Protecting Robinhood's Agentic Trading MCP with Verifiable Agent Identity

June 22, 2026 · Viswanadha Pratap Kondoju

OAuth tells Robinhood who the user is. Nothing in the MCP handshake identifies which agent generated the trade instruction. Robinhood launched Agentic Trading on May 27, 2026, allowing agents with MCP support and user authorization to call trading tools. The agent identity layer is missing.

The gap

OAuth identifies the user. MCP tool calls arrive with user auth but no standardized cryptographic agent attestation. A legitimate Claude instance and a modified fork present the same OAuth token. From the server's perspective they are identical. No portable MCP-native cryptographic attribution survives an audit. When a regulator asks "which software placed this trade at 14:32 on Tuesday," the answer today is "something with a valid user token."

What we built

We put @bolyra/gateway in front of a mock Robinhood MCP server modeled after kevin1chun/robinhood-for-agents. The gateway sits between the agent and the MCP server. It verifies ZKP proof bundles before any tool call reaches the backend. It enforces per-tool permission policies, blocks proof replays via a nonce store, and generates signed audit receipts for every decision (allow or deny).

Agent → @bolyra/gateway → Mock Robinhood MCP

verifyBundle() · checkToolPolicy() · rejectReplay() · emitReceipt()

The demo runs four scenarios:

Scenario	Agent	Tool	Result
1. Verified read	Trader (READ_DATA)	`get_portfolio`	Allowed + receipt
2. Verified trade	Trader (FINANCIAL_SMALL)	`place_stock_order`	Allowed + receipt
3. Unauthorized	Reader (READ_DATA only)	`place_stock_order`	Blocked (403)
4. Replay attack	Trader (reused proof)	`get_portfolio`	Blocked (401)

Tool permission mapping

This is the part that matters for engineers integrating with Robinhood's tool surface:

Permission Tier	Bit	Tools
`READ_DATA`	0	`get_portfolio`, `get_accounts`, `get_stock_quote`, `get_historicals`, `get_news`, `get_movers`, `get_options`, `get_crypto`, `get_orders`, `get_order_status`, `search`, `check_session`
`WRITE_DATA`	1	`cancel_order`
`FINANCIAL_SMALL`	2	`place_stock_order`
`FINANCIAL_MEDIUM`	3	`place_option_order`, `place_crypto_order`
`BLOCKED`	all	`browser_login`

Cumulative bit encoding means FINANCIAL_MEDIUM (bit 3) implies FINANCIAL_SMALL (bit 2) implies READ_DATA (bit 0). An agent credentialed at tier 3 can read quotes and place stock orders without separate grants. An agent credentialed at tier 0 cannot trade. The delegation circuit enforces this in the ZK proof (verifiable locally or on-chain), not just in the gateway config.

Run it yourself

git clone https://github.com/bolyra/bolyra.git
cd bolyra/examples/robinhood-demo
npm install
npm run demo

No Robinhood account needed. The demo uses a mock server with deterministic responses. All four scenarios run in under 5 seconds.

What this means

Robinhood's beta covers equities only. When it expands to crypto, options, and futures, the agent identity gap widens. More tool surface, more permission tiers, more regulatory scrutiny.

Bolyra adds verifiable agent attribution without changing the MCP protocol. The gateway is self-hosted, fail-closed, and generates audit receipts with cryptographic proof of every allow/deny decision. No external dependency in the trade path.

The gateway architecture is the same one from the previous post. This demo applies it to financial trading tools.

← Previous: Your MCP Server Doesn't Need Auth Code. It Needs a Gateway.

Clone the demo and inspect the signed allow/deny receipts.

View Demo on GitHub

This project is not affiliated with, endorsed by, or sponsored by Robinhood Markets, Inc. The demo uses a mock server with no connection to Robinhood's production systems.