盤點 14 個券商 MCP 伺服器，只有 3 個要求逐筆確認訂單

Brokers are shipping MCP servers so you can connect Claude, ChatGPT or Cursor straight to a brokerage account. I track every official one, from each broker's own docs, and asked one question: when the agent decides to trade, who actually places the order?

Of 14 servers:

The AI trades directly (6): Alpaca, Longbridge, NinjaTrader (beta), moomoo, Public and Tradier. Once connected with trading permission, the agent's order goes through. Some let you narrow the tools, but there's no confirmation step on the broker's side.
You confirm each order (3): tastytrade (a single-use confirmation token from a dry run, valid 60 seconds), TradeStation (explicit confirmation before every order) and eToro (every action is proposed for your review).
Approval is optional (4): Interactive Brokers (you approve each order unless you opt in to its autonomous mode), Robinhood (a trade-approvals toggle, off by default), Axi on MT5 (approval is your AI client's prompt, and "Always allow" skips it) and CCXT (preview and confirm by default on live accounts, configurable).
You place the order yourself (1): Webull creates order instructions that you confirm in the Webull app.

Your AI client's prompt is not a safety control

Several servers rely on the client asking "Allow this tool?". That prompt is one click from "Always allow", and it can't tell a $50 order from a $50,000 one. A confirmation enforced by the broker, or by something outside the model, is a different thing from a prompt the agent's host shows you.

What to do before you connect an agent

Start in paper. 9 of the 14 document a paper, demo or sandbox mode.
Grant read-only first. 11 of 14 document scopes, read-only modes or per-tool permissions.
Use a separate account funded with only what the agent may lose.
Check withdrawals. 10 of 14 document that the MCP can't move money out. Know which one you're using.
Put hard limits outside the model.

The tool I built for point 5

I wanted per-order and daily dollar caps that the agent can't talk its way around, so I built TAS Guard, an open-source stdio proxy that sits between your AI client and any broker or exchange MCP server. It reads each order before it reaches the broker:

per-order and daily value caps, plus orders per minute and per day
symbol allow and block lists, optional buy-only mode
large orders, live-money orders and "close everything" held for a human, with approvals from your phone through your own Telegram bot (optionally phone-only, so the agent can't approve itself)
withdrawals, transfers, leverage changes and unrecognized tools blocked by default
a kill switch, and a hash-chained audit log

Verified profiles exist for Alpaca's MCP server and CCXT's. Anything else runs in a conservative heuristic mode. It's MIT-licensed with zero dependencies, and it runs locally, so nothing goes through my servers.

Try it without a broker account: npx -y tas-guard demo starts it in front of a fake $100k paper broker.

Repo: https://github.com/intoApex/tas-guard
Full data, with a source for every row: https://tradingagentstack.com/research/broker-mcp-order-gating/

I run TradingAgentStack, which tracks these tools. Not financial advice; check each broker's docs before you connect anything.