Building a trading app on MCP

Robinhood opened up trading by AI agent. Connect an agent and you get a dedicated agent account, and Robinhood exposes the account, market data and orders through its own MCP server. I was curious, and I had money I could afford to lose. So in August 2026 I built an app on it with Cursor: a local service where an AI agent watches the market and trades a cash account inside limits it can't change.

It ran live, but keeping it running took too much work. In mid-September I moved to xAI's Grok Bot on the same Robinhood connector, and the update at the end covers what that taught me.

Not financial advice. Nothing here says what to trade, and the account itself stays out of it.

The broker's MCP server was the easy part

As of August 2026, Robinhood's MCP server listed 54 tools: account and portfolio reads, market data, stock and options orders, watchlists and a scanner. Everything I needed sat behind one protocol.

That also means an agent with a connection could, in principle, call anything on that list. So the design question was what the agent shouldn't be able to touch.

Decisions that mattered

Build it, don't fork it. An open-source project, Vibe-Trading, already does much of this. I chose not to fork it. Someone else's code touching a funded brokerage account was too much inherited risk, so I cloned the capabilities and wrote my own. My own first version was a thin TypeScript harness on the Cursor SDK, and I replaced it entirely with a Python service and a React front end.

Write my own connector, and make it deny by default. The connector handles its own sign-in and doesn't borrow Cursor's MCP login. Reads and order review are allowed. Stock orders go only through a gated path. Options orders are refused outright. The agents emit trade intents and never call place themselves.

Put the guardrails in code, not the prompt. The requirements say it plainly: agent-level rules alone aren't trustworthy. Before an order is reviewed and placed it has to clear a kill switch and the strategy's own caps, then a settled-cash check. The account is cash only, sale proceeds stay unsettled until T+1, and buys need settled cash.

Treat news as data. Some strategies use a model to judge whether a headline meets a condition. The headline goes in marked as untrusted, the model can't call tools, and it answers in a fixed JSON shape. Only a true or false reaches the engine. A model can still say yes when the answer is no, and the security review leaves that open.

Dry-run first. Dry-run is on by default. The app logs every trade it would have made and never calls review or place until I turn it off. Once it's off there's no per-trade approval. The app restates each strategy in plain language, and the only human gate is my confirm.

What Cursor was good at, and where it hit walls

The build ran in stages, and the next stage didn't start until the current one met its done criteria. Cursor worked through that staged plan and the guardrails well.

Getting it set up and keeping it running was the painful part. Going live is a list of operator steps: sign in from the command line, start the API, confirm a strategy, start the monitors, run a dry-run week, fund the account, then turn dry-run off.

As of August 2026 the agent's decisions defaulted to OpenAI's gpt-4o-mini.

The app got through Stage 6, the web UI, with a security review and a go-live runbook written, and it ran live. Running it meant a VM and the Cursor CLI, and that was more upkeep than I had time for. That's where I left it.

Update, October 2026: Grok Bot and a rule

As of October 2026, Grok Bot is xAI's take on AI teammates: bots with their own computer that sign in to your tools, run routines on a schedule and come back when they need your approval.

The ground rules started stricter than my own app's. The AI confirms with me before any order, and sizes stay tiny. Robinhood has no true paper-trading mode, so Grok Bot and I built our own paper book. Positions are flat overnight. On every look the AI logs a decision and the reason, skips included.

In October the broker's limits caught up with us. With the AI checking in every 15 minutes, I found that Robinhood doesn't allow resting stop orders on fractional shares and has no trailing or bracket orders. Between checks, a paper stop slipped past its level.

That gave me the rule I work by now: AI makes decisions, code does the mechanical work. The AI picks entries. Code watching prices handles the exits.

After watching it for a while, we tightened the AI's check-ins from 15 minutes to 5. Some positions still moved too fast for that, so we built a code monitor that checks every 30 seconds. When an exit hits, it hands off to a separate routine that can only sell. It re-checks the price, then sells. Nothing new went live until that path tested OK, and then only with a daily loss limit.

The interesting part was how much took only a prompt. I could backtest and modify strategies, turn on paper trading and build a dashboard of results per strategy, which became a local web page with a filterable trade history. We numbered the strategies 1 through 8 so it's always clear which one we mean.

As of late October most of them run on paper and one small one runs live. Over six weeks the AI went from making every call on a timer to choosing only the entries, and the reason was what the broker's tools can and can't do.

What changed in three months

When I started in August, the tools hadn't come as far as they have now. I still thought of Cursor as an AI-assisted IDE. Using Claude and ChatGPT in different ways pushed me past that, and I started treating Cursor as an AI assistant for my entire computer.

Since then the tools have been moving toward the same set of features from different directions, and all of them toward more independence. The harnesses keep gaining capabilities. I experiment with most of them: Cursor, ChatGPT, Claude, OpenClaw, Hermes. As of October 2026:

• Grok Bot gives each bot its own computer, signed in to your tools.
• Meta's Muse launched on September 8, 2026, after I'd started. It runs on a dedicated virtual machine and can open a browser, fill out forms and book travel.
• Nous Research's Hermes Agent is open source, remembers how it solved a problem and schedules its own reports.
• OpenClaw is open source too, and I still use it. In August that wasn't something I trusted yet.

In August I built the plumbing myself: the connector, the sign-in, the VM. By October the tools brought their own. What none of them brought was the decision about what the AI owns and what code owns. That part is still mine.