Is Lighter safe to connect to an AI agent?

What an AI agent can do

• Live vs paper: live; public testnet (testnet.app.lighter.xyz, settles to Sepolia) source
• Order approval: No official MCP server; experimental agent kit in its GitHub org. API keys trade and can withdraw only to the account owner's own Ethereum address; read-only tokens and maker-only keys available source
• Markets: crypto perpetuals, crypto spot
• Pricing: no API fee; Standard accounts 0% maker / 0% taker with a 300 ms speed bump, Premium 0.004% / 0.028%

Safeguards that exist

• Order approval or confirmation options: No per-order approval; maker-only keys (post-only orders and cancels) and read-only tokens limit what a credential can do (official docs) source
• Paper, demo or testnet mode: Public testnet app and API settling to Sepolia (official docs) source
• Withdrawal permission needed or allowed: A key can make a 'secure withdrawal' only back to the account owner's own Ethereum address; sending to anyone else needs the wallet's signature (official docs) source
• Scoped keys, permission scopes or IP whitelisting: Separate key per account and sub-account, maker-only keys and read-only tokens (5 minutes to 10 years) (official docs) source
• Open source or audited: Circuits and contracts are public on GitHub (contracts under a source-available licence) and the docs link 9 audit reports (official docs) source

Safeguards that are missing

• Can it place live orders unattended?: API orders execute with no per-order approval step source

Sources

• https://docs.lighter.xyz/developers/integration-guides/api-keys
• https://docs.lighter.xyz/developers/getting-started/environments
• https://docs.lighter.xyz/security/security-audits

Full listing: Lighter · How the score works: Safety score method