DEV Community

Bartosz Bilicki
Bartosz Bilicki

Posted on

Remote MCP for crypto perps agents: what we learned shipping write-path safety

Most "AI trading agent" demos stop at listing markets.

The hard part starts when the agent can place orders.

What broke first

  1. Keys on the model host - local MCP servers with private keys in env look fine in a demo, then become a single-point blast radius.
  2. Write tools always-on - if open/close is available in every chat, one prompt injection is enough.
  3. No sub-accounts - one shared balance for every agent routine makes audits painful.

Pattern that worked better

  • Keep a remote MCP for execution (HTTP/streamable), so the Cursor/Claude machine never holds exchange keys.
  • Start read-only (markets, positions, balances).
  • Gate writes behind policy / human approve.
  • Prefer sub-accounts per routine or per client.

We shipped that pattern as a USDT perpetual futures MCP:

There is also a Deno-oriented SDK surface (~29 methods) if you want typed clients instead of raw tool calls.

Minimal agent loop

  1. Read markets + positions
  2. Decide size with hard caps
  3. Require confirmation before write tools
  4. Log every tool call

Telegram side note

If your distribution is Telegram-native (Mini Apps / bots), discovery and shipping speed matter as much as the agent:

Questions for builders

  • Do you keep research MCP and execution MCP as separate servers?
  • What is your default max notional before human approve?

Happy to compare notes.

Top comments (0)