I checked 14 broker MCP servers. Only 3 make you confirm each order.

Brokers are shipping MCP servers so you can connect Claude, ChatGPT or Cursor straight to a brokerage account. I track every official one, from each broker's own docs, and asked one question: when the agent decides to trade, who actually places the order?

Of 14 servers:

• The AI trades directly (6): Alpaca, Longbridge, NinjaTrader (beta), moomoo, Public and Tradier. Once connected with trading permission, the agent's order goes through. Some let you narrow the tools, but there's no confirmation step on the broker's side.
• You confirm each order (3): tastytrade (a single-use confirmation token from a dry run, valid 60 seconds), TradeStation (explicit confirmation before every order) and eToro (every action is proposed for your review).
• Approval is optional (4): Interactive Brokers (you approve each order unless you opt in to its autonomous mode), Robinhood (a trade-approvals toggle, off by default), Axi on MT5 (approval is your AI client's prompt, and "Always allow" skips it) and CCXT (preview and confirm by default on live accounts, configurable).
• You place the order yourself (1): Webull creates order instructions that you confirm in the Webull app.

Your AI client's prompt is not a safety control

Several servers rely on the client asking "Allow this tool?". That prompt is one click from "Always allow", and it can't tell a $50 order from a $50,000 one. A confirmation enforced by the broker, or by something outside the model, is a different thing from a prompt the agent's host shows you.

What to do before you connect an agent

1. Start in paper. 9 of the 14 document a paper, demo or sandbox mode.
2. Grant read-only first. 11 of 14 document scopes, read-only modes or per-tool permissions.
3. Use a separate account funded with only what the agent may lose.
4. Check withdrawals. 10 of 14 document that the MCP can't move money out. Know which one you're using.
5. Put hard limits outside the model.

The tool I built for point 5

I wanted per-order and daily dollar caps that the agent can't talk its way around, so I built TAS Guard, an open-source stdio proxy that sits between your AI client and any broker or exchange MCP server. It reads each order before it reaches the broker:

• per-order and daily value caps, plus orders per minute and per day
• symbol allow and block lists, optional buy-only mode
• large orders, live-money orders and "close everything" held for a human, with approvals from your phone through your own Telegram bot (optionally phone-only, so the agent can't approve itself)
• withdrawals, transfers, leverage changes and unrecognized tools blocked by default
• a kill switch, and a hash-chained audit log

Verified profiles exist for Alpaca's MCP server and CCXT's. Anything else runs in a conservative heuristic mode. It's MIT-licensed with zero dependencies, and it runs locally, so nothing goes through my servers.

Try it without a broker account: npx -y tas-guard demo starts it in front of a fake $100k paper broker.

Repo: https://github.com/intoApex/tas-guard
Full data, with a source for every row: https://tradingagentstack.com/research/broker-mcp-order-gating/

I run TradingAgentStack, which tracks these tools. Not financial advice; check each broker's docs before you connect anything.

Comments

[Auten]

Useful table, especially the split between "the client asks" and "the broker enforces".

One gap worth adding to point 5, from the computer-use side where we work: a proxy in front of the broker's MCP only sees orders that go through that MCP. If the same agent also has a browser or screen-control tool (Playwright MCP, computer use in Claude Code, Codex or Copilot), it can open the broker's web app, which is usually already logged in, and press Buy there. The caps never see that order, and from the model's side it is just another way to finish the task after the guarded tool says no.

So either the limit lives where the money actually moves, or the agent's other hands get the same rule: no browser or screen tool in a session that has trading permission, or a screen-side check that holds clicks on Buy / Sell / Confirm order targets on a broker origin for a human.

Does TAS Guard's threat model say anything about agents that also have browser tools? Even one line in the README would help people who stack several MCP servers.

[Dean Lee]

The notional dollar cap is necessary, but the nastier failure mode in broker APIs is order-type slippage. A five-thousand-dollar limit order on SPY during regular trading hours is benign. That same five-thousand-dollar order routed as a market order into an illiquid option contract or an extended-hours equity book sweeps the depth of book and gives up double-digit slippage before the fill message even reaches the client.

The second blind spot is retry behavior on partial fills and rejects. When an execution fails on a margin check or price collar, language models almost never inspect open order state or working cancel requests before firing another prompt turn. They tend to mutate the order price outward to force an execution, or place an opposing leg that turns a failed hedge into an accidental straddle.

Every retail brokerage customer agreement treats API credentials as explicit authorization by the account holder. The clearing firm bears zero liability for automated fills, which means any execution latency between the agent client and the broker risk engine comes entirely out of customer equity.

[Gautam K]

The tastytrade design is the one I'd copy. The confirmation comes from a dry run, it's single use, and it expires in 60 seconds, so the approval is tied to one exact order. That property matters more than who shows the prompt. If an approval only means "yes to an order", an agent can get a yes for 1 share and then send 100.

For TAS Guard's Telegram approvals: is the approval bound to the exact order (symbol, side, quantity, type, limit price), so a changed field needs a fresh approval? That's the rule I ended up with for API holds too: one approval covers one exact request, once.

[Paul Irolla]

A prompt that says 'allow this tool' covers the next order too, so it checks the tool, not the trade. Does the confirm prompt on those three show the symbol and size?