Your AI Can Now Trade Your Brokerage Account: Seven Brokers Shipped MCP Servers, And Their Safety Controls Are Not What Traders Assume

For most of 2025, an AI that could trade your account was a side project on GitHub. In 2026 it became a product category. tastytrade launched its official MCP server - self-hosted, open source, running on the user's own machine - which lets AI clients such as Claude Desktop, Claude Code, Cursor, VS Code, Antigravity CLI and Perplexity read real-time quotes, option chains with Greeks, positions and history, and place single and multi-leg orders, from spreads to iron condors, across stocks, options, futures, futures options, crypto, ETFs and forex. Its marketing line captures the pitch: your AI does the homework, you turn it in.

It is not alone. When StockBrokers.com tested brokers with first-party MCP servers in September, it found seven: Interactive Brokers, Moomoo, Webull, tastytrade, Robinhood, TradeStation and Public. The headline finding was not which broker has the best features. It was that the safety controls - the thing a trader most needs to understand before connecting an agent to real money - differ enormously, and are frequently weaker than users assume.

What Each Broker Actually Does

• Interactive Brokers (rated 5.0/5): the most restrictive design. The agent never reaches the order book; a human reviews before anything is submitted to the market. It is the model that keeps a person accountable for every trade.
• Moomoo (4.0/5): defaults sensibly to paper trading, but approval is a setting the user can relax rather than a broker-enforced gate.
• Webull (3.5/5): offers genuine guardrails - hard caps on order size and value, symbol whitelists and read-only modes - configurable by the user and enforced by the broker.
• tastytrade (3.5/5): the most thorough automated order checks of any tested, with every order bound to a 60-second token from a dry run of that exact order, plus local credentials and tool permissions on first use. The weakness is that an unattended agent can clear the check itself.
• Robinhood and Public (3.5/5 and 3.0/5): simulation tools, but no broker-enforced caps; once approved, agents can execute unattended.
• TradeStation (3.5/5): first-party MCP access with its own control set, rated alongside the mid-pack.

“A confirmation step the agent can satisfy on its own is not a confirmation. It is a delay.”

What Traders Should Insist On

1. 01Broker-enforced limits, not model instructions. Maximum order size, maximum daily value, allowed symbols and instruments - set at the broker, where the agent cannot change them. Telling the AI 'never trade more than £1,000' is not a control.
2. 02A human in the loop for anything consequential, genuinely. If you want the Interactive Brokers model, do not run the agent unattended. The dry-run and confirmation designs only protect you if a person actually confirms.
3. 03Paper first. Every broker offering simulation should be used that way until the agent's behaviour on your strategy is understood. Default-to-paper is Moomoo's best feature for a reason.
4. 04Read-only by default. Most of the value - analysis, portfolio summaries, Greeks, what-if questions - needs no order permission at all. Grant trading permission only when you need it.
5. 05Watch for untrusted inputs. An agent that reads news or social posts and can also place orders can be steered by content it reads. Keep research sessions and trading sessions separate.

What This Means For Trading Platforms And Firms

For brokers and trading platforms not yet on this list, the direction is clear: customers will expect to connect their AI tools, and the competitive question is how safely. The review effectively sets the bar - broker-enforced caps, instrument whitelists, read-only modes, dry-run binding of the exact order, and a gate an unattended agent cannot pass. For institutional desks, the same principles apply at larger scale: agents propose, a deterministic pre-trade risk layer decides, and a human approves consequential orders. The retail brokers are now publishing, in public, the control design that professional trading systems have needed internally all along.

The Bottom Line

Seven brokers now let AI agents trade real accounts through first-party MCP servers, with tastytrade's open-source server the most visible launch of September. The features are impressive; the safety controls are uneven. Interactive Brokers keeps the agent away from the order book, Webull enforces hard caps and whitelists, tastytrade binds each order to a dry-run token that an unattended agent can nonetheless clear, and some brokers enforce no caps at all. For traders, the rule is broker-enforced limits, paper first, read-only by default and a real human on consequential orders. For platforms, the review has written the specification. That is the trading platform and AI signal integration work we do in London, and the brokers have just made the controls part of the product.

References & Further Reading

• StockBrokers.com - Best brokers for AI trading agents in 2026: MCP tested (16 September 2026). stockbrokers.com/guides/ai-agent-brokers
• tastytrade - Open API MCP brings AI to your tastytrade account. tastytrade.com/newsroom/news/open-api-mcp-brings-ai-to-your-tastytrade-account
• tastytrade Developer Docs - MCP server. developer.tastytrade.com/docs/sdks-and-tools/mcp-server
• Yahoo Finance - Brokerages accelerate rollout of AI trading tools as automated investing expands. finance.yahoo.com/technology/ai/articles/brokerages-accelerate-rollout-ai-trading-140623312.html
• Model Context Protocol - official site. modelcontextprotocol.io
• Simon Willison - The lethal trifecta for AI agents. simonwillison.net/2025/Jun/16/the-lethal-trifecta

This article is general information and commentary. It is not investment advice or a recommendation to buy or sell any investment. Important information