Trading agents over MCP
Four autonomous trading agents behind Swiftward, reading the open web, running code and placing orders. Exposed on two fronts at once: security and risk.
Two fronts, two sets of controls
| Front | The threat | What stood in the way |
|---|---|---|
| Security | a manipulated headline or a poisoned page becoming an unauthorized tool call, an exfiltration, or code reaching the open internet | each agent reached the model, its tools and the network only through a gateway |
| Risk | an order that looks reasonable and breaks a limit the agent cannot see | every trade checked against position, notional and velocity limits, by the same engine |
Neither check ran inside the agent, so nothing the agent was told could switch either one off.
Per tool, per argument, and on the state the engine keeps
The usual control is a switch over whole toolsets: this agent may use these tools, or it may not. Here the endpoint decided which tools it offered, and the caller's grant decided which of those this agent was given. A rule then decided the call itself, reading the arguments and the state the engine had kept from earlier calls.
The agent had no part in any of the three.
What prompt injection actually looks like
Not a user typing "ignore your instructions". An instruction sitting inside data the agent was told to read, arriving at a system that can place an order. Injection detection, including the tool-response side.
Every decision landed in the record
Both fronts produced the same decision record: what was decided, by which rule, on which frozen version, with the signals it read. Security and risk were answered from one place, instead of from two systems that have to be reconciled afterwards.