MCP, explained for traders

In May 2026, Robinhood launched agentic trading: AI agents that can read your account and place orders for you, with your permission. Under the hood, the connection between the agent and the brokerage runs on something called MCP. If you have seen that acronym in every announcement about agentic trading and quietly nodded along, this post is the plain-English version. No code, just the mental model.

MCP for a trading agent, in one sentence: it is the standard plug through which an AI agent reads a broker's menu of tools — positions, quotes, order review, order placement — and calls them, so “connect Claude to Robinhood” means registering one server address and signing in, and everything the agent can or cannot do is exactly what that server's tool list allows.

What MCP actually is

MCP stands for Model Context Protocol. It is an open standard, originally published by Anthropic and since adopted across the industry, that defines how an AI agent connects to external tools. Before MCP, every integration was a one-off: a custom bridge between one model and one service, rebuilt from scratch for the next pair. MCP replaces those one-offs with a common plug.

The standard has two sides. A server sits in front of a service and exposes a menu of tools, each with a name, a description, and a defined set of inputs and outputs. A client is the agent that reads that menu and calls the tools. The agent never touches the service's internal systems. It sees only the list of actions the server chose to offer, in a format it can parse reliably.

That division matters for everything that follows, so it is worth being precise about who is who. Your broker runs the MCP server. The agent software you run, for example Coil (coil.trade), is a client of that server. It reads the broker's menu the same way any compliant agent would.

There is a second Coil in this picture, on the server side, and the distinction is worth holding onto. coil.trade runs an MCP server of its own — free for a scored board delayed by one market day, and $29 a month for Coil Live (MCP feed), which opens the current board, the structural stops and targets the engine trades on, and the served rulebook. That server exposes reads and rules. It has no order tool, because placing orders is the broker's job, and Coil never sees your account.

What a broker's MCP server exposes

Robinhood's agentic trading works exactly this way: the brokerage publishes an MCP server, and an agent connects to it with your authorization. The menu is the broker's decision, but a trading MCP typically covers four things:

• Market data. Real-time quotes, historical prices, fundamentals, earnings dates.
• Account state. Current positions, balances, open orders, realized gains and losses.
• Order actions. Place an order, review it before submission, cancel it.
• Housekeeping. Watchlists, screens, and other organizational tools.

The key property is that all of this is structured. When the agent asks for positions, it gets clean fields it can act on, not a webpage it has to interpret. And anything not on the menu simply does not exist from the agent's point of view. If there is no tool for wiring money to an outside account, the agent cannot invent one. For the practical walkthrough of the Claude-plus-Robinhood setup, the guide to running an agent on Robinhood covers it step by step, and the always-on version covers keeping it running on a schedule without you at the keyboard.

Why this beats scraping and pasted keys

Before broker-sanctioned MCP servers, software that traded a retail account had two bad options.

The first was screen-scraping: a bot drives a browser, reads page markup or pixels, and clicks buttons meant for humans. It is brittle in the way you would expect. A layout change breaks it, a slow page confuses it, and a misread number becomes a mis-sized order. It also usually violates the platform's terms, which means it can be cut off at any moment, possibly while holding positions.

The second was pasting credentials into scripts, through unofficial APIs or a login stored in plain text next to the code. Those credentials are all-or-nothing. Anything the account can do, the script can do, and anyone who gets the file can do too. No scoping, no approval step, no audit trail beyond whatever the script bothers to log.

An MCP connection fixes both failure modes at the root. Authorization goes through the broker's own login flow, so no password lives in a script. The agent gets scoped tools rather than raw account control. Results come back structured, so there is no pixel-reading step to silently go wrong. And because the broker built the server on purpose, both sides of the connection know it exists and can see what it did.

The safety layers on top

The protocol is the floor, not the whole safety story. In practice, agentic trading stacks several more layers on top of it.

Scoped permissions. The server only offers what the broker chose to expose, and the client side can narrow that further. Agent harnesses like Claude Code let you allowlist specific tools, so an agent can be permitted to read quotes and positions while every order call still requires a human yes.

Approval modes. You choose where the human sits. Fully manual, where the agent proposes and you confirm each order. Or bounded autonomy, where pre-agreed rules run without a prompt and anything outside them stops and asks. The right choice depends on how well-tested the rules are, which is worth being honest with yourself about.

Dedicated accounts. The simplest and most underrated layer: run the agent against a separate brokerage account funded only with the capital you intend it to manage. The blast radius is then a number you picked in advance.

Deliberate arming. Coil scans and scores; it never places an order, and your agent acts only where you allow it. The rules behind the board are documented at /how-it-works. Whatever software you use, off until a human says otherwise is the right default.

What an agent still cannot do through it

Worth stating plainly, because the fear here is usually vaguer than the reality.

An agent cannot call tools that do not exist. If the broker's server has no tool for external transfers, account changes, or security settings, those actions are unreachable no matter what the agent decides to attempt. It cannot bypass broker-side checks either: buying-power limits, tradability restrictions, and market-hours rules are enforced by the broker, not negotiated with the client. And the connection grants no custody. Your money stays at your broker, in your name, the same as before, which is the core of the self-custody model for trading software.

What MCP does not protect you from is the market. Orders placed through the cleanest connection in the world can still lose money, and leveraged products can lose it quickly. The protocol answers whether an agent can talk to your broker safely. Whether the agent should be trading at all is a separate question, covered from a different angle in can Claude trade stocks.

FAQ

Is MCP only for trading?

No. MCP is a general standard for connecting AI agents to any external tool: databases, calendars, code repositories, and much else. Broker MCP servers are one application of it. The pattern is spreading to other infrastructure: on September 8, 2026, Zayo launched “agentic networking”, a production MCP server through which a customer’s own agents can order cloud-to-cloud connectivity and execute approved network changes inside enterprise-defined controls, with people keeping authority over the infrastructure underneath. Same shape as a broker’s server, same shape as Coil’s: the agent acts within a published tool list and a policy it cannot rewrite. The trading-specific parts, like order review steps and scoped account tools, are choices the broker makes on top of the standard.

Does Coil run its own MCP server?

Two separate things. Coil’s own engine, the one that trades our account, is an MCP client: it connects to the broker's server, in its case Robinhood's, reads the tools the broker exposes, and trades through them by rule. Separately, coil.trade does serve its own free MCP server for market reads — claude mcp add --transport http coil https://mcp.coil.trade/mcp — so your agent can load Coil's scored board (one market day delayed) with no key, no card, and no account. Full docs on the For AI agents page.

Can an agent withdraw money from my account over MCP?

Only if the broker exposed a tool for that, and brokers have strong reasons not to. On a typical trading MCP the agent can read data and place orders inside the account, nothing more. Check the published tool list before authorizing any server, and treat that list as the full extent of what the agent can reach.

What does MCP mean for an AI trading agent?

For a trading agent, MCP is the standard plug through which it reads a broker's menu of tools — positions, quotes, order review, order placement — and calls them. Connecting an agent to a broker means registering one MCP server address and signing in; what the agent can and cannot do is exactly the tool list that server publishes, which is why a well-built broker server has no tool for moving money out.