An AI agent for trading: inspect permissions before broker access

Inspect the tool, the permission and the deployment

Model Context Protocol, or MCP, is a connection format. It does not decide whether a tool reads holdings, creates a conditional instruction or sends an ordinary order. A coding-agent skill can also call a broker's software development kit, or SDK, without using a read-only chat connector.

Separate those routes before judging a setup. Reading an order book is not placing an order, and an order-capable API is not proof that every connector exposes it. A repository may include functions that the broker's hosted service disables. A trigger instruction can create a later financial action even when an interface is described mainly as read-only.

This guide checked documentation on 14 October 2026. We did not authenticate accounts, install connectors, submit orders or test a confirmation screen. The official MCP comparison covers the broader feature catalogue; here the focus is the boundary between data and action.

Published broker routes and their action boundaries

Documentation checked 14 October 2026; selected eight brokers, with Upstox routes separated. No live permission or order test.

Route	Documented scope	Confirmation or uncertainty
Dhan native MCP	Read and trade tools documented; order-capable design.	Current overview describes per-session consent. Exact per-order behaviour was not independently re-established from the detail paths.
Groww MCP	Stock/F&O context and order-placement requests documented.	Demat sell prerequisite documented; actual confirmation behaviour not tested. See the dedicated Groww guide for scope.
5paisa MCP	Order placement and action logging described by the broker.	Documentation establishes the published capability; a universal confirmation screen or audit-log behaviour was not tested.
Zerodha hosted Kite MCP	Read-oriented, with GTT (good-till-triggered) instruction exception.	Ordinary order tools listed in the repository must not be assumed available on the hosted service; self-hosted configuration differs.
Upstox MCP	Read-only account integration; no order placement.	Separate from Upstox Agent Skills even when both appear in one marketplace.
Upstox Agent Skills	Order execution through the SDK; launch effective 6 June 2026.	Guide documents an order preview and explicit confirmation before place/modify/cancel. These guardrails were not tested.
FYERS MCP	Unresolved conflict: older announcement and current help say read-only; current product page describes order actions where enabled.	No rollout date, account permission check or actual order test resolves the conflicting official descriptions.
Kotak Neo MCP	Read-only; order placement and modification unavailable in its FAQ.	A separate broker trading interface remains a separate permission path; no privacy/security test conducted.
Angel One	Official MCP not established in the reviewed official sources.	A server name or community publication does not establish broker ownership or approval; unknown is not proof of absence.

Row sources: Dhan overview; Groww update; 5paisa product page; Zerodha article plus repository; Upstox MCP docs plus Skills guide/launch; FYERS announcement, support and product page; Kotak FAQ; Angel official organisation listing and scoped searches. A source-listed action is not a measured runtime result.

Sources: [1], [2], [3], [4], [5], [6], [7], [8], [9], [10], [11], [12], [13]

Download this table (CSV)

FYERS shows why a single old label can mislead

The 7 November 2025 announcement and the support article describe a read-only boundary. The product page now lists order workflows where enabled. We preserve both statements and withhold a settled account-level classification. The new page does not establish when the feature rolled out or whether your current account has those tools. Older announcement, support scope, current product description.

The practical question is which tools your specific connection exposes and which permission boundary applies to them. A tool list and the broker's current scope documentation should agree before you rely on the description. This conflict is an evidence gap to resolve with the broker, not a reason to infer that the broker is unsafe.

For Upstox, the published distinction is explicit: its MCP reads data while Agent Skills can execute orders. For Kite, keep the hosted GTT exception separate from ordinary order tools in a self-hosted repository. A broad 'read-only versus trading' label can hide both differences.

An identifier, a token and a TOTP seed are different

Security standards and broker documentation checked 14 October 2026. Scope depends on the actual implementation.

Item	Why it matters	Boundary to preserve
API key or client identifier	The label alone does not establish its role or access scope.	Check the broker's documentation; distinguish an identifier from a secret or access token. Do not infer safety from the name 'key'.
Bearer access token	Possession can allow access to its associated resources under the token's permissions.	Protect it from chat transcripts, screenshots, logs and source control; establish where the trusted application stores and uses it.
TOTP seed or setup secret	It is the shared secret behind recurring time-based codes, rather than one code shown now.	Never give it to an AI agent or MCP connector. Keep the seed private in trusted authenticator setup, and keep recovery material private.
Password, PIN or one-time login code	These belong to authentication, not the content of a portfolio-analysis request.	Enter them only through the broker's documented trusted login flow. Verify the destination rather than accepting a link supplied by untrusted content.

Bearer-token principle: RFC 6750. TOTP distinction: RFC 6238. Broker-flow example: Zerodha's external authentication description. Identifier row is a proposed documentation check, not a universal credential classification.

Sources: [16], [15], [4]

“authenticate access to API through two factor authentication”

Authentication and action approval solve different problems

SEBI circular SEBI/HO/MIRSD/MIRSD-PoD/P/CIR/2025/0000013, dated 4 February 2025, addresses broker API authentication. Read it alongside the extension SEBI/HO/MIRSD/MIRSD-PoD/P/CIR/2025/132, dated 30 September 2025. This is a plain-English summary, not legal advice.

Authentication establishes access through a particular process. It does not establish that a proposed instrument, quantity or cancellation matches your intention. Upstox documents a separate order preview and explicit confirmation in Agent Skills; this is a published guardrail, not a control we tested. Check the actual permission and confirmation behaviour for the specific client and tool.

Approval also needs a defined scope. Permission to connect an account should not be interpreted as your decision about a later financial action. For any action proposal, inspect its complete parameters and what happens after a failure or an unclear response. An assistant's confident description is not the broker's execution record.

Twelve checks before considering an account-connected agent

• 1. Establish who operates the connection

  Find the official broker documentation and the actual server or package owner. A familiar broker name in a repository title does not establish first-party ownership.

• 2. List the enabled actions

  Separate reads, alerts, GTT instructions, ordinary orders, modifications and cancellations. Resolve any disagreement between the published description and the available tools.

• 3. Identify the deployment

  Distinguish a hosted connector from a locally run server or an SDK-based skill. Do not copy one deployment's permission boundary to another.

• 4. Limit permissions to the task

  Use the minimum necessary access. A review that only needs old notes does not require a broker order tool; this is a design principle, not an account configuration test.

• 5. Keep secrets outside the conversation

  Exclude passwords, PINs, tokens, TOTP seeds and recovery material. Check screenshots and diagnostic records before sharing them for help.

• 6. Separate source data from instructions

  Treat a fetched report or webpage as material to analyse, not as authority to grant new permissions or send private account information.

• 7. Require a complete action preview

  Check the exact instrument, exchange, expiry where relevant, side, product, quantity, order type and price fields before any consequential action is considered.

• 8. Check units and contract identity

  Distinguish shares, units and lots. Use the applicable official instrument information rather than a model's remembered contract description.

• 9. Reject an open-ended approval scope

  Do not treat a general conversational instruction as permission for repeated trades, automatic retries, future sessions or a changed proposal.

• 10. Resolve unclear order responses first

  Verify the broker's order state before considering another action. A timeout or missing chat reply does not establish that nothing reached the broker.

• 11. Know the broker's stop and revocation controls

  Read the documented cancellation, access revocation and segment-lock behaviour. Check pending orders and positions separately; a connector disconnect does not prove that existing instructions are gone.

• 12. Keep a redacted audit record

  Retain the proposed action, scope of approval, tool response and broker's recorded outcome. Keep secret credentials out of the record you share.

How untrusted content can cross a permission boundary

1. 1

   A legitimate read introduces outside content

   An assistant retrieves a webpage or file for your research. Its text may contain instructions unrelated to the task you authorised.

2. 2

   The model treats that content as an instruction

   An indirect prompt injection attempts to change model behaviour through external material. This is different from an ordinary mistaken summary.

3. 3

   An available tool makes the mistake consequential

   If the workflow grants sensitive reads or action tools, unintended instructions may influence their use. Least privilege, separation of untrusted content and enforced human approval are safeguards described by OWASP.

Prompt injection is a workflow risk, not a broker accusation

OWASP's LLM01:2025 describes external files and webpages altering model behaviour and recommends limiting privileges, separating untrusted content and requiring human approval for high-risk actions. The sequence above is an illustrative threat model. We did not test an exploit against any selected broker or find that a named connector is vulnerable. OWASP guidance.

A sentence telling the assistant to behave safely is one layer; the permission boundary and application controls need their own evidence. An outside document should not expand access or decide a financial action. Review what data reaches the model, what the tools can do and which checks are enforced by the surrounding software.

If a response is unclear, go to the broker's authoritative record. Avoid assuming that a conversational success message proves a fill, or that silence proves rejection. The kill-switch comparison documents separate broker lock scopes; it is not a promise that one control reverses every existing action.

Keep retrospective review separate from the broker's record

The Groww MCP guide explains that connection's documented scope. Similar account-reading tools can expose sensitive financial information even when they cannot place orders. Read-only access reduces the available action set; it does not remove the need to understand data handling and permissions.

OneTradeJournal uses manual trade entry, without import, broker sync or a broker connection. Its paid AI can be wrong and reviews the supplied entries. It does not send trading signals, execute trades or block an order. A manually written journal cannot replace the broker's authoritative order and trade records.

Use a journal review to inspect your recorded reasons and rule choices. Keep technical action logs separately and redact credentials before sharing them. The evidence that matters is the specific permission granted, the action actually authorised and the outcome the broker recorded.

Sources

Every figure on this page comes from one of these. Each was checked on the date shown.

1. [1]DhanHQ: native MCP read/trade surface · checked 14 Oct 2026
2. [2]Groww's MCP product update · checked 14 Oct 2026
3. [3]5paisa's official MCP product page · checked 14 Oct 2026
4. [4]Zerodha: hosted Kite MCP security and GTT exception · checked 14 Oct 2026
5. [5]Zerodha's official server repository and hosted exclusions · checked 14 Oct 2026
6. [6]Upstox MCP: read-only account integration · checked 14 Oct 2026
7. [7]Upstox Agent Skills: execution and documented guardrails · checked 14 Oct 2026
8. [8]Upstox Agent Skills launch, effective 6 June 2026 · checked 14 Oct 2026
9. [9]FYERS official MCP announcement, 7 November 2025 · checked 14 Oct 2026
10. [10]FYERS support: read-only connections · checked 14 Oct 2026
11. [11]FYERS current MCP page: order actions where enabled · checked 14 Oct 2026
12. [12]Kotak Neo MCP: order placement/modification unavailable · checked 14 Oct 2026
13. [13]Angel One public GitHub organisation: scope of reviewed official listing · checked 14 Oct 2026
14. [14]OWASP LLM01:2025: prompt injection and mitigations · checked 14 Oct 2026
15. [15]RFC 6238: shared-secret time-based passwords · checked 14 Oct 2026
16. [16]RFC 6750: bearer token possession and protection · checked 14 Oct 2026
17. [17]SEBI retail algo framework, 4 February 2025 · checked 14 Oct 2026
18. [18]SEBI retail framework extension, 30 September 2025 · checked 14 Oct 2026