# Is Gloam safe to connect to an AI agent? | TradingAgentStack

> Is Gloam safe for an AI agent? Can trade unattended. Safety 48%. Safeguards and gaps, each from official sources, checked 2026-11-09.

Canonical: https://tradingagentstack.com/tool/gloam/is-it-safe/

1. [Home](https://tradingagentstack.com/)

2. [AI agent payments](https://tradingagentstack.com/category/agent-payments/)

3. [Gloam](https://tradingagentstack.com/tool/gloam/)

# Is Gloam safe to connect to an AI agent?

**Can trade unattended.** [Safety 48%](https://tradingagentstack.com/safety-score/) Can trade unattended. Built from our sourced listing, last checked 2026-11-09. Not financial advice.

## What an AI agent can do

- **Live vs paper:** live on mainnet (beta) on Tempo and Robinhood Chain since Oct 21, 2026 and on Base and Ethereum since Oct 26; Gloam says it is live on Elysium; the MCP server defaults to testnet, so a setup never moves to mainnet by itself [source](https://www.npmjs.com/package/@gloamtrade/mcp)

- **Order approval:** the agent pays x402 and MPP resources and other Gloam addresses from a private balance without approving each payment, within spending limits it cannot lift: off-chain limits the local MCP server checks, and on Tempo an access key whose cap the protocol enforces; amounts and payees are hidden, money going in and out of the vault stays public; the hosted MCP server (gloam.trade/mcp) only reads and plans and never signs or holds keys; the local server that signs keeps the key on your machine; the MCP server can't cash out to a public wallet (the app and SDK can, for 0.5%); Gloam says it never holds your keys and there is no admin withdraw [source](https://www.npmjs.com/package/@gloamtrade/mcp)

- **Markets:** stablecoins (USDC.e, pathUSD, USDT0, USDG and others by network), x402 and MPP payments, private balances on Tempo, Robinhood Chain, Base, Ethereum and Elysium

- **Pricing:** deposits and private payments free; cashing out to a public wallet costs 0.5%

## Safeguards that exist

- **Guardrails outside the agent:** Spending limits the agent can't lift, but they're off-chain limits checked by the local server itself; only on Tempo does the protocol enforce an access key's cap (official docs) [source](https://www.npmjs.com/package/@gloamtrade/mcp)

- **Test before real money:** Paper, demo or testnet mode available [source](https://www.npmjs.com/package/@gloamtrade/mcp)

- **Who holds the keys:** Self-custody: the local MCP server that signs keeps the key on your machine, and the hosted server only reads and plans and never signs or holds a key; Gloam says it never holds your keys and has no admin withdraw (official docs) [source](https://www.gloam.trade/docs/agents)

- **Open source or audited:** Open source (MIT); Kann Audits reviewed the vault contracts (report, Nov 1, 2026) and found no Critical, High or Medium issues (official docs) [source](https://www.npmjs.com/package/@gloamtrade/mcp)

- **Incident record (last 12 months):** No incident naming this tool in our incident tracker in the last 12 months [source](https://www.npmjs.com/package/@gloamtrade/mcp)

## Safeguards that are missing

- **Human approval:** No approval per payment: the agent pays x402 and MPP resources and other Gloam addresses on its own, within its limits (official docs) [source](https://www.npmjs.com/package/@gloamtrade/mcp)

- **Sending funds out:** The agent can pay any x402 or MPP resource and any Gloam address within its limits; the MCP server can't cash out to a public wallet (the app and SDK can, for 0.5%) (official docs) [source](https://www.npmjs.com/package/@gloamtrade/mcp)

## Safety score

[Safety 48%](https://tradingagentstack.com/safety-score/) Can trade unattended. If this tool, or an AI agent using it, is wrong, hacked or prompt-injected, how much of your money is at risk? Higher is safer. Not a ranking; affiliate links never affect it. [How it's calculated](https://tradingagentstack.com/safety-score/) · [Incidents](https://tradingagentstack.com/incidents/)

| Input | From official docs or our listing | Points |
| --- | --- | --- |
| Human approval | No approval per payment: the agent pays x402 and MPP resources and other Gloam addresses on its own, within its limits (official docs) [source](https://www.npmjs.com/package/@gloamtrade/mcp) | 0 / 25 |
| Guardrails outside the agent | Spending limits the agent can't lift, but they're off-chain limits checked by the local server itself; only on Tempo does the protocol enforce an access key's cap (official docs) [source](https://www.npmjs.com/package/@gloamtrade/mcp) | 8 / 15 |
| Test before real money | Paper, demo or testnet mode available | 15 / 15 |
| Sending funds out | The agent can pay any x402 or MPP resource and any Gloam address within its limits; the MCP server can't cash out to a public wallet (the app and SDK can, for 0.5%) (official docs) [source](https://www.npmjs.com/package/@gloamtrade/mcp) | 0 / 15 |
| Who holds the keys | Self-custody: the local MCP server that signs keeps the key on your machine, and the hosted server only reads and plans and never signs or holds a key; Gloam says it never holds your keys and has no admin withdraw (official docs) [source](https://www.gloam.trade/docs/agents) | 5 / 10 |
| Open source or audited | Open source (MIT); Kann Audits reviewed the vault contracts (report, Nov 1, 2026) and found no Critical, High or Medium issues (official docs) [source](https://www.npmjs.com/package/@gloamtrade/mcp) | 10 / 10 |
| Incident record (last 12 months) | No incident naming this tool in our incident tracker in the last 12 months ([incident tracker](https://tradingagentstack.com/incidents/)) | 10 / 10 |
| Total | 48% of the points we could check | **48 / 100** |

## Sources

- [https://www.npmjs.com/package/@gloamtrade/mcp](https://www.npmjs.com/package/@gloamtrade/mcp)

- [https://www.gloam.trade/docs/agents](https://www.gloam.trade/docs/agents)

Full listing: [Gloam](https://tradingagentstack.com/tool/gloam/) · How the score works: [Safety score method](https://tradingagentstack.com/safety-score/)

## More safety checks: AI agent payments
[Is Coinbase Agentic Wallet safe?](https://tradingagentstack.com/tool/coinbase-agentic-wallet/is-it-safe/)[Is Link agent wallet safe?](https://tradingagentstack.com/tool/link-agent-wallet/is-it-safe/)[Is Stripe Issuing for agents safe?](https://tradingagentstack.com/tool/stripe-issuing-for-agents/is-it-safe/)

Every tool's score: [Safety score for all tools](https://tradingagentstack.com/safety-score/)

Building an agent on this? When it trades a public account on Hyperliquid or Polymarket, [get its track record verified](https://tradingagentstack.com/get-your-ai-agent-verified/): we check it from public data on the spot, then list it with a signed record. See [the verified AI trading leaderboard](https://tradingagentstack.com/ai-trading-leaderboard/), and how the agents already out there are doing in the [AI trading bot statistics](https://tradingagentstack.com/ai-trading-bot-statistics/).

## For agents

- [When to use this site, and the page index](https://tradingagentstack.com/llms.txt)
- [Sitemap](https://tradingagentstack.com/sitemap.xml)
- [Contact](https://tradingagentstack.com/contact/)
- [MCP server](https://tradingagentstack.com/mcp/)
- [MCP discovery](https://tradingagentstack.com/.well-known/mcp)