← Ayo Osunjuyigbe

· AI

Binance has an official MCP now. Do not use the one with your API key in mcp.json.

Thursday Binance shipped Agent OS and a first-party MCP. Streamable HTTP. https://agent.binance.com/mcp/agentic. ChatGPT, Claude Code, Codex, Cursor. Control sits on the account — granular access, not a blank cheque. That is the only part of the launch I care about.

I have been watching people paste BINANCE_API_KEY into Claude Desktop since the unofficial servers showed up last May. npx -y something with Binance in the name. One of them advertises 478 tools and credentials never leave your machine. Thursday did not make that install official. It made it the wrong object.

What shipped

Agent OS is a bundle: the existing APIs, a Wallet Agentic Hub, x402 for programmable payments, a Skill Hub, and MCP. The MCP piece is the one that lands in your host.

The initial server, in their words: market data, read-only account information, and placing trades. You can assign the agent a dedicated subaccount, set permissions, revoke when you want. It can see that subaccount’s balances, portfolio, and transaction history. It can also see balance and portfolio on the main account. It cannot see email or KYC. They will monitor the orders. They will not see the agent’s prompt, the other MCP servers in the same window, or why the model clicked sell. They said that out loud: they really cannot see the reasoning.

The sentence the launch post buried: withdrawals from those subaccounts are blocked by default. You can require approval on every order, or let the agent execute once the permissions are set. There is no separate loss cap. The amount you transfer into the box is the limit.

The important part: a blast radius you chose, not a key that can withdraw because a README said complete coverage.

I am not writing a setup guide. The endpoint is public. The permission screen is the article.

The unofficial server was a signing oracle

AnalyticAce published an unofficial Binance MCP on 26 May 2025 — designed to support developers building crypto trading AI Agents, BINANCE_API_KEY / BINANCE_API_SECRET in the environment, BINANCE_TESTNET defaulting to false. create_order. Balances. Futures PnL. Deposit address and withdraw history. The install is the same one Invariant already measured: a command in mcp.json.

In January a TypeScript server went up that is honest about the surface. Spot, margin, USD-M and COIN-M futures, options, portfolio margin, earn, staking, loans, VIP loans, wallet deposits and withdrawals, convert, Pay, gift cards, copy trading, mining, NFT, P2P, fiat. 478+ tools. Dual transport: stdio and SSE. The README’s security line is API credentials never leave your machine. Then it shows you how to put those credentials in claude_desktop_config.json and in Cursor’s MCP env block. SSE is not your machine. A cloud agent’s Secrets tab is not your machine. @latest on npm is not a pin.

Binance’s own API FAQ, last updated 20 March 2025, is older than MCP and still the control. System-generated HMAC keys with unrestricted IPs are read-only. To turn on trading you IP-restrict, switch to Ed25519 or RSA, or disable the default. Withdraw requires an IPv4 allowlist. That is the exchange saying: a key that can move funds is a key that only answers from addresses you named.

The community MCP does not enforce that. It will happily sign whatever the model asked, with whatever scopes you ticked in API Management when you wanted the demo to just work. If you enabled withdraw so a tool named withdraw would not 403, you handed the model a withdrawal API. If you did not, you still handed it every trade endpoint in a catalog no human reads. Invariant’s finding was that the description is prompt and the user never sees the full string. Four hundred and seventy-eight descriptions is not a feature. It is a second system prompt you did not write, refreshable on the next tools/list.

I am not going to write the drain. The shape is enough. A tool the UI labels place order can be shadowed by a docstring the way send_email was. The host confirms an add. The exchange receives a signed request. Binance, on Thursday’s server, at least told you they will not see the reasoning — only the order. On the unofficial server they see the order too. The difference is whose key signed it, and whether that key was allowed to leave the building.

A subaccount is a permission system. A prompt is not.

When they asked what happens if the agent is prompt-injected, the answer was the subaccount. That is the honest one. Don't sell everything in the chat is the Replit freeze. Eleven times. The agent has a trade tool. The tool works.

The official MCP’s actual control is the box you funded. If the subaccount holds what you can lose, a confused or injected model can still lose it — spot, futures, whatever you granted — and it cannot withdraw off-platform while that default holds. That is not safe. That is bounded. Binance will not add a second ceiling. Li already said that.

Confirm-every-order is a toggle, not the architecture. If you pick autonomous, you picked the freeze with a fill. If you pick confirm, the confirm is still on the order, not on the story. Size, symbol, side, type, the subaccount name. A surface the docstring cannot restyle. If the host cannot show those arguments, the trade tool stays off — including the official one.

The main portfolio being visible is already more than I wanted. The model does not need my net worth to place a test order. I will treat that read as recon I opted into. Same rule as a cloud agent: prod credentials do not go in the Secrets tab.

I will not install the 478-tool server next to the official one for the endpoints Agent OS has not shipped. That is how you get a withdraw description in the same context window as a read-only official catalog. Multi-server trust is implicit. We measured that.

What I do now

The official endpoint, or nothing that trades. Streamable HTTP to agent.binance.com. Subaccount I created and funded with what I can lose. Confirm on every order. Permissions I can revoke without rotating a secret that has been in three mcp.json files. If Agent OS is not on my account, I do not fall back to npx. I read the ticker in a browser.

HMAC on the main account is not an MCP integration. If I still need a local bot, the key is read-only or trade-on-a-subaccount, IP-restricted to that box, withdraw off. Testnet is a flag you set before the first call, not after. Binance’s FAQ is the spec. The npm README is not.

Pin the catalog. Official or not: hash name + description + inputSchema on first approve. Four hundred tools is a rug waiting to happen. I do not need Pay and gift cards in the same process that can see a price.

Do not put the unofficial server on a cloud agent. The last piece I wrote was about the laptop closing. The secret in the dashboard is the machine. SSE plus a hosted Cursor VM is the opposite of never leaves your machine.

Thursday gave us an exchange-shaped MCP: a subaccount, a revoke button, and a vendor who will not look at the prompt. That is better than a secret in JSON. It is still a model with a trade tool. Fund the box like you will not get the money back. Because if the description wins, you won't.

References