{"slug": "tools-17-with-write-access-how-ai-platforms-bound-agent-authority", "title": "Tools, 17 with write access: How AI platforms bound agent authority", "summary": "Antalpha's MCP server exposes 120 tools to any connecting agent, and 17 of them can write, according to the company's own count verified on 21 October 2026 via the standard MCP tools/list call. Sixteen of the 17 write-capable tools sit in the Trading category, with wallet-revoke-page the only security tool, and the company graded its tools by reasoning risk: 65 Low, 12 Medium, 15 High and exactly two Very High — wallet-guard-token-deep-scan and transfer-request. The count accompanies a five-grade scale for agent guardrails, from architectural (the model cannot supply the dangerous value) through cryptographic, procedural and instructional down to none, published as OKX, Binance and Minara shipped agent products whose announcements described capabilities rather than what agents may do without asking.", "body_md": "Four of the largest venues in crypto shipped agents that can act on a user's behalf this year. OKX opened an agent marketplace in June. Binance released Agent OS in August and Binance AI Pro on 19 October. Minara moved its product onto an agent harness in September. Every one of those announcements described what the agent can do. None of them led with the thing a user actually has to evaluate, which is what the agent is allowed to do without asking.\n\nThat question has a measurable answer, and we started by measuring our own. The Antalpha MCP server exposes 120 tools to any agent that connects to it. Seventeen of them can write. The other hundred and three can only read. Below is how we counted, what the four platforms do differently, and a five-grade scale for telling a real guardrail from a sentence in a prompt.\n\n## What is in our own tool surface\n\nThe Antalpha MCP endpoint at `mcp-skills.ai.antalpha.com/mcp` answers the standard MCP `tools/list` call, so the inventory is not something you have to take our word for. Running `npx mcporter list https://mcp-skills.ai.antalpha.com/mcp` returns the same set we counted on 21 October 2026.\n\nEach tool description carries its own capability tag. Twelve tools are marked `[Write]` and five are marked `[Read+Write]`, which is seventeen of 120 that can change state. Sixteen of those seventeen sit in the Trading category. The seventeenth is `wallet-revoke-page`, a security tool.\n\nThe tags go further than read and write. Each tool also carries a reasoning grade, and the distribution is lopsided: 65 tools are graded Low, 12 Medium, 15 High, and exactly two are graded Very High. Those two are `wallet-guard-token-deep-scan` and `transfer-request`, the tool that sends tokens from a user's address to someone else's.\n\nThat is the shape of an honest agent surface. The overwhelming majority of what an agent receives is the ability to look things up, and the ability to act is concentrated in a small, enumerable list that a reviewer can read in a minute.\n\n## Five grades of guardrail\n\nReading our own tool definitions produced something more useful than a count. The seventeen write tools do not all restrain the model the same way, and the differences fall into a ladder. The top three grades all show up in our own tools.\n\n| Grade | What stops a bad action | Can a confused or manipulated model get past it? | \n|---|---|---|\n| Architectural | The model is structurally unable to supply the dangerous value | No | \n| Cryptographic | The action needs a signature the model cannot produce | No, but the user can be tricked into signing | \n| Procedural | A separate confirmation step, enforced by the system | Only if the user approves both times | \n| Instructional | The tool description tells the model to confirm first | Yes | \n| None | The tool acts when called | Yes | \n\nThe architectural grade is worth dwelling on because it is rare and it is the only one that does not depend on anybody behaving well. Our `wallet-revoke-page` tool builds a page for revoking ERC-20 approvals, and its description states the constraint directly:\n\nAddresses are ALWAYS taken from the live on-chain scan, never from model input. The optional `approvals` list is only a display-label / filter hint: entries that do not exactly match an on-chain approval are ignored.\n\nThe model is not trusted to name the contracts. It cannot name them. The addresses come from the chain, and anything the model invents is dropped before the page is built. A hallucinated address and a prompt-injected address fail the same way, for the same reason, without anyone having to notice that an attack happened.\n\nCompare that with the cryptographic grade, which is where most of the on-chain tools sit. `poly-buy` returns a signing URL and its description states that private keys never leave the wallet. The agent assembles an intent; the user signs it. That is strong, and it is not the same as the architectural grade, because a user who signs without reading has handed the protection back.\n\n`transfer-request` adds the procedural grade on top. It is a two-step tool: the first call produces a risk preview, the second produces the signing URL, and the description says it \"requires explicit user approval at BOTH steps.\" It is also one of the two tools graded Very High. The highest-risk action in the set is the one with the most friction deliberately added to it, which is the correct relationship between those two things.\n\n## What the other three shipped\n\nAll of the following is drawn from each company's own public material.\n\n| Platform | Shipped | The binding mechanism | Grade | \n|---|---|---|---|\n| Binance AI Pro | 19 Oct 2026 | An isolated AI Strategy Account, funded only by manual transfer, from which the agent cannot withdraw to external addresses; paper trading first; a separate review-and-approve step before going live | Architectural, at the account level | \n| OKX AI | 30 Jun 2026 | An agent marketplace and a task marketplace where agents hire other agents, settling in stablecoins, with disputes resolved by a staked evaluator network | After the fact | \n| Minara Harness | 8 Sep 2026 | Described by Minara as bringing research and execution into one workspace \"with confirmation requirements and operating limits\" | Procedural, per its own description | \n\nBinance's approach is the most interesting contrast with ours because it answers the same question from the opposite direction. Binance calls the principle \"bounded autonomy,\" and the boundary it draws is around the account rather than around each action. The agent operates inside a walled sub-account that only the user can fund and that has no path to an external address. Within those walls the agent has a lot of freedom. Outside them it has none, structurally.\n\nThat is an architectural guardrail, and it is a good one. It also has a different failure mode from ours. A per-action signature protects every transaction but asks the user to read every prompt. An account boundary asks nothing of the user per transaction but caps the loss at whatever is inside the account. Neither is strictly better. They fail differently, and a user should know which failure they are choosing.\n\nBinance is also explicit about what its checks do not cover, which is worth repeating because so few launch posts bother: the platform's code checks confirm that a strategy runs without errors, and they do not assess whether it will make money.\n\nOKX is doing something else entirely. The marketplace lets agents hire other agents and settle payments between them, and the control is a staked evaluator network that resolves disputes after they happen. That is a reasonable design for a commerce network and a weak one for custody, because arbitration runs after the money has moved. It is the right tool for \"did this agent deliver the service it promised\" and the wrong tool for \"should this transfer have happened at all.\"\n\nMinara's harness page describes confirmation requirements and operating limits without publishing the specifics, so we have placed it at the procedural grade on its own description and cannot verify further from public material.\n\n## The question each design is answering\n\nLining them up, the four products are not competing on the same axis.\n\nAn account boundary answers: how much can be lost. A signature gate answers: who decided. An evaluator network answers: who pays when it goes wrong. An instruction in a tool description answers: what the model was asked to do, which is not the same as what it will do.\n\nA serious agent platform probably needs more than one of these. The ones that only have the fourth are the ones to look at twice.\n\n## What to ask before you connect an agent\n\nFour questions, and all four have public answers for every platform named above.\n\nHow many of the tools can write, and can you see the list? An inventory you can enumerate is a different risk from a capability surface described in marketing copy. If the platform speaks MCP, `tools/list` answers this in one call and nobody has to be trusted.\n\nWhat is the hard cap on a single bad instruction? For Binance AI Pro it is the balance of the isolated account. For a per-signature model it is one transaction. If the answer is a sentence about careful design rather than a number or a boundary, there is no cap.\n\nWhich grade protects the riskiest action, and is it the same grade as the safest one? The interesting number is not the average. It is the weakest path that touches money.\n\nWhat can the model itself supply? A model that can name a destination address is a model that can be made to name the wrong one. Ask whether the dangerous fields come from the model or from the chain.\n\n## Where this leaves Nina\n\nNina is Antalpha's Web3-native AI agent (NASDAQ: ANTA), and the same MCP surface described above is what Nina runs on and what an external agent can connect to. Antalpha's documentation describes the architecture as a five-step flow in which step 4 is a signature gate, with control of assets stopping at the draft, inside the user's own wallet.\n\nOne thing we are not claiming: Nina is not safer than Binance AI Pro because it uses signatures. It is bounded differently, and the per-transaction model puts more of the work on the user.\n\nIf you want to check any of this rather than trust it, the tool inventory is a public endpoint. Point an MCP client at `mcp-skills.ai.antalpha.com/mcp`, list the tools, and read the capability tags yourself. If what you count disagrees with what we published, the endpoint is right and we will correct the post.\n\n## Frequently asked questions\n\n### How many Antalpha MCP tools can write?\n\nSeventeen of 120 tools can write, comprising twelve marked `[Write]` and five marked `[Read+Write]`, counted from the live `tools/list` endpoint on 21 October 2026. Sixteen of the seventeen are in the Trading category.\n\n### What is bounded autonomy?\n\nBounded autonomy is the principle Binance describes for Binance AI Pro, in which agents provide analysis and recommendations while consequential actions require explicit human approval, with live strategies confined to an isolated account the agent cannot withdraw from.\n\n### What is the difference between an account boundary and a signature gate?\n\nAn account boundary caps the maximum loss at the balance the agent can reach and asks nothing of the user per transaction. A signature gate requires human approval for every individual transaction and caps the loss at one transaction, provided the user reads the prompt.\n\n### Can an AI agent move funds from a self-custodial wallet on its own?\n\nNo, when the design requires a wallet signature for each transaction. The agent can assemble and propose a transaction, and the transfer only occurs after the user signs it from their own wallet.\n\n### What is the weakest form of guardrail in an AI agent?\n\nAn instruction in the tool description telling the model to confirm with the user first. It depends entirely on the model complying with its own context and provides no protection against a confused or manipulated model.\n\n### How can I verify what tools an MCP server exposes?\n\nCall the server's `tools/list` endpoint with any MCP client, for example `npx mcporter list <server-url>`, which returns the complete tool inventory with each tool's description and capability tags.\n\n*Nina is the Web3-native AI agent from Antalpha (NASDAQ: ANTA), covering crypto, prediction markets and US stocks: conclusion-first analysis with named sources and freshness badges, and Sentinel mode for continuous monitoring. Self-custodial. Never holds funds, never trades for the user, takes no cut of principal or profits; a transparent routing fee applies on the execution path. Nothing here is investment advice or a price prediction. Official channels: antalpha.com, \"Antalpha AI\" on the App Store and Google Play, x.com/antalpha_ai.*\n\n*Related reading: [$387.5 million left Bitget without a stolen key: the four questions that expose the same risk in your AI agent](https://www.antalpha.com/en-us/blog/387-5-million-left-bitget-without-a-stolen-key-the-four-questions-that-expose/).*", "url": "https://wpnews.pro/news/tools-17-with-write-access-how-ai-platforms-bound-agent-authority", "canonical_source": "https://www.antalpha.com/en-us/blog/120-tools-17-that-can-write-how-four-platforms-bound-an-ai-agents-authority/", "published_at": "2026-10-29 03:17:38+00:00", "updated_at": "2026-10-29 03:43:55.993376+00:00", "lang": "en", "topics": ["ai-agents", "agent-protocols", "ai-tools", "ai-safety"], "entities": ["Antalpha", "OKX", "Binance", "Binance AI Pro", "Minara", "Agent OS", "wallet-revoke-page", "transfer-request"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/tools-17-with-write-access-how-ai-platforms-bound-agent-authority", "markdown": "https://wpnews.pro/news/tools-17-with-write-access-how-ai-platforms-bound-agent-authority.md", "text": "https://wpnews.pro/news/tools-17-with-write-access-how-ai-platforms-bound-agent-authority.txt", "jsonld": "https://wpnews.pro/news/tools-17-with-write-access-how-ai-platforms-bound-agent-authority.jsonld"}}