The full-access surface (`/mcp-full-access`) lets a connected AI agent trade on your account **directly**. This page explains exactly what that means and how to stay in control. Read it before you approve the full-access consent screen.

<Callout type="error">
  Connecting this AI agent lets it place, cancel and close orders and set triggers on your account directly, with no per-action confirmation. These actions are irreversible. This differs from the in-terminal AI chat, which confirms each trade.
</Callout>

## No per-action confirmation [#no-per-action-confirmation]

The in-terminal **AI Assistant chat** asks you to confirm each trade before it executes. The full-access MCP surface does **not**. Once connected, the agent can place, cancel, and close orders and set price triggers on its own, as fast as it decides to — there is no confirmation dialog and no "are you sure?" step.

## Actions are irreversible [#actions-are-irreversible]

Trades execute against the live market. A filled order, a closed position, or a cancelled order **cannot be undone**. If your agent makes a mistake — or is manipulated into one — the market result stands.

## Prompt-injection risk [#prompt-injection-risk]

An autonomous agent acts on the text it reads. If your agent processes untrusted content — a web page, an email, a chat message, a document — that content can contain hidden instructions telling the agent to trade against your interest. This is called **prompt injection**. Because the full-access surface has no confirmation gate, a successful injection can move real money before you notice.

To reduce the risk:

* Prefer the **read-only** surface unless you specifically need the agent to trade.
* Only grant full access to agents and workflows you trust and control.
* Be cautious about letting a full-access agent read untrusted external content in the same session it can trade.

## How to stop your agent [#how-to-stop-your-agent]

You have two independent controls. Use either — or both.

1. **Stop it in the agent (fastest).** Disconnect or remove the B2Trader connector in your agent (Claude, ChatGPT, or your custom client). The agent immediately stops making new calls.
2. **Revoke the grant in B2Trader.** Open your **account console** (your broker's Keycloak account page) → **Applications**, find the connected MCP application, and **revoke** its access. This removes your consent so the agent cannot obtain a new token.

<Callout type="warn">
  There is no broker-side "kill switch" that instantly voids a token already in the agent's hands. A token the agent already holds stays valid until it expires (see [Access tokens are short-lived](#access-tokens-are-short-lived)). Revoking in the account console stops **new** tokens; disconnecting in the agent stops it using the one it has. Do both to be certain.
</Callout>

## You still get execution notifications [#you-still-get-execution-notifications]

Every order the agent places, cancels, or closes fires the **same account notifications** you already receive for terminal activity. Your normal notification channels keep working, so a full-access agent cannot act silently — watch them to see what your agent is doing.

## Access tokens are short-lived [#access-tokens-are-short-lived]

The agent's access token has a **short lifetime**. If you revoke consent in the account console, the agent can finish using its current token but cannot get a new one once it expires — so a revoked grant fully lapses within the token's short window, without any forced server-side revocation.

## Choosing read-only instead [#choosing-read-only-instead]

If you do not need the agent to trade, connect the **read-only** surface (`/mcp-read-only`) instead. Its tools cannot place or change anything — the trading tools are not part of that surface at all. See [Overview](/connect-your-ai-agent/overview.md) for the comparison.