· XingAI Invest AI
Read-First MCP: Robinhood Agentic Trading and ADR-028 Execution Gates
Robinhood's Agentic Trading MCP lets third-party agents read portfolio data and place trades in a dedicated Agentic account. Users can even configure auto-execute without per-trade confirmation.
XingAI's position is the opposite: read-first MCP, write only after human approval. That is not marketing — it is ADR-028.
Why an ADR for a wiki page?
We already document the tool catalog in the Robinhood MCP wiki. Wiki explains what the tools do. ADR-028 defines when Invest AI may call them — enforceable in code review.
Related: ADR-003 MCP phased rollout, ADR-014 structural risk mitigations, Decision Engine ADR-003 human-in-the-loop.
Phase 1: read-only
| Allowed now | Blocked until gates pass |
|---|---|
get_portfolio, quotes, watchlists | place_equity_order, place_option_order |
| Dev sandbox / engineering skills | Production one-click trade |
| Display-only enrichment | Auto-exec without user confirm |
MCP read tools must not alter cached decision scores (ADR-012).
Gates G1–G7 (all required for write tools)
| Gate | Requirement |
|---|---|
| G1 | User explicitly confirms each order in UI |
| G2 | Step-up auth (extend ADR-024 OTP pattern) |
| G3 | Worker data freshness green — no trade if degraded |
| G4 | ADR-014 structural risk checklist |
| G5 | Order ticket cites cached v2:dashboard:today — not live LLM invention |
| G6 | Agentic account only (Robinhood policy) |
| G7 | Audit log: user, timestamp, tool, params hash, decision snapshot id |
Skip any gate → rejected for production write tools.
Phased rollout R0–R3
| Phase | Capability | Invest AI surface |
|---|---|---|
| R0 | Read tools in dev | No trade button |
| R1 | Read portfolio in settings | Holdings overlay |
| R2 | Draft order from cached recommendation | User confirms in modal |
| R3 | MCP place order after G1–G7 | Logged execution + receipt |
Cursor skills: rh-mcp-read-* allowed; rh-mcp-trade-* gated until R2. Env XINGAI_MCP_TRADE_ENABLED=true never defaults on.
Decision Engine stays out of execution
Decision Engine never calls Robinhood MCP. It outputs recommendations only. Execution lives in Invest AI (or the user's agent environment) with audit.
What we said no to
- Full auto-trader via MCP — liability and brand mismatch.
- MCP inside FastAPI request path — breaks cache boundary and audit.
- Wiki-only guidance — insufficient for enforcement.
Further reading: June 24 Opportunity Radar · MCP architecture best practices