Every other agent framework loads the exchange key into the agent process, where a prompt injection or a stray log line can leak it; here the key exists only inside the enclave and the MCP server can ask for a signature but never read it. The honest catch is that nothing in the tool surface tells you which venue and network your policy points at — read place_order and confirm with the token issuer before sending size.
The MCP face of Usenami Signer. It gives an agent a six-tool surface for trading perp accounts on Binance, OKX, Asterdex, KuCoin, Bybit and Hyperliquid without the API secret ever entering the agent's process. The key is generated inside an AWS Nitro Enclave and the enclave's measurement is published, so you can check that the code signing your orders is the code that was audited.
- list_venues — the venues this Signer can sign for, with each one's asset class (perp, spot or margin) and auth scheme (hmac, eip712 or ed25519); a static manifest compiled into the package, so it makes no network call
- get_attestation — the enclave's live AWS Nitro attestation document with its PCR0, PCR1 and PCR2 measurements and AWS signature
- get_account — equity, free margin and open positions for a venue; read-only, and the call to make before ordering
- place_order — a single order on a named venue, taking a canonical symbol and a quantity in the base asset and translating both to the venue's native format
- place_hedge — a two-leg market hedge signed atomically inside the enclave, so if either leg fails policy nothing executes, then fired at both venues in parallel
- cancel_order — cancel by venue order id, signed in the enclave like an order, and idempotent on an order that is already gone
Access is invite-based during the pilot; the token is provisioned at onboarding and bound to a policy with per-venue and per-period caps. Clients run npx -y @usenami/signer-mcp@^0.6.0 over stdio with SIGNER_GATEWAY_URL and SIGNER_API_TOKEN. Pin at ^0.6.0 — every release up to 0.5.0 defaulted the gateway URL to a host that redirects to a landing page, so the network tools received HTML. list_venues and get_attestation need no token. Which venue and network your orders reach is decided by the policy bound to your token: assume mainnet unless whoever issued it told you otherwise.
One command plus a key — npx -y @usenami/signer-mcp@^0.6.0, then supply credentials