Is Alpaca MCP Server safe to connect to an AI agent?

What an AI agent can do

• Live vs paper: live and paper (ALPACA_PAPER_TRADE defaults to true/paper; paper with simulated $100K) source
• Order approval: local server; 65 tools incl. stocks/options/crypto orders; ALPACA_TOOLSETS can restrict (e.g. read-only market data); ALPACA_PAPER_TRADE defaults to paper source
• Markets: US stocks, ETFs, options, crypto, fixed income quotes
• Pricing: free paper Trading API account with Basic IEX data is enough to start; Algo Trader Plus $99/mo for broader real-time; docs note no separate ~$9 unlimited SIP-style plan for new Trading API subscribers

Safeguards that exist

• Order approval or confirmation options: Only limits or read-only modes, no per-order approval source
• Paper, demo or testnet mode: Paper, demo or testnet mode available source
• Withdrawal permission needed or allowed: No withdrawal or transfer tools; deposits and withdrawals happen in the Alpaca web dashboard, not via the API (official docs) source
• Scoped keys, permission scopes or IP whitelisting: Scoped access (scopes, read-only mode, dedicated or separate account) source

Safeguards that are missing

• Can it place live orders unattended?: Can place live orders with no documented approval step source
• Open source or audited: No public source code in our listing source

Sources

• https://docs.alpaca.markets/us/docs/trading-api-mcp
• https://alpaca.markets/learn/fund-live-trading-account

Full listing: Alpaca MCP Server · How the score works: Safety score method · Alpaca MCP vs IBKR MCP · Alpaca MCP vs Tradier MCP