← All posts

· XingAI Invest AI

Read-First MCP: Robinhood Agentic Trading and ADR-028 Execution Gates

Robinhood's Agentic Trading MCP lets third-party agents read portfolio data and place trades in a dedicated Agentic account. Users can even configure auto-execute without per-trade confirmation.

XingAI's position is the opposite: read-first MCP, write only after human approval. That is not marketing — it is ADR-028.

Why an ADR for a wiki page?

We already document the tool catalog in the Robinhood MCP wiki. Wiki explains what the tools do. ADR-028 defines when Invest AI may call them — enforceable in code review.

Related: ADR-003 MCP phased rollout, ADR-014 structural risk mitigations, Decision Engine ADR-003 human-in-the-loop.

Phase 1: read-only

Allowed nowBlocked until gates pass
get_portfolio, quotes, watchlistsplace_equity_order, place_option_order
Dev sandbox / engineering skillsProduction one-click trade
Display-only enrichmentAuto-exec without user confirm

MCP read tools must not alter cached decision scores (ADR-012).

Gates G1–G7 (all required for write tools)

GateRequirement
G1User explicitly confirms each order in UI
G2Step-up auth (extend ADR-024 OTP pattern)
G3Worker data freshness green — no trade if degraded
G4ADR-014 structural risk checklist
G5Order ticket cites cached v2:dashboard:today — not live LLM invention
G6Agentic account only (Robinhood policy)
G7Audit log: user, timestamp, tool, params hash, decision snapshot id

Skip any gate → rejected for production write tools.

Phased rollout R0–R3

PhaseCapabilityInvest AI surface
R0Read tools in devNo trade button
R1Read portfolio in settingsHoldings overlay
R2Draft order from cached recommendationUser confirms in modal
R3MCP place order after G1–G7Logged execution + receipt

Cursor skills: rh-mcp-read-* allowed; rh-mcp-trade-* gated until R2. Env XINGAI_MCP_TRADE_ENABLED=true never defaults on.

Decision Engine stays out of execution

Decision Engine never calls Robinhood MCP. It outputs recommendations only. Execution lives in Invest AI (or the user's agent environment) with audit.

What we said no to

  • Full auto-trader via MCP — liability and brand mismatch.
  • MCP inside FastAPI request path — breaks cache boundary and audit.
  • Wiki-only guidance — insufficient for enforcement.

Further reading: June 24 Opportunity Radar · MCP architecture best practices