Security, Scopes, and Credits
MCP gives an external agent access to Algo Trade Analytics research tools, so the connection is treated as a scoped research integration. It does not grant broker execution rights and it does not bypass Algo Trade Analytics billing or evidence policy.
Entitlement
Section titled “Entitlement”MCP Agent Access requires one of:
- Professional plan,
- beta access,
- Professional access or an admin-granted beta entitlement.
Basic users can still use Algo Trade Analytics’s native in-app workflows. External MCP clients are the advanced integration surface.
Scopes
Section titled “Scopes”| Scope | Allows |
|---|---|
mcp:read | Read Algo Trade Analytics context, resource metadata, tool metadata, reports, Case Studies, evidence maturity, and research state. |
mcp:research:write | Create or update research runs, hypotheses, experiment protocols, task progress, and workflow records. |
mcp:candidate:write | Stage or update strategy candidates where server-side gates allow it. |
mcp:memory:write | Save durable research memory and lessons into Algo Trade Analytics. |
Grant the narrowest scopes the client needs. Write scopes do not authorize trade placement.
OAuth vs Manual Tokens
Section titled “OAuth vs Manual Tokens”| Path | Use when | Secret handling |
|---|---|---|
| OAuth | The MCP client can open a sign-in flow. This is the recommended path. | No bearer token is pasted into the client. The client stores its OAuth grant. |
| Manual API key | The client cannot complete OAuth, or an API-side MCP call needs an explicit authorization value. | Create a scoped token in Algo Trade Analytics, copy it once, store it as a secret, and revoke it when done. |
Credits
Section titled “Credits”Your external client may spend its own model tokens while planning and reasoning. Algo Trade Analytics credits are separate.
Algo Trade Analytics credits can still be consumed when MCP starts Algo Trade Analytics-hosted or server-side work, including:
- server-side agent/research jobs,
- paid backtest and validation tools,
- heavy sweeps and robustness checks,
- hosted AI work performed by Algo Trade Analytics,
- candidate/evidence workflows that reserve a budget.
Using MCP does not bypass Algo Trade Analytics credits. It lets your external agent decide what to run, while Algo Trade Analytics meters the Algo Trade Analytics-hosted work it performs.
Revocation
Section titled “Revocation”- OAuth: use Revoke OAuth access on Dashboard > MCP Access. The client must sign in again before calling MCP.
- Manual API keys: revoke individual tokens from the manual token table.
- Lost token: revoke it and create a new one. Algo Trade Analytics cannot show the full token again after creation.
Revoked OAuth connection rows can remain visible as an audit/status record. A revoked row is not an active grant; it tells you that clients must authenticate again before calling MCP.
Safety Boundaries
Section titled “Safety Boundaries”MCP tools can read research state and, with write scopes, mutate research records. They cannot:
- place broker orders,
- modify your broker account,
- change your TradingView account,
- silently accept staged code into your active editor tab,
- prove that a strategy is safe for live capital.