AI agent trading permissions: who approves the order?

Updated: 2026-10-16 · AgentBroker Index

Educational content — not investment advice

This guide is for information and education only. It is not financial, investment, legal or tax advice, and it is not a recommendation to open an account with any provider, to buy or sell any instrument, or to let an AI agent trade. AI agents make mistakes and can act on manipulated content; investing involves risk of loss and leveraged products (CFDs, futures, perpetuals) are high-risk. Features and eligibility change often: confirm on the provider's own site. This page contains no affiliate links and no provider paid to appear.

The biggest difference between providers isn't which AI they support but who presses the button. Some only let the agent draft an order that you submit; others let it place orders, with safeguards ranging from a confirmation step on every order to a separate ring-fenced account or a scoped API key. Below are the documented limits for every provider where an agent can draft or place orders.

Quick answer: At 2 providers the agent only drafts orders (Interactive Brokers, Montrose). In 26 official products it can place them, usually behind a confirmation step, a ring-fenced account or a scoped API key. ESMA and the CNMV warn that public AI tools are not authorised or supervised to give investment advice.

Agent drafts, you submit

The agent cannot send an order to the market.

Provider	Agent can	ES / EU / US	Limits & approval (as documented)
Interactive Brokers Broker · US	Draft orders Hosted MCPChatGPT appClaude connector	ES: Yes · EU: Yes · US: Yes	Agent drafts trade instructions only; you review and submit each one from an IBKR platform. Authorization covers a single account. Drafts expire after 7 days (per StockBrokers).
Montrose Broker · Sweden	Draft orders Hosted MCP	ES: Unknown · EU: Yes · US: No	Read access to portfolio data plus pre-filled trades: the agent prepares a buy, and you log in to Montrose to review and approve it. Cannot move money in, out or between accounts. Access is opt-in, time-limited and revocable (90 days per the MCP page; Montrose's setup guide says seven days).

Agent can place orders — official agent products

Read the limits column: many still require your confirmation per order.

Provider	Agent can	ES / EU / US	Limits & approval (as documented)
Alpaca Broker · US	Place orders Local MCP	ES: Unknown · EU: Unknown · US: Yes	Open-source MCP; defaults to paper trading. No built-in OAuth for remote hosting.
Binance Crypto exchange · Global	Place orders Hosted MCPAgent skill	ES: Unknown · EU: Unknown · US: No	Agents run in dedicated Agentic sub-accounts with per-feature permissions, funding limits, optional order approval and an Emergency Stop. No withdrawal scope.
Bit2Me Crypto exchange · Spain	Place orders Local MCP	ES: Serves market* · EU: Unknown · US: Unknown	Local MCP with API key + secret (48 tools). Irreversible writes return a confirmation preview unless confirm=true. External withdrawals and transfers to other users not supported.
Bitpanda (incl. Fusion) Crypto exchange · Austria	Place orders Hosted MCP	ES: Unknown · EU: Yes · US: Unknown	Scoped, revocable API key (read / trade). Public-API MCP can trade with Trade(Write) scope; Fusion MCP places/cancels orders with Trade scope. Stricter rate limits on order placement. No per-order size cap documented.
Bybit Crypto exchange · Global	Place orders Local MCP	ES: Unknown · EU: Unknown · US: Unknown	Official trading MCP (npx); market data without credentials, trading requires API key + secret. Limits depend on key permissions.
Coinbase Crypto exchange · US	Place orders Hosted MCPCLIAgent skill	ES: Unknown · EU: Unknown · US: Yes	OAuth with portfolio selection; recommends an isolated agent portfolio. Transfers only between your own portfolios (no external withdrawals). x402 data payments capped at 5 USDC per payment.
Crypto.com Crypto exchange · Global	Place orders Agent skillAPIHosted MCP	ES: Unknown · EU: Unknown · US: Unknown	Agent Key set in the app: view-only or view+trade, weekly trading limit, optional per-trade confirmation, instant kill switch. Agent Keys cannot withdraw. The public MCP server is market data only.
cTrader (Spotware) Trading platform · Cyprus	Place orders Hosted MCPLocal MCPAgent skill	ES: Serves market* · EU: Serves market* · US: Unknown	Remote MCP via configuration token from cTrader Web; local MCP needs cTrader Windows/Mac. Confirmation for trading operations can be enabled; no caps documented.
eToro Broker · Israel/Cyprus	Place orders APIAgent skill	ES: Unknown · EU: Unknown · US: No	Agent Portfolios: a ring-fenced sub-portfolio (from $200) with a scoped, expiring API key and optional IP allow-list. No per-order confirmation documented. ChatGPT, Gemini and Claude.ai are not supported.
Fensory Crypto exchange · Switzerland	Place orders Hosted MCP	ES: Unknown · EU: Unknown · US: No	Executes without per-order confirmation, inside a kill-switch, market allow-list and per-order cap set on the account.
Freedom24 (Tradernet) Broker · Cyprus	Place orders Local MCP	ES: Unknown · EU: Unknown · US: Unknown	Connect with an API key generated in the Tradernet dashboard; keys stay on your machine. The connector lists placing/cancelling orders and stop-losses. No caps documented.
Gemini (exchange) Crypto exchange · US	Place orders Hosted MCPClaude connectorAgent skill	ES: Unknown · EU: Unknown · US: Yes	Agentic Trading via MCP can monitor markets and place orders; the Claude marketplace connector is described as read-only.
Kraken Crypto exchange · US	Place orders Local MCPCLI	ES: Unknown · EU: Unknown · US: Unknown	Default services are market data, read-only account and paper trading. Live trading requires enabling the 'trade' service with an API key; enabling 'funding' allows withdrawals. Experimental software.
MetaMask Agent Wallet Wallet · US	Place orders CLI	ES: Unknown · EU: Unknown · US: Unknown	Self-custodial. Guard Mode (default): daily spend limits, allow-listed protocols, 2FA approval for out-of-policy transactions. Beast Mode: fewer interruptions, flagged transactions still need 2FA.
Moomoo Broker · US/Global	Place orders Hosted MCPAgent skill	ES: Unknown · EU: Unknown · US: Yes	Hosted MCP with OAuth sign-in; 13 order types incl. TWAP/VWAP. Trade approval is a toggle you choose; skills path defaults to paper trading and asks for the trading password before going live.
NinjaTrader Broker · US	Place orders Hosted MCPAgent skill	ES: Unknown · EU: Serves market* · US: Serves market*	Beta, not generally available. OAuth 2.1 with per-tool permissions you pick on the consent screen (e.g. Trade = place/modify/cancel). Optional connection risk limits (max exposure, traded volume, per-product/contract allowlist) on top of account-level risk settings. Separate Demo and Live servers. The official trading skills show each order payload and ask for approval; direct tool calls have no documented per-order confirmation.
OKX Crypto exchange · Global	Place orders Local MCPCLI	ES: Unknown · EU: Unknown · US: Unknown	Agent Trade Kit: open-source MCP toolkit + CLI using OKX API keys. Limits depend on API key permissions.
Public.com Broker · US	Place orders Hosted MCP	ES: No · EU: No · US: Yes	Trades may execute without your input on each transaction. Dedicated accounts available; preflight checks; no user-set caps; Agentic Brokerage runs unattended once approved.
Revolut X Crypto exchange · UK/Lithuania	Place orders Claude connectorLocal MCPCLIAgent skill	ES: Serves market* · EU: Serves market* · US: Unknown	Users must review and approve every order. The Claude connector / MCP server is read-only (no place/modify/cancel); order placement goes through the revx CLI/skill.
Robinhood Broker · US	Place orders Hosted MCP	ES: No · EU: No · US: Yes	Agent trades only in a separate dedicated agentic account, but can read all your Robinhood accounts. No broker-enforced caps, whitelist or read-only mode; can trade without confirmation if instructed.
Scalable Capital Broker · Germany	Place orders Hosted MCPCLI	ES: Serves market* · EU: Serves market* · US: No	Agent prepares orders; you approve each order before execution. Permission levels: read-only, restricted or full access. Payments are never handled by agents. Access can be switched off any time.
tastytrade Broker · US	Place orders Local MCP	ES: Unknown · EU: Unknown · US: Yes	Every order needs a 60-second confirmation token from a dry run of that exact order (agent can mint it itself). $50,000 buying-power cap by default; read-only flag. Self-hosted; defaults to production.
TradeStation Broker · US	Place orders Hosted MCPClaude connectorChatGPT app	ES: Unknown · EU: Unknown · US: Yes	Explicit confirmation enforced on every order; existing account permissions apply. Request access via HUB. $10k minimum and paid-AI requirement dropped in Oct 2026 (StockBrokers).
Tradier Broker · US	Place orders Hosted MCP	ES: Serves market* · EU: Serves market* · US: Yes	Hosted MCP authenticated with your personal API token (live or paper token selects the environment). Tools include equity, single-leg and multi-leg option, OCO/OTO/OTOCO orders and cancellations. No per-order confirmation or caps documented by Tradier; your AI client's own approval settings for write actions apply.
Trading 212 Broker · UK/Bulgaria	Place orders APIAgent skill	ES: Serves market* · EU: Serves market* · US: No	Official open-source Agent Skill (trading212-labs/agent-skills) wrapping the Public API (beta, v0): market, limit, stop and stop-limit orders, portfolio, history. API key + secret; demo and live environments; optional IP allow-list for keys. Invest and Stocks ISA accounts only. No per-order confirmation or caps documented. Trading 212's API Terms prohibit using the API for Algorithmic Trading (orders determined by an algorithm with limited or no human intervention).
Webull Broker · US	Place orders Hosted MCPLocal MCPChatGPT appClaude connectorCLI	ES: No · EU: Unknown · US: Yes	Order value and share caps, symbol whitelist and read-only mode; local server ships with $10,000 notional / 1,000-share caps and defaults to sandbox. Preview recommended, not enforced.

Orders possible through a general API (no official agent product)

The broker documents an API, not an agent feature; safeguards are whatever you build.

Provider	Agent can	ES / EU / US	Limits & approval (as documented)
Saxo Broker · Denmark	Place orders API	ES: Unknown · EU: Unknown · US: No	Official OpenAPI (REST + WebSocket, OAuth) with SIM and LIVE environments. No official agent/MCP product found.

*Serves market: the provider operates there, but it does not publish whether the agent feature is available in that country.

What ESMA and the CNMV warn

Publicly available AI tools are not authorised or supervised by financial regulators and are not required to act in your interest.
They may rely on outdated, wrong or incomplete information.
Be wary of promises of high returns from AI-based strategies, and protect your personal data.

Source (Spanish version): ESMA/CNMV — Uso de la inteligencia artificial en las inversiones: ¿qué necesita saber?.

Recent related launches

2026-10

TradeStation — TradeStation drops its $10k minimum and paid-AI requirement for MCP access. source ↗

2026-09-09

NinjaTrader — NinjaTrader announces an MCP server (beta) for futures trading with Claude and ChatGPT. source ↗

2026-09

tastytrade — tastytrade releases its official MCP server. source ↗

2026-08-25

Scalable Capital — Scalable Capital launches Agentic Investing: first EU broker letting ChatGPT/Claude place orders (with approval). source ↗

2026-08-20

Binance — Binance launches Agent OS with an MCP server and agentic sub-accounts. source ↗

2026-08-06

MetaMask Agent Wallet — MetaMask Agent Wallet launches (self-custodial, Guard Mode). source ↗

Frequently asked questions

Can an AI agent trade without my approval?

With some products, yes, within limits you configure (sub-account, scoped API key). With others, every order needs your confirmation or you submit it yourself. See the limits column on this page.

What should I check before connecting an agent?

From providers' documentation: the permission level (read, limited, full), whether each order needs confirmation, whether withdrawals are blocked, key/access expiry, and how to disconnect.

Is what an AI agent tells me investment advice?

Providers in the index state that an agent's outputs are not their advice, and ESMA notes that public AI tools are not authorised to give investment advice.

How we built this page: every row comes from our tracker data, checked against each provider's official page (see each provider entry for sources). See the full tracker →

External sources: ESMA/CNMV — Uso de la inteligencia artificial en las inversiones: ¿qué necesita saber?