{"slug": "i-checked-14-broker-mcp-servers-only-3-make-you-confirm-each-order", "title": "I checked 14 broker MCP servers. Only 3 make you confirm each order.", "summary": "An independent researcher tracking broker MCP servers reviewed 14 official implementations and found that only three — tastytrade, TradeStation and eToro — require broker-enforced confirmation before an agent's order executes, while six let a connected AI agent trade directly once trading permission is granted. To address the gap, the researcher released TAS Guard, an MIT-licensed open-source stdio proxy that sits between an AI client and any broker or exchange MCP server, enforcing per-order and daily dollar caps, symbol allow/block lists, human approval for large or live-money orders via a Telegram bot, and a hash-chained audit log, with verified profiles for Alpaca and CCXT.", "body_md": "Brokers are shipping MCP servers so you can connect Claude, ChatGPT or Cursor straight to a brokerage account. I track every official one, from each broker's own docs, and asked one question: when the agent decides to trade, who actually places the order?\n\nOf 14 servers:\n\n- \n**The AI trades directly (6):** Alpaca, Longbridge, NinjaTrader (beta), moomoo, Public and Tradier. Once connected with trading permission, the agent's order goes through. Some let you narrow the tools, but there's no confirmation step on the broker's side.\n- \n**You confirm each order (3):** tastytrade (a single-use confirmation token from a dry run, valid 60 seconds), TradeStation (explicit confirmation before every order) and eToro (every action is proposed for your review).\n- \n**Approval is optional (4):** Interactive Brokers (you approve each order unless you opt in to its autonomous mode), Robinhood (a trade-approvals toggle, off by default), Axi on MT5 (approval is your AI client's prompt, and \"Always allow\" skips it) and CCXT (preview and confirm by default on live accounts, configurable).\n- \n**You place the order yourself (1):** Webull creates order instructions that you confirm in the Webull app.\n\n### \n  \n  \n  Your AI client's prompt is not a safety control\n\nSeveral servers rely on the client asking \"Allow this tool?\". That prompt is one click from \"Always allow\", and it can't tell a $50 order from a $50,000 one. A confirmation enforced by the broker, or by something outside the model, is a different thing from a prompt the agent's host shows you.\n\n### \n  \n  \n  What to do before you connect an agent\n\n1. \n**Start in paper.** 9 of the 14 document a paper, demo or sandbox mode.\n2. \n**Grant read-only first.** 11 of 14 document scopes, read-only modes or per-tool permissions.\n3. \n**Use a separate account** funded with only what the agent may lose.\n4. \n**Check withdrawals.** 10 of 14 document that the MCP can't move money out. Know which one you're using.\n5. **Put hard limits outside the model.**\n\n### \n  \n  \n  The tool I built for point 5\n\nI wanted per-order and daily dollar caps that the agent can't talk its way around, so I built TAS Guard, an open-source stdio proxy that sits between your AI client and any broker or exchange MCP server. It reads each order before it reaches the broker:\n\n- per-order and daily value caps, plus orders per minute and per day\n- symbol allow and block lists, optional buy-only mode\n- large orders, live-money orders and \"close everything\" held for a human, with approvals from your phone through your own Telegram bot (optionally phone-only, so the agent can't approve itself)\n- withdrawals, transfers, leverage changes and unrecognized tools blocked by default\n- a kill switch, and a hash-chained audit log\n\nVerified profiles exist for Alpaca's MCP server and CCXT's. Anything else runs in a conservative heuristic mode. It's MIT-licensed with zero dependencies, and it runs locally, so nothing goes through my servers.\n\nTry it without a broker account: `npx -y tas-guard demo` starts it in front of a fake $100k paper broker.\n\nRepo: [https://github.com/intoApex/tas-guard](https://github.com/intoApex/tas-guard)\n\nFull data, with a source for every row: [https://tradingagentstack.com/research/broker-mcp-order-gating/](https://tradingagentstack.com/research/broker-mcp-order-gating/)\n\n*I run TradingAgentStack, which tracks these tools. Not financial advice; check each broker's docs before you connect anything.*", "url": "https://wpnews.pro/news/i-checked-14-broker-mcp-servers-only-3-make-you-confirm-each-order", "canonical_source": "https://dev.to/intoapex/i-checked-14-broker-mcp-servers-only-3-make-you-confirm-each-order-828", "published_at": "2026-10-23 12:03:00+00:00", "updated_at": "2026-10-23 12:13:02.227528+00:00", "lang": "en", "topics": ["ai-agents", "ai-tools", "agent-protocols", "ai-safety", "developer-tools"], "entities": ["TAS Guard", "TradingAgentStack", "Alpaca", "CCXT", "tastytrade", "TradeStation", "eToro", "Interactive Brokers"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/i-checked-14-broker-mcp-servers-only-3-make-you-confirm-each-order", "markdown": "https://wpnews.pro/news/i-checked-14-broker-mcp-servers-only-3-make-you-confirm-each-order.md", "text": "https://wpnews.pro/news/i-checked-14-broker-mcp-servers-only-3-make-you-confirm-each-order.txt", "jsonld": "https://wpnews.pro/news/i-checked-14-broker-mcp-servers-only-3-make-you-confirm-each-order.jsonld"}}