MCP SERVERPlace and cancel exchange orders from an agent while the signing key stays inside an attested AWS Nitro Enclave.
LABSCO SUMMARY
Every other agent framework loads the exchange key into the agent process, where a prompt injection or a stray log line can leak it; here the key exists only inside the enclave and the MCP server can ask for a signature but never read it. The honest catch is that nothing in the tool surface tells you which venue and network your policy points at — read place_order and confirm with the token issuer before sending size.
The MCP face of Usenami Signer. It gives an agent a six-tool surface for trading perp accounts on Binance, OKX, Asterdex, KuCoin, Bybit and Hyperliquid without the API secret ever entering the agent's process. The key is generated inside an AWS Nitro Enclave and the enclave's measurement is published, so you can check that the code signing your orders is the code that was audited.
Access is invite-based during the pilot; the token is provisioned at onboarding and bound to a policy with per-venue and per-period caps. Clients run npx -y @usenami/signer-mcp@^0.6.0 over stdio with SIGNER_GATEWAY_URL and SIGNER_API_TOKEN. Pin at ^0.6.0 — every release up to 0.5.0 defaulted the gateway URL to a host that redirects to a landing page, so the network tools received HTML. list_venues and get_attestation need no token. Which venue and network your orders reach is decided by the policy bound to your token: assume mainnet unless whoever issued it told you otherwise.
One command plus a key — npx -y @usenami/signer-mcp@^0.6.0, then supply credentials
USE CASES
Read the venue manifest and pull the live attestation document before trusting the setup.
Read equity, free margin and open positions on the venue first.
Send the smallest size your policy allows in the base asset and let the server translate it to the venue's format.
Sign both legs together so nothing executes unless both pass policy.
Cancel the outstanding order by its venue id.
Counted once with only startup setup. Other versions, modes or optional credentials may expose a different list.
cancel_orderCancel an outstanding order by its venue order_id. Signed inside the enclave just like place_order. Returns the cancellation receipt from the venue. Idempotent: cancelling a non-existent / already-filled order returns ok=false with a reason from the venue.
get_accountReturn equity, free margin, and open positions for a venue. Read-only (does not sign anything that mutates state). Use BEFORE place_order to confirm the account has margin. Requires SIGNER_API_TOKEN.
get_attestationReturn the Signer enclave's AWS Nitro attestation document (PCR0, PCR1, PCR2 measurements + AWS-issued signature). This proves the code currently signing your orders matches the published source. The enclave's signing key NEVER leaves attested code. Verify the PCR0 against https://usenami.io/signer/attestations before trusting any place_order.
list_venuesList the venues this Signer can sign trades for. Returns the venue id, asset class (perp / spot / margin), and auth scheme (hmac / eip712 / ed25519). Read-only static manifest — does NOT need the Signer gateway to be reachable. Call this first to discover what's signable.
place_hedgePlace a 2-leg MARKET hedge ATOMICALLY: both legs are signed inside the enclave (if either leg fails policy, NOTHING executes), then the gateway fires both venue calls in parallel server-side — minimal leg gap, works even when a venue geo-blocks your residential IP. Accepts canonical symbol (BTC) + qty in BASE ASSET per leg (contract venues converted, translation echoed per leg). Result status: executed (both venue receipts accepted) | partial (ONE leg live — naked position, repair via legs[].outcome) | unknown (a receipt was lost — that leg MAY be live: reconcile with get_account BEFORE any retry, never blind-retry) | failed (both rejected, safe to retry). Market orders only in v1. Side effect: real or testnet trades.
place_orderPlace a single order on the named venue. Accepts canonical symbol (BTC / BTCUSDT) and qty in BASE ASSET; translates both to the venue's native format (okx sizes in contracts) and echoes the translation in the result — always check translation.sent to see what actually hit the exchange. The Signer enclave signs the venue-native payload using a key that has never been exported. Policy enforced server-side: orders that exceed per-asset caps are rejected by the enclave before signing. Returns the venue's order_id on success. Side effect: real or testnet trade depending on venue env.
BEFORE YOU INSTALL
6 tools when we connected. Only list_venues and get_attestation work without SIGNER_API_TOKEN. place_order, place_hedge and cancel_order support only binance and okx in v0.
CONTEXT COST
Rated by the size of the 6 tool definitions that ride along on every turn, not by how many there are
INSTALLATION
npx -y @usenami/signer-mcp@^0.6.0{
"mcpServers": {
"signer": {
"command": "npx",
"args": [
"-y",
"@usenami/signer-mcp@^0.6.0"
],
"env": {
"SIGNER_GATEWAY_URL": "https://signer-demo.usenami.io:8443",
"SIGNER_API_TOKEN": "<YOUR_SIGNER_API_TOKEN>"
}
}
}
}Install the plugin in your ElizaOS project:
npm install @usenami/plugin-signerAdd it to your character's plugins and put SIGNER_API_TOKEN under settings.secrets (SIGNER_GATEWAY_URL only if you self-host; it defaults to the hosted demo enclave). The plugin's README shows the full character snippet.
{
"plugins": [
"@elizaos/plugin-mcp"
],
"settings": {
"mcp": {
"servers": {
"signer": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"@usenami/signer-mcp@^0.6.0"
],
"env": {
"SIGNER_GATEWAY_URL": "https://signer-demo.usenami.io:8443",
"SIGNER_API_TOKEN": "<YOUR_SIGNER_API_TOKEN>"
}
}
}
}
}
}MCP servers
keel-trade
ethancod1ng
dlwjdtn535
BCusack