Philosophy
Agents should operate at the lowest autonomy level that accomplishes their task. Each level upward trades human oversight for agent independence.
Safety Tiers (the underlying mechanism)
Every cdcx MCP tool is classified into one of four tiers:
| Tier | Agent Behaviour | Example |
|---|---|---|
read |
Runs freely, no acknowledgement | cdcx_market_ticker |
sensitive_read |
Runs freely, no acknowledgement | cdcx_account_summary |
mutate |
Requires acknowledged: true in tool arguments |
cdcx_trade_order |
dangerous |
Refused unless server was started --allow-dangerous |
cdcx_trade_cancel_all, cdcx_funding_withdraw |
Level 0 — Read-only
Agent can observe the market but cannot touch the account.
cdcx mcp config --reset # ensures only market is enabled
Use for: market research agents, price alerts, chart commentary.
Level 1 — Paper
Agent can read live market data plus read authenticated account info; any actual trading is paper-only and handled CLI-side (not via MCP).
cdcx mcp config --enable account
Pair the MCP server with shell access to cdcx paper for simulated execution. Paper has no MCP tools; execution stays outside the agent's tool surface.
Use for: strategy research with real account context, backtest harnesses.
Level 2 — Supervised Live
Agent can place and cancel real orders, but every mutation requires explicit acknowledgement from the host application (human-in-the-loop).
cdcx mcp config --enable account,trade,advanced
The agent calls cdcx_trade_order; the host MUST echo the intent to the human and only pass acknowledged: true once approved. Dangerous tools (cancel-all, withdraw) are refused at the server since allow_dangerous is not set.
Use for: semi-automated trading with human oversight, production with guardrails.
Level 3 — Autonomous
Agent executes anything without per-call confirmation. Dangerous tier is available.
cdcx mcp config --enable account,trade,advanced,funding
cdcx mcp config --allow-dangerous
Even at level 3, mutate tools still require acknowledged: true in the tool arguments — but an autonomous agent will pass it automatically without a human prompt. --allow-dangerous additionally unlocks cancel-all and withdrawals.
Use for: fully automated strategies with external risk controls (position limits, drawdown circuit breakers, monitoring alerts). Rare in production.
Promotion Criteria
| From → To | Requirement |
|---|---|
| 0 → 1 | Agent correctly interprets market data, no hallucinated instruments |
| 1 → 2 | Strategy is profitable or sound on paper; agent handles API errors gracefully |
| 2 → 3 | Agent has operated supervised without unexpected actions for a meaningful period |
Service Group Reference
Valid MCP service groups: market, account, trade, advanced, margin, staking, funding, fiat, otc, stream.
accountalso exposeshistory(orders/trades/transactions)fundingmaps to thewalletCLI group (deposit/withdraw/networks)paperis not an MCP group — paper trading is CLI-onlycdcx mcp config --enable allis a shortcut to enable everything
Notes
- Withdrawals (
funding withdraw) should only be unlocked at Level 3 and only with--allow-dangerous; they are the highest-risk action available - You can run multiple cdcx MCP servers side by side with different autonomy levels (one agent at level 1, another at level 2)
allow_dangerousonly affects the dangerous tier. Mutate tools always needacknowledged: trueregardless