runs against a sandbox until you switch it to production.

Webull agentic trading

Kraken CLI

Official project

A command-line tool with a built-in MCP server, open source under MIT, reaching Kraken spot, futures and the xStocks tokenized equities. The default service set is read-only for live funds, and a local paper-trading engine runs with no credentials at all.

What it reaches: Spot, perpetual and dated futures, xStocks tokenized equities, forex, staking
Cost: Free and open source

Choose this if: You want a local tool you can inspect, a genuine paper mode that needs no credentials, and confirmation enforced by the tool itself rather than by whatever the model decided to do.

Worth knowing: The only server here where the agent can reach withdrawals: enabling the funding service lets it initiate them, gated only by the acknowledgement flag. Scope the API key to exclude withdrawal, or do not enable that group.

Kraken MCP docs

Phantom MCP

Official project

Phantom’s own server, first published in February 2026. Signing in creates a new dedicated wallet, not your personal one, and Phantom’s key service signs under policy. Swaps run across Solana, Ethereum and Bitcoin, and perpetual futures run on Hyperliquid.

What it reaches: Solana, Ethereum and Bitcoin swaps, Hyperliquid perpetual futures
Cost: No Phantom swap fee documented

Choose this if: You want on-chain trading with no key in a config file at all, and you are happy for the blast radius to be whatever you fund the agent wallet with. It is the cleanest key story in the on-chain half of this field.

Worth knowing: No per-order cap, allow-list or kill-switch is documented. The transaction preview is a convention the agent is asked to follow, not a control that refuses anything.

Phantom docs

Open-source Hyperliquid servers

Community project

Seven community servers that wrap the Hyperliquid API and can place an order: edkdev, 0xikalgo (Rust), Impa-Ventures, GigabrainGG, erscoder, caiovicentino and hypurrquant, whose CLI also reaches other venues. Free, self-hosted, and none is affiliated with Hyperliquid. Read-only servers are excluded, which is why kukapay and mektigboy are not here.

What it reaches: Hyperliquid perpetual futures and spot
Cost: Free

Choose this if: You want to read every line of what signs your orders, you are trading Hyperliquid, and you can manage key hygiene yourself. Of the seven, hypurrquant is the one we would start from: MIT licensed, the most recent commit of the set, and 36 stars. erscoder is worth reading for its pattern, a documented read-only mode that needs no private key at all, so removing the key disarms the write tools.

Worth knowing: A leaked private key cannot be rotated the way an API key can. 0xikalgo asks for your main wallet key on disk in step two while warning you in the same README never to use your main wallet. GigabrainGG and erscoder carry no licence, which means all rights reserved, and erscoder has no stars or forks, so the pattern is worth copying even where the repository is not worth depending on. Check the package name before installing: erscoder’s README points at a PyPI package belonging to a different author.

erscoder/hyperliquid-mcp

Walnut

Official project

A hosted connector that links US brokerage accounts through a regulated integration provider. Walnut never holds funds and your brokerage credentials never reach it. Every order is confirmed by you in Walnut’s own dialog rather than by the agent.

What it reaches: US equities and ETFs through linked brokerage accounts
Cost: Free, with no paid tier

Choose this if: You want your assistant to do the research and the reasoning while a human stays on the trigger, and you would rather not give any agent the ability to place an order at all.

Worth knowing: It is not an execution server in the sense the rest of this list is. Nothing trades without your click.

Walnut

Composer MCP

Official project

Listed here because directories still recommend it. It connected an assistant to Composer’s automated strategies. The package is still installable and the company is trading normally, but the MCP product looks retired.

What it reaches: US equities, ETFs and crypto through automated strategies
Cost: Server free, trading needed a paid Composer plan

Choose this if: Nothing today. It is on this page so that a reader who found it recommended elsewhere can see what we found when we checked.

Worth knowing: Several directories still list it as current. Verified on 16 September 2026: it is not.

PyPI package

OKX Agent Trade Kit

Official project

The official OKX toolkit, an MCP server and a CLI, covering spot, perpetual swaps, delivery futures, options, Simple Earn, grid and DCA bots and event contracts across 167 tools. It runs as a local stdio process and states that keys never leave your machine.

What it reaches: Crypto spot, perpetual swaps, delivery futures, options, earn products, event contracts
Cost: Free toolkit, OKX trading fees apply

Choose this if: You trade on OKX and want the widest tool surface in this comparison by some distance, including options and grid bots that nothing else here reaches. The read-only flag is a real switch, and running it locally means no third party sits between you and the exchange.

Worth knowing: The protection is the read-only flag, not a limit: once trading is enabled there is nothing to stop a single order of any size. Keys sit in a config file on your machine, which is the risk class this page keeps separating from hosted, revocable access.

GitHub repo

Bybit MCP Server

Official project

The official Bybit server for the V5 API, 384 tools across market data, trading, positions, account, assets, loans, earn, copy trading and WebSocket streams. Strategy execution includes POV and Iceberg, which splits into up to 200 child orders.

What it reaches: Crypto spot, derivatives, options, earn products, loans
Cost: Free server, Bybit trading fees apply

Choose this if: You trade on Bybit and want market data without handing over a key at all, which is a cleaner default than most servers here manage. Withholding OneTime execution because the API would ignore the limit is the kind of decision that tells you the authors thought about the failure rather than the feature.

Worth knowing: The quantity limit applies to strategy execution, not to an ordinary order, so it is not a per-order cap. Credentials in environment variables are better than a checked-in file and still a credential on your machine.

GitHub repo

Gate MCP

Official project

Gate.io’s hosted MCP endpoints, split by purpose: public market data with no auth, 400+ tools for exchange trading and account behind OAuth2, a DEX wallet and swap surface across 20+ chains, and separate news and research endpoints.

What it reaches: Crypto spot, futures, options, delivery, margin, earn, plus DEX swaps across 20+ chains
Cost: Free server, Gate trading fees apply

Choose this if: You want exchange trading without a key in a file. Gate is the only exchange server in this comparison that authorises over OAuth with a separate read-only scope, which is the same shape as delegated access and revocable in the same way.

Worth knowing: A second repository, gate/gate-for-ai, has more stars and has not been pushed since 15 March 2026. It is the older surface, and the stars point at the staler one, which is exactly the trap this page warns about elsewhere.

GitHub repo

tastytrade MCP

Official project

The official server from tastytrade, a US broker, covering quotes, positions, balances, watchlists and order entry for equities and options. Production is the default and the environment in use is stated on every order result.

What it reaches: US equities and options
Cost: Free server, tastytrade commissions apply

Choose this if: You are in the US and you want the agent stopped by the software rather than by its instructions. The dry-run binding is the only mechanism on this page that makes a confirmation step something the server enforces rather than something the model is asked to do, and every result names the checks that did not run, so an empty warning list cannot be mistaken for a completed check.

Worth knowing: US only, which rules it out for most of this page’s readers, and US equities and options only. Production is the default rather than the sandbox, which the README states plainly and is worth reading before pointing it at a funded account.

GitHub repo

Senpi

Official project

Personal trading agents for Hyperliquid, launched 24 February 2026, with an MCP surface of 62 tools and an open-source skills repository carrying 80+ strategy templates. Each strategy runs against its own funded Hyperliquid wallet rather than a shared balance.

What it reaches: Hyperliquid perpetual futures only. ~230 crypto and ~95 equities, metals, indices and pre-IPO
Cost: 0.05% on all perpetual futures auto-trades on Hyperliquid, no recurring platform fee, plus Hyperliquid fees and a $1 HyperCore activation per strategy wallet

Choose this if: You trade Hyperliquid perpetual futures and you want loss limits rather than order limits. Senpi is the only product on this page that documents a daily-loss halt and a drawdown breaker, which stop a losing run; a per-order cap, ours included, does not. If you are in the US it is also one of the few here you can actually use.

Worth knowing: Perpetual futures only, so no tokenized equity you can hold and no spot. The custody wording matches ours closely, so the difference is the instrument set and the shape of the limits, not the custody model.

Senpi skills repository

Fensory

OursOfficial project

Our own. A hosted MCP server reaching Hyperliquid spot and perpetual futures, including supported builder-dex markets. The app separately surfaces tokenized US stocks and treasuries and gold. Fensory sets a kill-switch, an access expiry, a market allow-list and a per-order cap on the account.

What it reaches: MCP: Hyperliquid spot and perpetual futures. App: tokenized US equities and treasuries, and gold
Cost: Free to connect. 0.01% to 0.05% on perpetual futures and Hyperliquid spot, nothing on tokenized equities, yields or bridging

Choose this if: You are outside the US, you want the cap and the allow-list enforced on the account rather than asked of the model, and you want one account that reaches tokenized equities and perpetual futures rather than two.

Worth knowing: Not available to US persons, which rules it out for a large share of this page’s readers. The cap is per order and not a limit on total losses, so orders inside your limits can still lose money.

The Fensory MCP server

Data and research tools

Listed apart because they do not place orders. They can supply market data or analysis alongside an execution option, but they do not replace one.

Alpha Vantage MCP

Official project

The official Alpha Vantage server: prices, fundamentals, earnings, news sentiment, screeners, technical and macro indicators across global stocks, forex, crypto and commodities. It cannot place an order.

What it reaches: Global equities, forex, crypto, commodities, macro data
Cost: Free tier, then paid API plans

Choose this if: You want your assistant to research well before anything touches an order. Run it alongside an execution server; the two do different jobs.

Worth knowing: The legacy setup puts your API key in the URL, which leaks into logs. Use the hosted path.

GitHub repo

Shibui Finance

Official project

A hosted, free, credential-free server over decades of US end-of-day equity data, financials, technical indicators and SEC filing records. No account and nothing to place an order with.

What it reaches: US equities, NYSE and NASDAQ, end of day
Cost: Free

Choose this if: You want long-history US equity data in an assistant with the shortest possible setup, and end-of-day data is enough.

Worth knowing: End of day only, so no intraday and no real-time. One maintainer is a real dependency to weigh.

Shibui Finance

Announced, and not verified by us

Each of these is reported to let an agent place a real order, and we have not yet read the vendor’s own page or repository end to end. They are named so you can chase them, not recommended, and not ranked in the table above.

Bitget GetClawReported to trade autonomously inside an isolated sub-account since April 2026, with 58 tools. Bitget’s own pages would not load for us.
Binance MCP serverReported alongside Agent OS, which is already in our non-US comparison. The MCP surface itself we have not read.
MetaTrader 5Reported to have native agent and MCP support in terminal builds through July 2026, which would reach users through any MT5 broker. No MetaQuotes page found.
Trading CentralA data and analytics MCP surface rather than an execution one. If it holds up it belongs beside Alpha Vantage and Shibui, not in the table above.
stocksonchain/mcp-serverRead-only, for tokenized stocks. Created 20 September 2026, four days after this page was researched, so it is new rather than missed.

How we checked

The field is the MCP servers an assistant can use to place a real trade that we have verified against the vendor’s own repository or page, plus the two data-only servers people most often confuse with them. Data servers are listed separately and are not ranked against execution servers, because a server that cannot place an order is not competing with one that can.

This list is not complete, and saying so is more useful than implying otherwise. A sweep on 22 September found four official servers the first pass had missed, three from exchanges and one from a broker: OKX, Bybit, Gate and tastytrade. All four are in the table now, and Bitpanda was a fifth, added to the non-US comparison. It also surfaced several we have not finished checking, named under “Announced, and not verified by us” below rather than left out. The first pass was scoped to Hyperliquid servers and to products already known to us, which is why an OKX repository with 438 stars, more than any Hyperliquid server here, was not in it. If you know of one that can trade and is not here, it belongs here.

The community Hyperliquid servers were drawn from a GitHub search on name and description, sorted by stars and read on 16 September 2026. Everything that can place an order is in the entry; the read-only ones are named and excluded. If you know of one we have missed that can trade, it belongs here and we would rather add it than defend a shorter list.

Every factual cell was read on the vendor’s own documentation or repository, never from another roundup. The original field was read on 16 September 2026 and the five entries added on 22 September were read that day. Where a vendor page refused to load, we left the claim off the page rather than sourcing it to a summary of that page.

Repository figures come from the GitHub API, not a directory listing: stars, the archived flag, and the last commit on the default branch. That last detail matters, because a repository can show recent activity from a branch that was never merged. One server in this comparison looks five months fresher than it is for exactly that reason.

Fensory publishes this page and appears in it. We sell a trading account, which is a conflict worth stating: it is why the comparison is on documented custody, credentials, limits and maintenance rather than on a score we assign.

Questions people ask

What is an MCP server for trading?: A program that exposes a trading account to an AI assistant through the Model Context Protocol, so the assistant can read prices and, in most cases, place orders. Some are run by the broker or venue, some are community projects you host yourself, and some only read market data.
Do I have to give an AI agent my private key?: Not unless you choose a server that requires one. Hosted servers from brokers and venues use OAuth and no secret touches your machine. Every open-source Hyperliquid server in this comparison asks for a raw private key in a file, which is the one credential you cannot rotate after a leak.
Can an AI agent withdraw my money?: It depends on the server. Most block it: Robinhood’s agent cannot transfer, Coinbase’s Transfer permission cannot reach an external address, and Fensory’s key cannot sign a withdrawal. Kraken’s CLI is the exception here, where enabling the funding service lets an agent initiate withdrawals unless you scope the API key to prevent it.
What stops an AI agent from placing an order that is too big?: On most of this field, nothing but the account balance. Two products here document a cap you can set on a single order: Webull and Fensory. Everywhere else the answer is to fund a separate account with only what you are prepared to lose, which is what several vendors tell you to do in their own setup guides.
Are these servers safe to use?: The software is the smaller risk. The bigger ones are a credential in a file that something else can read, an agent acting on a misread instruction, and an abandoned project nobody is patching. Check when the code last changed, check what the account enforces rather than what the model is asked to do, and fund it accordingly.