Hybrid [Refer to profile for meaning] "Don't entrust withdrawals to AI, even if you entrust trading." @pacifica_fi How MCP divides trading permissions Asking AI to check the price of Bitcoin is entirely different from asking it to buy Bitcoin. The first ends with reading information; from the second onward, actual funds and positions move. When leverage and market orders are added, the ambiguity of a single natural language sentence can directly translate into losses. This is precisely why you need to understand Pacifica MCP. What matters is not the fact that AI can execute trades, but what it can read, which keys it uses to place orders, and where fund movement permissions are blocked. [MCP: Turning Natural Language into a Trading Tool] MCP stands for Model Context Protocol—a standardized interface enabling AI and external services to exchange information in a structured manner. While conventional chatbots merely generate responses to user questions, an AI connected via MCP can select registered tools to query actual services or trigger actions. Pacifica MCP provides Pacifica’s REST API as accessible tools for AI. Using clients like Claude Desktop, Claude Code, or OpenAI Codex, users can use natural language to check market data and account status—and, if permissions are configured, even place orders or manage positions. Here’s how it works: When a user requests to check the current BTC price and funding rate, the AI interprets the intent and selects the price query tool. The MCP server converts this into a Pacifica REST API request, then returns the retrieved price and funding rate back to the AI. The same basic flow applies when requesting a limit buy order for BTC. However, requests that alter account state—like placing orders—require authentication. Thus, higher permissions are needed than for simple queries. Pacifica’s GET requests and WebSocket queries can be used without signing, but POST requests require an Ed25519 signature. [Start with Read-Only Access Using Only ADDRESS] The safest entry point for Pacifica MCP is configuring only the account’s public ADDRESS. In this mode, you can view price, order book, funding rate, fees, account equity, balance, open positions, loan status, liquidation price, pending orders, and trade history. However, any request that modifies account state—such as creating or canceling orders—is rejected with a “read-only mode” error. For users connecting an AI agent for the first time, it’s better to start in read-only mode rather than immediately granting trading permissions. This allows you to verify whether the connection to your live account is correct, whether the AI accurately interprets asset names and values, and whether it avoids calling unapproved tools. Even in read-only mode, you can fully utilize the system for market analysis and account monitoring. For example, you can build workflows that compare current BTC price with funding rate, summarize open positions and liquidation levels, and review pending orders and recent fees—all in one go. [For Trading, Use an Agent Key Instead of the Main Private Key] To execute actual trades, you must configure either an AGENT PRIVATE KEY or the main wallet’s PRIVATE KEY. Pacifica recommends using the Agent Key. An Agent Key is a separate signing key linked to your account. It can sign POST requests—including trades—without requiring you to directly input your main wallet’s private key. Unlike the main key, it can also be disconnected when needed. To summarize simply: - Configure ADDRESS only: View-only access; no trading allowed - Configure ADDRESS + AGENT_PRIVATE_KEY: View and trade allowed - Configure ADDRESS + PRIVATE_KEY: View and trade allowed; uses main key directly While the Agent Key is a safer choice than the main key, it is not meant to be public. If exposed, attackers could place orders or modify leverage and account settings. Since keys are stored in plain text within Pacifica MCP configuration files, never upload them to GitHub, take screenshots containing them, or paste them directly into AI chat windows. If a key is exposed, immediately revoke it and generate a new one. [Testnet and Mainnet Share the Same Address] By default, Pacifica MCP connects to the testnet API. To use it on the real mainnet, you must manually change PACIFICA BASE URL to the production API endpoint. Even when using the same MCP server, connecting to different endpoints separates the test environment (handling virtual assets) from the mainnet (handling real funds). Therefore, the first thing you should verify after installation is not the AI’s response—but its execution logs. Pacifica MCP logs your current account address and authentication method upon startup. Before testing any orders, always confirm your account, network type (testnet/mainnet), and whether you’re in read-only or agent-key mode. Deposit permissions differ from trading permissions. The tools for issuing test USDP and depositing USDC or USDP do not use Pacifica’s REST API—they directly generate Solana transactions.This task cannot use an Agent Key; the main PRIVATE_KEY is required. If you do not wish to place the main key into the MCP environment, it is safer to handle deposits separately through the Pacifica app and connect only the Agent Key to MCP. [Do not entrust withdrawals to AI] The most critical aspect of Pacifica MCP is how it handles withdrawal permissions. In MCP v0.2.0, publicly released on July 9, 2026, the tools for withdrawing Perp collateral (withdraw) and sending Spot assets to external wallets (withdrawSpotAsset) were removed. The ability to query withdrawal history and pending withdrawals remains, but the functionality to move funds externally via MCP has been blocked. The official release explicitly states this is a measure to prevent accidental fund transfers. This distinction is crucial in AI-agent trading. If trading permissions are compromised, losses may occur—but if withdrawal permissions are also exposed, assets can be drained from the account entirely. Pacifica has chosen to separate order execution from external fund transfers to limit potential damage. However, Pacifica’s current MCP Tools documentation still lists withdraw and withdrawSpotAsset in its tool catalog. Meanwhile, the GitHub v0.2.0 release notes state these two functions have been removed. When actually using the system, you should not rely solely on documentation—you must verify the installed package version and the tools exposed in your MCP instance. This discrepancy between documentation and release is something Pacifica must resolve. In financial tools, security includes not only adding features but also clearly communicating which permissions are currently active. [The greatest danger in natural language orders is ambiguity] Connecting MCP does not mean AI will make good trading decisions or guarantee profits. AI interprets user statements to select tools and parameters. If a user says, “Buy a little BTC,” parameters such as quantity, price, order type, leverage, margin mode, and maximum slippage remain undefined. Expressions that humans can infer from context create significant differences in actual orders. A trading request must include at least the following information: - Asset and direction - Exact quantity - Market or limit order - Specified price or maximum slippage - Leverage - Cross or Isolated margin mode - Stop-loss and take-profit conditions - Pre-execution approval requirement For example, instead of saying “Buy BTC,” it is safer to request: - First, check the current order book and minimum order size for BTC Perp on the Pacifica testnet. - Prepare a single limit buy order at 20 ticks below the best bid, using the minimum quantity—but show me the asset, price, quantity, leverage, and margin mode first, and do not send until I approve. However, simply stating “Do not execute without approval” does not guarantee complete safety. MCP is a specification for connecting AI to external tools; it does not enforce human approval across all clients. You must separately verify your AI client’s settings for tool execution approval and auto-execution scope. [After an order succeeds, recheck your account status] Even if AI responds that an order succeeded, the task is not complete. An order may have been received by the server but remain unfilled, partially filled, or filled at an unexpected price. Re-executing the same request after a network error may result in duplicate orders. After placing an order, you must always recheck: - Order ID and current status - List of unfilled orders - Actual filled quantity - Average entry price - Current position - Account equity and margin utilization rate Pacifica MCP provides separate tools to query unfilled orders, order history, current positions, position history, and account information. This is why retrieval tools that confirm execution outcomes are more important than the tool that sends orders. When connecting to automated trading systems, preserving only AI conversation logs is insufficient. You must separately log: tools used, input values, server responses, order IDs, fill results, and final account state. When issues arise, you must be able to verify which API requests were actually sent—not just what prompts the AI generated. [Why Pacifica MCP is promising] The value of Pacifica MCP does not lie in AI’s ability to predict markets more accurately. Previously, traders had to learn each exchange’s API documentation and signing methods and build separate programs for each. With MCP, the Pacifica REST API becomes a common tool usable across multiple AI clients—such as Claude Desktop, Claude Code, and OpenAI Codex. Beginners can use natural language to inspect their accounts and markets. Developers can combine analysis, order placement, and validation procedures on the same MCP server.It is beneficial that read-only mode, disposable Agent Keys, on-chain operations requiring the main key, and the removed withdrawal functionality from MCP are clearly separated. Moving forward, what matters most is not the number of features, but the completeness of control. More granular permission management is needed—such as per-order spending limits, allowed asset lists, maximum leverage, daily loss caps, and human approval workflows—that go beyond what Agent Keys currently offer. Currently, Agent Keys reduce exposure of the main key, but they are not a full policy engine capable of finely restricting permitted trading activities. [Conclusion] The most dangerous assumption in AI agent trading is expecting the AI to handle everything automatically. While Pacifica MCP connects natural language to market queries and actual orders, the final outcome depends entirely on the keys and permissions granted by the user, the precision of commands, and the verification methods applied after execution. Therefore, the safe usage sequence is clear: First, connect only your ADDRESS in read-only mode to verify everything. Only add an Agent Key when actual trading is required. Thoroughly test order placement, cancellation, and result re-verification on testnet before moving to mainnet. Keep your main private key and all deposit/withdrawal operations outside of MCP whenever possible. The most impressive aspect of Pacifica MCP is not that AI can do a lot. It’s that the product design now actively considers where to draw the line on what AI should not do. In the future, the competitiveness of AI trading infrastructure will likely be determined less by how naturally responses sound, and more by how finely permissions are divided and how easily every action can be verified. #Pacifica #PerpDEX