Full-access safety

The full-access surface (/mcp-full-access) lets a connected AI agent trade on your account directly. This page explains exactly what that means and how to stay in control. Read it before you approve the full-access consent screen.

Connecting this AI agent lets it place, cancel and close orders and set triggers on your account directly, with no per-action confirmation. These actions are irreversible. This differs from the in-terminal AI chat, which confirms each trade.

No per-action confirmation

The in-terminal AI Assistant chat asks you to confirm each trade before it executes. The full-access MCP surface does not. Once connected, the agent can place, cancel, and close orders and set price triggers on its own, as fast as it decides to — there is no confirmation dialog and no "are you sure?" step.

Actions are irreversible

Trades execute against the live market. A filled order, a closed position, or a cancelled order cannot be undone. If your agent makes a mistake — or is manipulated into one — the market result stands.

Prompt-injection risk

An autonomous agent acts on the text it reads. If your agent processes untrusted content — a web page, an email, a chat message, a document — that content can contain hidden instructions telling the agent to trade against your interest. This is called prompt injection. Because the full-access surface has no confirmation gate, a successful injection can move real money before you notice.

To reduce the risk:

Prefer the read-only surface unless you specifically need the agent to trade.
Only grant full access to agents and workflows you trust and control.
Be cautious about letting a full-access agent read untrusted external content in the same session it can trade.

How to stop your agent

You have two independent controls. Use either — or both.

Stop it in the agent (fastest). Disconnect or remove the B2Trader connector in your agent (Claude, ChatGPT, or your custom client). The agent immediately stops making new calls.
Revoke the grant in B2Trader. Open your account console (your broker's Keycloak account page) → Applications, find the connected MCP application, and revoke its access. This removes your consent so the agent cannot obtain a new token.

There is no broker-side "kill switch" that instantly voids a token already in the agent's hands. A token the agent already holds stays valid until it expires (see Access tokens are short-lived). Revoking in the account console stops new tokens; disconnecting in the agent stops it using the one it has. Do both to be certain.

You still get execution notifications

Every order the agent places, cancels, or closes fires the same account notifications you already receive for terminal activity. Your normal notification channels keep working, so a full-access agent cannot act silently — watch them to see what your agent is doing.

Access tokens are short-lived

The agent's access token has a short lifetime. If you revoke consent in the account console, the agent can finish using its current token but cannot get a new one once it expires — so a revoked grant fully lapses within the token's short window, without any forced server-side revocation.

Choosing read-only instead

If you do not need the agent to trade, connect the read-only surface (/mcp-read-only) instead. Its tools cannot place or change anything — the trading tools are not part of that surface at all. See Overview for the comparison.