TAS Guard: limits for AI agents that trade real money

Why it exists

Of the 14 official broker MCP servers we track, 6 let an AI agent place orders directly and 4 make approval optional (research). Generic MCP gateways can flag "create order" as risky, but they can't tell a $50 order from a $50,000 one. TAS Guard reads the order itself: symbol, side, size and price, including option contract multipliers and exchanges that preview before they fill.

What it does

• Hard limits: per-order and daily value caps, orders per day and per minute. Approval can't override them.
• Allow and block lists: symbols (with wildcards like BTC/*) and sides (for example buy-only).
• Human approval: orders over a threshold, live-money orders, market orders with no price, and "cancel or close everything". You approve in your AI app's prompt or with a command; the agent can't.
• Blocked by default: withdrawals and transfers, leverage changes, account settings, raw "call any endpoint" tools and anything unrecognized. They're hidden from the agent too.
• Kill switch: one command stops new orders on every guarded account. Cancels and closing positions keep working.
• Audit log: every decision, with secrets redacted, in a hash-chained file that shows if a line was edited or deleted.

Connectors where a guard matters most

Broker MCP servers that let an agent trade without a per-order confirmation, from our sourced listings:

Quick start (Alpaca, paper trading)

On Windows with Claude Desktop? Follow the step-by-step Windows guide: two copy-paste scripts, tested with an Alpaca paper account.

Needs Node 18+ and uv. Install Alpaca's server once with uv tool install alpaca-mcp-server, then save this as alpaca.json. Keep your API keys in this file rather than in your AI app's settings: some apps keep their own copy of server settings, and keys in the guard file always win. (${VAR} values are read from the environment if you prefer.)

{
  "name": "alpaca",
  "profile": "alpaca-mcp-server",
  "upstream": {
    "command": "alpaca-mcp-server",
    "args": [],
    "env": {
      "ALPACA_API_KEY": "PK...your paper key",
      "ALPACA_SECRET_KEY": "...your paper secret",
      "ALPACA_PAPER_TRADE": "true"
    }
  },
  "policy": {
    "max_order_value": 500,
    "max_daily_value": 2000,
    "approve_over": 250,
    "symbols_allow": [
      "SPY",
      "QQQ",
      "AAPL"
    ]
  }
}

Then point your MCP client at the guard instead of at Alpaca. Claude Desktop (claude_desktop_config.json):

{
  "mcpServers": {
    "alpaca": {
      "command": "npx",
      "args": [
        "-y",
        "tas-guard",
        "run",
        "--config",
        "/path/to/alpaca.json"
      ]
    }
  }
}

Claude Code: claude mcp add alpaca -- npx -y tas-guard run --config ~/alpaca.json. Ask the agent to call tas_guard_status to see its limits.

Your controls

npx tas-guard pending           # actions waiting for you
npx tas-guard approve <id>      # approve one (the agent repeats the call)
npx tas-guard kill              # stop all new orders now
npx tas-guard resume
npx tas-guard log --tail 20     # what happened
npx tas-guard verify-log        # check the log wasn't edited

Connector profiles (open data)

A profile records what each tool of a connector can do with money and where its order fields live, checked against the connector's source code. They're published as JSON under the same CC BY 4.0 terms as our dataset:

• Alpaca MCP Server: alpaca-mcp-server.json, 22 tools, checked 2026-10-20 against tests/test_server_construction.py EXPECTED_TOOLS and src/alpaca_mcp_server/overrides.py at commit 2a973a0 (2026-10-12)
• CCXT MCP Server: ccxt-mcp-server.json, 24 tools, checked 2026-10-20 against mcp/ts/tools/*.ts registerTool calls at ccxt commit 310bf4b (2026-10-19)

Schema: connector-profile.v1.json. Index: /data/profiles/index.json. Profiles for more brokers are welcome as pull requests on GitHub.

Limits of the guard

• Order values use the order's own price; a market order by quantity has no price, so it needs approval by default.
• There's no profit-and-loss stop yet: daily caps limit how much the agent can trade, not how much it can lose.
• If your agent can run terminal commands, it could run the approve command itself. Use in-app approval prompts and tight hard limits.
• It's a seatbelt, not a guarantee. Not financial advice.

TAS Guard is made by TradingAgentStack. It is our own tool, so it never affects safety scores or rankings. Version 0.1.1, MIT license.