AI agents in your brokerage: where Claude can trade, and where the brakes are missing

What this is about

On November 12, 2026, Charles Schwab launched its own MCP server. Selected retail customers can now connect Anthropic's Claude to their brokerage account and have it prepare, place and manage orders. MCP (Model Context Protocol) is an open standard that lets an AI assistant talk to other software, a bit like a universal plug. Schwab is late to the party. Robinhood, Interactive Brokers, eToro, Webull and Public already offer such connections. For German customers, Scalable Capital and Bitpanda have joined them since the summer.

If you connect your account to an agent, there's one thing you need to know above all: What happens when the agent screws up? Brokers handle that very differently. We read the documentation and checked it against industry reports and the directory awesome-broker-mcp. The directory lists 94 brokers and was last reviewed on November 11. Along the way, some of our starting assumptions turned out to be outdated.

Brokers for German customers compared

Scalable Capital has the strongest safeguards. According to Trending Topics and Broker-Test.at, buys, sells and savings plans must be approved before they're executed. Every transaction comes with cost information and key information documents carrying their own reference, which you have to confirm. A Handelsblatt guide, labeled as advertising, describes the flow: first the assistant creates a preview with order details, costs and warnings, then comes the separate confirmation. It counts 29 tools in six groups. Payments are off-limits for agents. Supported assistants are ChatGPT, Claude, Grok and Codex. According to Scalable's website, you can choose between “read-only,” “restricted” and “full.” Neuebanken.de criticizes that the assistant sees the entire portfolio and that Scalable doesn't mention any amount limits. In Broker-Test.at's test, displaying positions worked with Claude. A limit order, however, kept failing despite approval with the message “This operation is temporarily unavailable.”

Bitpanda takes a different approach. According to the Bitpanda docs, there are two hosted servers, one for the Public API and one for the pro exchange Fusion. What the agent can do is defined by the permissions (scopes) of the API key. With the “Trade (Write)” scope, the agent can execute orders on its own. The real brake is daily buy and sell limits in euros. Bitpanda enforces them on the server no matter what the agent does, and once set they can't be changed or deleted. If you want different limits, you need a new key. Bitpanda recommends starting with a read-only key and states that it is “not responsible for outcomes resulting from unclear or misconfigured prompts or permissions.” According to the Bitpanda Academy, approving individual orders is handled by the assistant in the chat. We didn't find a broker-side lock like Scalable's in the docs. We couldn't confirm details on key expiry dates or IP binding.

Interactive Brokers is where our starting thesis no longer holds. The standard AI integration really does only create drafts. According to Walnut, they land in an “AI Instructions” area, and you submit them yourself. That's why the directory classifies IBKR as “cannot execute by design.” But on October 21, 2026, IBKR also launched “Autonomous Trading.” Here, a connected AI trades in its own “AI Partition” sub-account without per-order approval. According to TradeInformer, this is only available for individual accounts without margin. First you need at least ten trades of $100 or more within two weeks in approval mode. The AI can only use the money assigned to it, only trade certain products and order types, and its orders are throttled. Whether the offer is available in Germany depends, according to IBKR, on the responsible entity and your country of residence.

At eToro, the agent first has to prepare an order with “prepare.” That returns a token valid for about two minutes. Only “place” actually executes the order. The directory warns, however, that a general write tool gets by without server-side confirmation.

Trade Republic and DEGIRO have no official interface. The community servers for Trade Republic are based on pytr, a reverse-engineered version of the private app interface. They need your phone number and PIN, which are often stored in plaintext. The directory warns that this may violate the terms of service. The best-known server deliberately leaves out order tools, even though pytr has them. For DEGIRO, the directory lists the server jaenster/degiro-mcp, which was only a few days old at the time of review. It uses the private web API and enables orders as soon as the setting DEGIRO_TRADING=true is set.

For comparison: the US brokers

Schwab is starting with a small pilot for Claude only. Only accounts with access to the thinkorswim platform can trade, and according to RIABiz you have to confirm every trade. What the confirmation dialog shows isn't known. The press release has no MCP-specific liability section. The backstory is notable: on October 14, Schwab CEO Rick Wurster said, according to American Banker and InvestmentNews, that Schwab blocks third-party agents that log in with stored credentials or via browser automation, calling it “not a safe way.” So Schwab actively blocks unofficial access of the kind that exists for Trade Republic.

Robinhood is the most aggressive. External agents trade in a separate agent account, but according to Robinhood's help pages they can see data from all of the customer's Robinhood accounts. Trading permission is on by default for Robinhood's built-in agents and off by default for external MCP agents. Once enabled, the agent can place eligible trades without confirmation. Robinhood writes that the customer is “ultimately responsible” and that Robinhood isn't liable for losses. PolicyLayer, a vendor that sells its own security gateway, also criticizes the lack of per-order or daily limits.

Who's liable when things go wrong?

The answer is the same everywhere: the customer. According to Trending Topics, Scalable writes that AI responses, recommendations and transactions “do not constitute investment advice and are the investor's own responsibility.” Bitpanda and Robinhood put it similarly. You pick the agents yourself, and they don't belong to the broker. That's why regulatory rules barely apply. In its May 2024 statement, ESMA requires investment firms to meet their MiFID II obligations when using AI and to stay in control. But that refers to AI the firm deploys itself. The US regulator FINRA, in its 2026 report, lists agents acting beyond the user's intent or disclosing sensitive data as risks.

Our take: if you confirmed an order, you'll have a hard time arguing it didn't come from you, even if a hidden instruction on a web page led the agent astray. Hidden instructions like that are called prompt injection. Neuebanken points out that there's no public security research on Scalable's implementation. The TradeTrap study shows how vulnerable trading agents are. When a data server was manipulated to deliver fake prices and news, one agent's return dropped from 7.81 to 0.89 percent, and it traded much more often.

What live tests reveal about AI as a trader

Buy-and-hold means buying once and then doing nothing. The claim from our briefing that the majority fail to beat buy-and-hold in every season doesn't hold up as a blanket statement. According to TradeRank, all premium models beat Bitcoin in seasons 4 and 5, but not a single one did in season 8. The widely cited figure of 46.2 percent profitable model seasons comes from a blog by the crypto exchange Bitrue, and we couldn't find it on TradeRank itself. Over the long run, though, the picture is clear. The FINSABER authors find that LLM strategies are too cautious in rising markets and too aggressive in falling ones. Alpha Arena operator nof1 itself stresses that short run times and small capital don't produce a reliable ranking.

That fits with the skill pack claude-trading-skills for Claude Code. It has around 3,900 GitHub stars and includes building blocks like a discipline check before every trade and a “Drawdown Circuit Breaker” that blocks new trades when daily loss limits are hit or after a losing streak. The pack doesn't send real orders. At most it generates order templates for Alpaca and explicitly describes itself as “not a broker execution platform.”

Our verdict

For German investors, there are three levels of safety today. Scalable requires per-order approval with confirmation, the strictest brake. However, the agent sees your entire portfolio, and there are no amount limits. Bitpanda relies on technical limits instead of individual approvals. That's robust if you actually set them up. IBKR cleanly separates draft mode from the autonomous sub-account. The unofficial servers for Trade Republic and DEGIRO have no broker-side brake at all and add ToS and password risks on top.

Our take: per-order approval only protects you if you actually read it. Check the ISIN, quantity and limit in the order itself, not the reasoning in the chat. Start with read access, and if the agent is allowed to trade, give it its own limited budget. The benchmarks give no reason to hand your strategy over to a language model. Right now, agents are most useful for analysis, getting an overview and paperwork. Nobody has publicly tested yet how brokers respond when a manipulated order goes through despite approval.