---
title: "Which brokers let AI trade your account, and how far each one goes"
standfirst: "In 2026, broker after broker opened a door for AI assistants. Some let the AI look, some let it trade after you say yes, a few let it trade on its own. What matters most is where that yes is enforced."
author: "Yorben De Reuse"
author_url: "https://hello-purple.com/authors/yorben-de-reuse/"
date_published: "2026-10-20T07:12:42.575Z"
canonical: "https://hello-purple.com/reports/brokers-that-let-ai-trade/"
track: "The Map"
layout: "essay"
publisher: "Hello Purple"
publisher_note: "Hello Purple is a technology publisher from Purple Technology. Its Reports describe what was built and how; they are not financial advice and do not offer or invite the use of any financial service."
llms_txt: "https://hello-purple.com/llms.txt"
interactive: "https://hello-purple.com/reports/brokers-that-let-ai-trade/interactive/"
---

# Which brokers let AI trade your account, and how far each one goes

> In 2026, broker after broker opened a door for AI assistants. Some let the AI look, some let it trade after you say yes, a few let it trade on its own. What matters most is where that yes is enforced.

*Interactive edition: Put fourteen broker connections side by side, watch what changes when you switch on "Always allow", and leave with a checklist for your first hour. https://hello-purple.com/reports/brokers-that-let-ai-trade/interactive/*

## TL;DR

- In 2026, more than ten brokers and trading platforms opened a connection that lets Claude, ChatGPT or Grok reach your real trading account.
- What the AI may do differs a lot: some only let it read your positions, most let it trade after you say yes, and a few let it trade on its own.
- Start read-only or on a demo account, give the AI the smallest budget you can, and make every order tool ask for your approval.

## The year brokers let the AI in

Just a year ago, if you wanted an AI assistant to say something about your portfolio, you usually had to paste your positions into the chat yourself, unless you were willing to build a connection of your own. That changed quickly this year, as one broker after another opened up a direct connection. TradeStation was, according to StockBrokers.com, the first US broker to do so in January, Public launched AI agents that trade from plain-language instructions at the end of March, and Robinhood followed at the end of May by letting AI agents trade from a separate account. In July, Interactive Brokers opened its connection to any compatible AI tool, tastytrade released its own server in September, and this week, on 14 October, Axi launched an alpha version that links MetaTrader 5 accounts to Claude.

You can see the trend in the numbers as well. When StockBrokers.com reviewed 14 large brokers in early October, 7 of them had a connection of this kind built by the broker itself, all 7 had launched it this year, and none of them charges extra for it.

After going through the documentation of each of them, I don't think the most interesting question is which broker has a connection. What matters far more is what the AI is allowed to do once it's connected, and who or what can stop it when it does something you didn't intend. The answers to those questions differ a lot more than the launch announcements would make you think.

Disclosure: Purple Technology, which publishes Hello Purple, built the technology behind one of these connections, Axiory.ai, for the broker Axiory. I describe it below in the same way as the others, but read that part with this interest in mind.

## What the connection is

Almost all of these connections are built on the Model Context Protocol (MCP), an open standard that Anthropic introduced in November 2024. In most cases, you add the broker as a connector in your AI app, log in on the broker's own page and approve the access, so your password never passes through the AI. With the versions you install on your own computer, such as those of tastytrade and Webull, you put your login details or API keys in a settings file instead, which is why their documentation warns you never to paste them into the chat. From then on, the AI sees a list of tools, such as "get positions" or "place order", which it can use whenever your request calls for it. The broker decides which tools exist, while your AI app decides when it has to ask you before using one. There are two exceptions in this article: eToro gives the agent a separate API key instead, and Public's agents run inside Public's own app.

## The ladder: from looking to trading on its own

The easiest way to compare all these connections is to see them as a ladder with four rungs, where every step up means the AI needs you a bit less.

![A ladder with four rungs, from bottom to top: look only, prepare an order that you send yourself, send an order after a yes, and send orders on its own. Beside it, two dashed boxes for limits and a separate pot of money, which hold on every rung.](https://media.hello-purple.com/uploads/ai_broker_permissions_01_c088cdd787.png)

*Four rungs of what an AI may do in a trading account, and two safeguards that hold on all of them. Source: the brokers' own documentation and announcements, January to October 2026.*

On the first rung, the AI can only look at your balances, positions and prices. Because there are no order tools at all, there's also nothing that can be switched on by accident. On the second rung, the AI drafts an order, but you have to submit it yourself on the broker's own platform. I'd call this the safest set-up that still lets the AI do useful work, as the final click happens completely outside of its reach.

The third rung is where most brokers sit, but it's also where things get slightly more complicated. The AI places the order after you say yes, but that yes can be checked in three very different places.

The first is your chat app. Claude asks for your permission before it uses a tool, unless you've set that tool to "Always allow". The issue, however, is that once you do, the question disappears completely, and the broker has no way of knowing that nobody approved the order.

The second is the set of instructions the broker gives to the AI. A connection can tell the agent to show you the order first and wait for your approval, and it can mark its order tools as "destructive". These are only hints, though. The MCP standard itself says that apps must treat such labels as untrusted unless they come from a trusted server, and Axiory.ai's own documentation calls its confirmation instructions "guidance mechanisms, not enforcement".

The third is the broker itself. tastytrade, for example, refuses an order unless the exact same order was run as a dry run in the 60 seconds before. Since the AI can request that dry run itself, this proves the order was previewed rather than that you actually read the preview, but it's still checked on the broker's own side, just like the confirmations that TradeStation and Capital.com describe as mandatory.

On the fourth and final rung, the AI places orders without asking you each time, within rules or a budget you approved beforehand.

Next to the ladder, there are two safeguards that work no matter which rung you're on. The first is a set of limits the broker enforces, such as a maximum size per order or a daily loss limit, and the second is a separate pot of money, which is all the AI can ever spend. OWASP, a well-known organisation for security standards, gives the same advice for AI applications in general: decide what the AI is allowed to do in the system behind it, rather than leaving that decision to the AI. Personally, these are the controls I'd rely on most, because they still hold when the AI misunderstands what you asked, or follows an instruction someone hid in a web page it read.

## Broker by broker

Below is an overview of what each connection allows and what it blocks, based on the public documentation and announcements as of mid-October 2026. Keep in mind that availability depends on your country and account type, and that none of this is a recommendation of any broker.

**TradingView and FundedNext: look only.** TradingView's connection, in beta since September, gives the AI access to market data, research and platform functions, but not to your broker balances, positions or orders. The prop firm FundedNext launched a read-only connection in July, which means the AI can't trade, make changes to the account or change any settings.

**Interactive Brokers: prepare, you send.** Since 28 July, clients can connect any AI tool that supports MCP, not just the certified versions for ChatGPT, Claude and Grok. The AI can analyse your portfolio, research investments, keep an eye on risk and draft trade instructions, for one account at a time and after you log in on IBKR's own screen. As Interactive Brokers puts it, the client then reviews each instruction and converts it into an order on one of its platforms before anything is submitted.

**TradeStation: send after a yes.** TradeStation launched its connection on 13 January, at first only for Claude and later for ChatGPT as well. According to TradeStation, explicit confirmation safeguards are built in, so you have to review and confirm every order. StockBrokers.com couldn't find any published limits or a read-only mode, though.

**Webull: two different routes.** The hosted connection, which also powers the connectors for ChatGPT, Claude and Grok added in August, lets you choose which accounts and which types of data the AI can reach, such as balances, positions, order history and market data. It can also prepare orders, but those still need to be confirmed in the Webull app or on the desktop platform, which puts this route on the second rung. The separate local server, which has been in use since April, goes further and can place, change and cancel orders itself. Its settings let you restrict which symbols can be traded, cap each order (by default at $10,000 and 1,000 shares on the US version), preview orders, or turn trading off completely, and it starts in Webull's test environment unless you switch it to production.

**tastytrade: a yes the broker checks.** tastytrade's server is open source and runs on your own computer, as there's no hosted version. Its five order tools only work with the 60-second dry-run token described above, but seven other tools that change something, such as cancelling an order, act straight away on the first call. A single setting switches off all 14 of these tools, a sandbox account lets you trade without real money (although it has no market data and is wiped every 24 hours), and orders are capped at $50,000 of buying power by default. One thing to watch out for: if you don't change any settings, it connects to your live account.

**Moomoo: you choose the scopes.** With Moomoo's hosted connection, you choose on Moomoo's own consent page what the AI is allowed to access, for example quotes only or also trading. The access renews itself automatically, but it stops working after 14 days without use, and you can revoke it from the console at any time. StockBrokers.com reports that approval is a setting you can switch off, in which case the AI can place live trades unattended, and that Moomoo asks for your trading password before a live order.

**Robinhood: a separate account.** Since 27 May, as part of a beta, you can open a separate account for each AI agent, with its own wallet. The agent can read your whole portfolio, but it can only trade with the money you put in its wallet. For some trades it shows a preview you may have to approve, and you get a notification for every trade the agent makes. During the beta, it can only trade stocks.

**eToro: a ring-fenced portfolio.** eToro's Agent Portfolios, also in beta, are separate sub-accounts with their own API key and a minimum budget of $200. The agent can open and close positions inside that portfolio, but nowhere else. Unlike most others on this list, eToro doesn't use MCP for this.

**Public: rules approved once.** Since 31 March, you can describe a strategy to Public's AI, which asks follow-up questions and turns your description into a workflow. Once you've confirmed the logic and switched it on, it runs without asking you again, which puts it on the top rung of the ladder. In September, Public extended this to prediction markets as well.

**Axi: a yes in the chat.** Axi launched its connection on 14 October as an alpha, for MetaTrader 5 accounts and for Claude only. The AI can check prices, open, change and close positions, place pending orders and set stop-loss and take-profit levels. Every action needs your approval in the chat, unless you set it to "Always allow", and you log in with your own Axi login. MetaTrader 4 accounts can't be connected.

**Capital.com: two steps.** Capital.com launched its connection in June for part of its client base, for both research and trading. An AI can only place trades after a mandatory two-step confirmation, although the announcement doesn't say what those two steps are.

**Axiory.ai: a yes in the chat, limits at the server.** Axiory.ai launched in March and was built by Purple Technology, as mentioned in the disclosure above. It's a remote server with 19 tools and a paper mode for testing, while live trading requires an Axiory FIX API account. The AI is instructed to show its calculation and wait for your approval, which, as its documentation says itself, is guidance rather than enforcement. What the server does enforce is a chain of eight checks before any order reaches the broker, including a read-only mode, a check that only symbols from the server's own catalogue can be traded, a maximum of 20 open positions, a maximum of 2 orders per second and 10 per minute, and a daily loss limit of $2,000 by default. When that limit is hit, a kill switch cancels all pending orders and refuses new ones. You log in through your browser, and your trading credentials are encrypted and discarded once you've been authenticated.

## Your first hour

If you want to try one of these connections this week, this is the order in which I'd set it up.

1. Start on the first rung or with a demo account. Use the read-only setting where there is one, or the broker's paper or sandbox account, and spend a few days asking the AI questions about your own portfolio before you give it any order tools.
2. Check the confirmation settings in your AI app. In Claude, set every order tool to "Needs approval" and never to "Always allow", while tools that only read data can safely be allowed.
3. Set the broker's limits before you place the first live order: a maximum per order, the symbols the AI is allowed to trade and, where the broker offers it, a daily loss limit.
4. If the broker lets you give the AI its own pot of money, use it, and only put in an amount you can afford to lose entirely.
5. Make sure you know how to cut the connection: remove the connector in your AI app and revoke the access at the broker. It's worth doing this once on purpose, so you know exactly where both switches are when you need them.
6. Finally, read every order before you approve it, and check the symbol, direction, size and order type.

Whichever broker you use, the limits it enforces on its own side are what protect you when the AI gets something wrong, so it's worth spending most of that first hour on them.

This article is for information and education only and is not investment advice. Trading carries risk, and an AI connected to an account can make mistakes.

## For agents

### Facts and figures

- StockBrokers.com review, published 2026-10-07 (MCP table verified 2026-09-16): 7 of 14 brokers run a first-party MCP server (Interactive Brokers, Webull, tastytrade, Moomoo, Robinhood, Public.com, TradeStation); all launched in 2026; none charges for the connection.
- Launch dates: TradeStation 2026-01-13 (Claude first, ChatGPT later; first MCP server at a US broker according to StockBrokers.com); Axiory.ai reported 2026-03-19; Public Agents 2026-03-31, prediction markets 2026-09-24; Webull local MCP in use from 2026-04, announced 2026-06-11, hosted connectors 2026-08-04; Robinhood agent accounts 2026-05-27 (beta); Capital.com 2026-06-08; FundedNext 2026-07; Interactive Brokers any MCP tool 2026-07-28; tastytrade 2026-09; TradingView beta 2026-09; Axi 2026-10-14 (alpha).
- tastytrade: 5 order-submitting tools need a single-use dry-run token valid for 60 seconds and bound to the arguments; 7 other destructive tools have no token; `TASTYTRADE_READ_ONLY=1` withholds all 14; `MAX_ORDER_NOTIONAL_USD` defaults to 50,000; default environment is production; sandbox has no market data and resets every 24 hours.
- Webull local MCP server (US documentation): default environment `uat` (sandbox); default maximum order notional $10,000 and maximum quantity 1,000 per order; symbol whitelist off by default; read-only by limiting toolsets to account and market data.
- Webull Cloud MCP (hosted): OAuth; the user selects accounts and capability groups; order tools create order instructions that require confirmation in the Webull app or desktop platform.
- Interactive Brokers (press release 2026-07-28): the AI drafts instructions; the client reviews each instruction and converts it to an order on an IBKR platform; access is authorised for a single account.
- Moomoo hosted MCP: OAuth 2.1 with user-selected scopes on a consent page; access tokens typically 2 hours, refreshed automatically; tokens expire after 14 days of inactivity by default; revocable from the console.
- eToro Agent Portfolios: ring-fenced sub-account, scoped API key, minimum budget $200.
- Axiory.ai: 19 tools, 12 resources, 3 prompts; 8 sequential server-side risk checks; rate limits 2 orders per second and 10 per minute (configurable) with a 5-second per-symbol cooldown; maximum 20 open positions; default daily loss limit $2,000, resetting at 17:00 New York time; kill switch cancels pending orders and rejects new ones; OAuth 2.1 with PKCE; access token 1 hour, refresh token 7 days.
- MCP specification (2025-06-18): clients must treat tool annotations as untrusted unless they come from trusted servers; there should always be a human in the loop with the ability to deny tool invocations.

### Steps to reproduce

1. Pick a connection and read its documentation for three things: which tools exist, whether there is a read-only mode, and which limits the broker enforces.
2. Connect it in read-only mode or to a demo, paper or sandbox account first.
3. In the AI app, set every tool that places, changes or cancels an order to require approval.
4. Set the broker-side limits (order cap, allowed symbols, daily loss limit) before any live order.
5. Test revoking access, both in the AI app and at the broker.

### Limits

Interactive Brokers' connection and Webull's hosted connection do not submit orders; the client confirms them on the broker's own platform. TradingView's and FundedNext's connections have no order tools. Robinhood's agent accounts trade stocks only during the beta. Axi's connection supports MetaTrader 5 accounts and Claude only. tastytrade has no hosted endpoint, and its dry-run token does not establish that a person approved the order. Axiory.ai's order confirmation is an instruction to the agent, not a server-side check; its risk checks are server-side. Capital.com's announcement does not describe its two confirmation steps. Availability differs by country and account type.

### Sources and links

- StockBrokers.com, Best Brokers for Agentic Trading (2026-10-07): https://www.stockbrokers.com/guides/ai-agent-brokers
- Interactive Brokers press release (2026-07-28): https://www.interactivebrokers.com/en/general/about/mediaRelations/7-28-26.php
- tastytrade MCP server documentation: https://developer.tastytrade.com/docs/sdks-and-tools/mcp-server/
- Webull connectors announcement (2026-08-04): https://www.webull.com/news/15344695056475136
- Webull MCP announcement (2026-06-11): https://www.nasdaq.com/press-release/webull-launches-model-context-protocol-enabling-investors-trade-through-ai-plain
- Webull Cloud MCP documentation: https://developer.webull.com/apis/docs/AI-friendly-Resources/mcp
- Webull local MCP server documentation: https://developer.webull.com/apis/docs/AI-friendly-Resources/local-mcp
- Trade Informer on the Webull MCP server: https://tradeinformer.com/broker-news/webull-launches-mcp-server-for-trading-through-ai-assistants
- TradeStation press release (2026-01-13): https://www.tradestation.com/press-and-news/tradestation-securities-releases-mcp-connection-allowing-users-to-connect-trading-accounts-with-third-party-ai-platforms/
- TradeStation MCP product page: https://tradestation.com/platforms-and-tools/mcp
- Moomoo MCP authentication: https://open.moomoo.com/mcp-docs/authentication
- TechCrunch on Robinhood agent accounts (2026-05-27): https://techcrunch.com/2026/05/27/robinhood-now-lets-your-ai-agents-trade-stocks/
- eToro Agent Portfolios: https://www.etoro.com/news-and-analysis/etoro-updates/agent-portfolios-let-your-ai-agent-trade-for-you/
- Public Agents announcement (2026-03-31): https://digital-release.wowktv.com/business/press-releases/cision/20260331NY22354/public-becomes-the-first-brokerage-to-introduce-ai-agents-for-your-portfolio
- Fortune on Public's prediction-market agents (2026-09-24): https://fortune.com/2026/09/24/public-ai-trading-agents-prediction-markets-kalshi-tie-up/
- Finance Magnates on Axi and Claude (2026-10-14): https://www.financemagnates.com/forex/brokers/axi-clients-can-now-ask-claude-to-place-trades-in-their-metatrader-accounts/
- Finance Magnates on Capital.com (2026-06-08): https://www.financemagnates.com/forex/capitalcom-launches-mcp-server-for-mena-clients/
- Finance Magnates on FundedNext: https://www.financemagnates.com/forex/ai-wave-reaches-prop-firms-as-fundednext-launches-mcp-server/
- Finance Magnates on TradingView: https://www.financemagnates.com/forex/tradingview-adds-mcp-as-retail-brokers-adopt-ai-trading-tools/
- Axiory.ai MCP server: https://mcp.axiory.ai/
- Axiory.ai risk management: https://mcp.axiory.ai/docs/trading-guide/risk-management/
- Axiory.ai security: https://mcp.axiory.ai/docs/trading-guide/security/
- A-Team Insight on the Axiory.ai launch (2026-03-19): https://a-teaminsight.com/blog/axiory-ai-launches-ai-agent-trading-platform-built-on-model-context-protocol/
- MCP specification, tools: https://modelcontextprotocol.io/specification/2025-06-18/server/tools
- Anthropic, introducing the Model Context Protocol (2024-11-25): https://www.anthropic.com/news/model-context-protocol
- OWASP LLM06:2025 Excessive Agency: https://genai.owasp.org/llmrisk/llm062025-excessive-agency/

### Terms

- **MCP (Model Context Protocol)**: an open standard through which an AI app calls tools that a server, here a broker, exposes.
- **Connector**: a broker connection added to an AI app such as Claude or ChatGPT.
- **Tool**: one action the AI can call, such as reading positions or placing an order.
- **Read-only mode**: a setting in which a connection exposes no tools that change anything.
- **Dry run**: a simulated order that checks an order without sending it.
- **Kill switch**: an automatic stop that cancels pending orders and refuses new ones.
- **Paper or sandbox account**: a test account that trades without real money.

### About this piece

Hello Purple, the-map track, 2026. Purple Technology, which publishes Hello Purple, built the technology stack of Axiory.ai, one of the connections described.