Over the past year, the retail FX and CFD industry has seen a wave of AI integrations, and AI agent trading has become a built-in feature on the platforms brokers rely on.

MetaQuotes introduced native support for the Model Context Protocol (MCP), the open standard that allows AI agents to use external tools, in MetaTrader 5, while Spotware launched cTrader AI Agent Connect. Match-Trade first launched an MCP for brokers, then extended it to traders.

London’s trading industry is coming home!

On these platforms, traders can connect external AI agents such as Claude, allowing them to perform trading operations on a live account.

Beyond the official platform servers, there are several other MCP setups that matter to dealers, from open-source bridges to custom servers that traders build themselves. Each setup creates risks in different ways, but they share one core consideration: brokers have no clear way to tell when AI is making the trading decisions.

Dealers have dealt with automated trading for years and know how to identify it. Algo trading, such as the use of Expert Advisors (EAs), is nothing new, and platform providers such as MetaQuotes make it easy for dealers to identify EA orders. AI agent trading, however, is harder to detect.

What MCP Is and What an AI Agent Can Actually Do

MCP is an open standard that sets common rules for how AI agents connect to other software. It is like a universal plug for AI. Instead of building a separate connection for every AI tool, a trading platform or third party builds an MCP server, and any compatible AI agent can connect to it.

That server offers the AI a list of actions it is allowed to take. Once the trader connects their AI agent to the server, they can simply make a request such as “close my EURUSD position”, and the AI executes the instruction.

What the AI can do depends on the setup, but on the official platform servers, almost anything a trader can do by clicking on the platform can now be done by an AI agent on their behalf. That matters for dealing desks because they tend to make decisions and handle each trader’s flow based on their past trading activity.

Setting it up is simple. With remote setups, the trader gets a token for each trading account and pastes it into their AI tool. With local setups, the AI connects through the platform running on the trader’s computer. In both cases, the trader can usually choose whether the AI is allowed to trade and whether each trade needs their approval.

If approval is turned off, the AI can open, modify and close real trades on its own.

For the dealing desk, three things stand out. First, the settings that control what the AI can do are in the client’s hands. Second, with remote setups, the access token sits in a third-party AI tool that the broker has no control over. Third, with local setups, the AI’s orders go through the same login session as the trader’s own clicks, so they may look the same to the broker.

Beyond the Official Servers: Other MCP Setups and Safety Controls

The official MCP servers, such as those built by MetaQuotes and Spotware, are not the only way to connect an AI agent to a trading account. Traders can also use open-source MCP servers, which link AI agents to trading platforms through their existing APIs.

Some vendors offer hosted versions, run by a company as a service, that work across several platforms at once. Traders with coding skills can also build their own custom servers.

Safety controls depend on whoever built the server. This matters because AI agents can make mistakes, and when they are connected to a live account, a mistake becomes a real trade. The official servers let traders keep the AI read-only until they trust it or require approval for each trade before it goes through.

Other setups may not offer these controls. For dealers, this means real trades can come from untested software, with no way for them to know.

With hosted versions, the trader’s login details or access token sit with a third-party company. Because these servers are not built by the platform provider, there is no record available to the broker of what the AI did or why. The orders reach the platform through its regular API or terminal, just like any other order.

However, some setups do give the broker visibility. ThinkMarkets, for example, has started offering its own MCP server. In that case, the broker controls the server and can see what the AI does. But this is only possible because ThinkMarkets runs its own trading platform. Brokers that do not own a trading platform depend on the provider for this kind of visibility.

Human, EA or AI Agent: Can the Desk Tell the Difference?

Not always. Platforms such as MetaTrader indicate to the dealer whether an order was placed from the desktop, mobile, web or by an EA. This information is recorded and available to the dealing desk, which uses it to spot algo trading and manage risk.

However, from my own experience working at major brokers for years, dealing desks have trouble even identifying EA trading, as some traders have found ways to bypass the platform’s ability to identify it. Instead of “EA”, the back-end software used by dealers shows, for example, “mobile” as the source. For AI agents, there is no label at all.

Some open-source MT5 MCP servers only work if the trader turns on algorithmic trading in the terminal. In those setups, the AI’s orders may appear with the EA label. The AI still has no label of its own, and the desk may simply see it as another EA.

Trading behaviour usually helps where labels fail. I have worked extensively on client profiling, with the goal of proper risk management and optimal book allocation (A-book versus B-book). Experienced dealers can identify human trading because human traders act at uneven speeds, deviate from their strategies due to psychological factors, and usually trade during active market hours.

An EA trades only when specific criteria in its code are met, so it follows a clear pattern. EAs usually rely on technical analysis rather than fundamental analysis (news, interest rates and inflation). Only automated systems can send orders one after another within milliseconds, which is a clear sign of automated trading.

An AI agent, however, takes everything into account. Its behaviour is mixed and random, making it difficult to identify.

Can a dealer find real proof that an AI is trading? Yes, but only through the MCP server. The server can record which account the AI used and every action it took. As mentioned earlier, brokers only have access to these records if they run their own server or the platform provider shares them. For most brokers, that information is out of reach.

The MCP Risks for Dealing Desks

AI agents make book allocation decisions even more difficult. A client profiled as a losing manual trader may suddenly trade with the speed and discipline of a machine and even start making large profits, while the dealing desk still treats the flow as safe to internalise. This makes the ongoing assessment of client profiles an even more crucial part of risk management.

Correlated flow and concentrated exposures can become more common. Many traders use the same AI models, prompts and open-source MCP servers. They may react in the same way to market conditions, trading in the same direction at the same time. That concentration can turn into a sudden and serious exposure.

AI can make mistakes. AI agents can misread an instruction, unlike an EA, which simply runs its code. This creates the risk of disputes. Without the MCP server’s records, the broker cannot show what the AI did, what the client instructed or who is responsible.

This can lead to complaints, reputational damage and questions from regulators, who expect brokers to know their clients and keep proper records of their trading. An AI agent could also trigger suspicion of market manipulation without anyone intending it.

AI agents can also be misled by false information. They can connect to not just one but many MCP servers and may use faulty third-party tools, incorrect prices, incomplete calendars and potentially inaccurate add-ons.

Fake or compromised information can feed into the AI, which may then trade based on it. The broker sees only normal orders. The trader, on the other hand, may lose money without understanding why and could complain to the broker.

Security risks exist as well. With hosted MCP servers, the trader’s login details or access token sit with a third-party company. Some open-source servers also run using the trader’s login and password, with code that nobody may have checked. If either is hacked or misused, someone else could trade on the account, and to the broker, these trades would look like the client’s own.

The Bottom Line on the MCP Risk

AI agent trading is now available on several of the platforms brokers use, and its use by traders is expected to grow. The problem is that most brokers cannot see whether AI is being used, unlike with EA trading. Without the ability to identify AI trading, the dealing desk makes risk decisions based on client profiles that may no longer reflect who, or what, is actually trading.

From my experience, client profiling has always been one of the desk’s most important risk management considerations, especially for book allocation decisions.

AI agents make profiling harder, and dealers need to review profiles more often, watch for sudden changes in behaviour, closely monitor correlated flow and push platform providers to label MCP orders. AI agent trading is a risk brokers cannot ignore, and the sooner they start tracking it, the better.

This article was written by Marios Kyriakou at www.financemagnates.com.Retail FXRead More

You might also be interested in reading Coinbase Files for National Trust Charter to Bridge Crypto and Traditional Finance.